Malware Analysis Report

2025-08-06 00:06

Sample ID 240223-mnvvcsfd23
Target cj.exe
SHA256 22379bd12c9d3a3bbcebfb14069c396cd4e38c554dda4e8c295f03c2a7fd9e8e
Tags
discovery persistence
score
6/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
6/10

SHA256

22379bd12c9d3a3bbcebfb14069c396cd4e38c554dda4e8c295f03c2a7fd9e8e

Threat Level: Shows suspicious behavior

The file cj.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery persistence

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Checks installed software on the system

Loads dropped DLL

Enumerates physical storage devices

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-23 10:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-23 10:37

Reported

2024-02-23 10:39

Platform

win11-20240221-en

Max time kernel

81s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cj.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\6EA26FFDFC3C3CADAF6C = "\"C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\setup.exe\" resume --installPath \"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\" --runOnce --installSessionId 740ba5a8-e42c-4ce4-a344-a0ad9f066a82 --passive" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ASPNET\viewchanges.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VSHiveStub.exe C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\1033\MsEnvMui_Brand_708_0.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Theme.Blue.ExtraContrast.pkgdef C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\de-DE\ai-generated-commit-messages.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\en-US\scroll_tabs.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\en-US\winforms-designer-selection.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-CN\extensionmanager.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\es\Microsoft.ServiceHub.Framework.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Projects\Welcome.Python\Welcome.Python.sln C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-TW\memory-dump-analysis.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ProjectAndSolution\b-StartDebugging.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.70x70.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-TW\all-in-one-search-text-support.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ko\Microsoft.VisualStudio.Services.Common.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\CodeSnippets1.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\GitHub\ghtutorial12.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome\Welcome.WindowLayout.mp4 C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\it-IT\scroll_tabs.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Projects\Welcome.Cpp\Welcome.Cpp\Welcome.Cpp.cpp C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ASPNET\newproject.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.VisualStudio.Validation.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-CN\memory_layout.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ProjectAndSolution\a-ToolsOptions.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\amd64\msvcp140.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\IntelliSenseListMembers.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Projects\Editor\EditorGuide\Program.cs C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-TW\scroll_tabs.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Shell.Blue.pkgdef C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Shell\Microsoft.VisualStudio.Platform.WindowManagement.pkgdef C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ASPNET\locals2.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\Automation\contextp.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\it\Microsoft.VisualStudio.Imaging.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\ja-JP\devcom.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hant\Microsoft.TeamFoundation.Common.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\ko-KR\scroll_tabs.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\cs\vs_layout.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\Automation\coloader80.dll.manifest C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\x86\msdia140.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.150x150.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.StartDebugging.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Assets\Installer.150x150.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-CN\extensions-verified-domains.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Debugger.Runtime.Impl.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\ja-JP\devcom.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\Automation\coloader80.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Shell.Light.pkgdef C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\cs-CZ\event-handler-insights.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\zh-Hant\Microsoft.VisualStudio.Setup.Common.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\tr-TR\scroll_tabs.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\GitHub.xml C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\cs\Microsoft.VisualStudio.Services.Common.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PublicAssemblies\System.Reflection.MetadataLoadContext.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\media\cpp_memory_layout_thumbnail.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\RefactorExtractMethod2.png C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\VSInstallerElevationService.Contracts.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\cs-CZ\all-in-one-search-text-support.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Threading.Tasks.Extensions.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\tr\VSIXInstaller.resources.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\1033\MsEnvMui_Brand_708_0.dll C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome\welcome.ico C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.Identity.Client.dll C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\de-DE\include_diagnostics_reference.md C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\SourceHash{26768860-CBEB-408D-9F30-87E0DBE11A6E} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe N/A
File opened for modification C:\Windows\Installer\MSI995D.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF56E080E5C09F9E0D.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF6A16876E13AB7CBE.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
File created C:\Windows\SystemTemp\~DFE125C6CB3B6C1391.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe N/A
File created C:\Windows\Installer\e5896fb.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5896fb.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF8240F59CD8F70640.TMP C:\Windows\system32\msiexec.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\VSWebLauncher.exe\" /openuri \"%1\"" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\VSWebLauncher.exe\" /openTfsLinkAsIs \"%1\"" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vsweb\ = "Web Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vstfs\URL Protocol C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\DefaultIcon C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\ = "Web Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\ = "TFS Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\git-client\URL Protocol C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vsweb C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\ = "Git Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\DefaultIcon\ = "\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\VSWebLauncher.exe\",-100" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\git-client\ = "Git Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vsweb\URL Protocol C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vstfs C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\shell C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\CLSID\ = "{DDD49901-1DD4-4288-A835-F9C413C4EF1F}" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6 C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6 C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\AlwaysShowExt = "1" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\shell\Open\Command C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\shell\Open\Command C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\shell\Open C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\shell C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6 C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\shell\Open\Command\ = "\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\Common7\\IDE\\VSWebLauncher.exe\" /openuri \"%1\"" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\git-client C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\vstfs\ = "TFS Protocol Handler" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\AlwaysShowExt = "1" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\shell\Open\Command C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\AlwaysShowExt = "1" C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsweb.48dcd8d6\shell C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vstfs.48dcd8d6\shell\Open C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\shell\Open C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.git-client.48dcd8d6\CLSID C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeAuditPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeImpersonatePrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3860 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\cj.exe C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
PID 3860 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\cj.exe C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
PID 3860 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\cj.exe C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
PID 2544 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe C:\Windows\SysWOW64\getmac.exe
PID 2544 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe C:\Windows\SysWOW64\getmac.exe
PID 2544 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe C:\Windows\SysWOW64\getmac.exe
PID 2544 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
PID 2544 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
PID 3144 wrote to memory of 1976 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe
PID 3144 wrote to memory of 1976 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe
PID 3144 wrote to memory of 2940 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
PID 3144 wrote to memory of 2940 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe
PID 2940 wrote to memory of 4352 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
PID 2940 wrote to memory of 4352 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
PID 2940 wrote to memory of 4352 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
PID 2940 wrote to memory of 4440 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2940 wrote to memory of 4440 N/A C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\cj.exe

"C:\Users\Admin\AppData\Local\Temp\cj.exe"

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe

"C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\cj.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"

C:\Windows\SysWOW64\getmac.exe

"getmac"

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe

"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202402231037292847.json" --passive --includerecommended --add Microsoft.VisualStudio.Workload.NativeDesktop --add Microsoft.VisualStudio.Workload.NativeCrossPlat --add Microsoft.VisualStudio.Workload.NativeGame --add Microsoft.VisualStudio.Workload.NativeMobile --locale en-US --activityId "54425207-b9c7-473b-ac4b-7cdf87459d07" --campaign "2031:e926ff27edac4a86a5e9f44c3b108e10" --pipe "689c5e05-3ae6-4cc3-9d88-4d0f3417d03a"

C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe

"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 3.9.2164.57262 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe

"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 54425207-b9c7-473b-ac4b-7cdf87459d07 --campaign 2031:e926ff27edac4a86a5e9f44c3b108e10 --handle 328170 --locale en-US --passive --pid 3144 --pipeName e3c596564066462e8d62fe11568aa424 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"0a458e46-b559-4340-a433-d69b9b2416cb\",\"Id\":\"7d748a1d-4ff9-446f-a13a-6ba20b8a85cd\",\"ProcessStartTime\":638442814715579394,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.9.34511.75\VSInitializer.exe

"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.9.34511.75\VSInitializer.exe" -Operation Install -InstallationID 48dcd8d6 -InstallationName VisualStudio/17.9.1+34616.47 -InstallationVersion 17.9.34616.47 -InstallationWorkloads Microsoft.VisualStudio.Workload.CoreEditor,Microsoft.VisualStudio.Workload.NativeDesktop,Microsoft.VisualStudio.Workload.NativeMobile,Microsoft.VisualStudio.Workload.NativeGame,Microsoft.VisualStudio.Workload.NativeCrossPlat -InstallationPackages Microsoft.VisualStudio.Component.CoreEditor,Microsoft.VisualStudio.Component.TypeScript.TSServer,Microsoft.VisualStudio.ComponentGroup.WebToolsExtensions,Microsoft.VisualStudio.Component.JavaScript.TypeScript,Microsoft.VisualStudio.Component.Roslyn.Compiler,Microsoft.Component.MSBuild,Microsoft.VisualStudio.Component.Roslyn.LanguageServices,Microsoft.VisualStudio.Component.TextTemplating,Microsoft.VisualStudio.Component.NuGet,Microsoft.VisualStudio.Component.Debugger.JustInTime,Component.Microsoft.VisualStudio.LiveShare.2022,Microsoft.VisualStudio.Component.IntelliCode,Microsoft.VisualStudio.Component.VC.CoreIde,Microsoft.VisualStudio.Component.Windows10SDK,Microsoft.VisualStudio.Component.VC.Tools.x86.x64,Microsoft.VisualStudio.Component.Graphics.Tools,Microsoft.VisualStudio.Component.VC.DiagnosticTools,Microsoft.VisualStudio.Component.Windows11SDK.22621,Component.OpenJDK,Component.Android.SDK.MAUI,Microsoft.VisualStudio.Component.VC.ATL,Microsoft.VisualStudio.Component.SecurityIssueAnalysis,Microsoft.VisualStudio.Component.VC.Redist.14.Latest,Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core,Microsoft.VisualStudio.Component.Windows11Sdk.WindowsPerformanceToolkit,Microsoft.VisualStudio.Component.CppBuildInsights,Microsoft.VisualStudio.ComponentGroup.WebToolsExtensions.CMake,Microsoft.VisualStudio.Component.VC.CMake.Project,Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest,Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest,Microsoft.VisualStudio.Component.VC.ASAN,Microsoft.VisualStudio.Component.Vcpkg,Component.Android.NDK.R23C,Component.HAXM.Private,Component.Android.Emulator.MDD,Component.MDD.Android,Microsoft.VisualStudio.Component.HLSL,Component.Unreal.Ide,Microsoft.VisualStudio.Component.Embedded,Component.MDD.Linux,Component.Linux.CMake,Component.Linux.RemoteFileExplorer -InstallationPath """C:\Program Files\Microsoft Visual Studio\2022\Community""" -ComponentId Microsoft.VisualStudio.Product.Community -ChannelsPath """https://aka.ms/vs/17/release/channel""" -SetupEngineFilePath """C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe""" -Log """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240223103815_015_Microsoft.VisualStudio.Initializer.log"""

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C20F6D2D622E7D748F4F0BF303BB48BD

C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe

"C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe" -autorecover "C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof"

C:\Windows\system32\wbem\mofcomp.exe

"C:\Windows\system32\wbem\mofcomp" -autorecover C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof

Network

Country Destination Domain Proto
US 8.8.8.8:53 az667904.vo.msecnd.net udp
US 152.199.19.161:443 az700632.vo.msecnd.net tcp
US 152.199.19.161:443 az700632.vo.msecnd.net tcp
US 13.85.16.224:443 targetednotifications-tm.trafficmanager.net tcp
US 8.8.8.8:53 161.19.199.152.in-addr.arpa udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
GB 92.123.242.18:443 aka.ms tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
GB 92.123.242.18:443 aka.ms tcp
GB 92.123.242.18:443 aka.ms tcp
US 13.107.5.88:443 visualstudio-devdiv-c2s.msedge.net tcp
US 152.199.19.161:443 vsstartpagenewsfeed.azureedge.net tcp
US 13.107.5.88:443 visualstudio-devdiv-c2s.msedge.net tcp
US 13.85.16.224:443 targetednotifications-tm.trafficmanager.net tcp
US 40.112.143.140:443 sendvsfeedback2.azurewebsites.net tcp
GB 92.123.242.18:443 aka.ms tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
NL 13.69.109.130:443 vortex.data.microsoft.com tcp
US 152.199.19.161:443 vsstartpagenewsfeed.azureedge.net tcp
GB 92.123.242.18:443 aka.ms tcp
US 20.189.173.4:443 events.data.microsoft.com tcp
US 20.189.173.4:443 events.data.microsoft.com tcp
US 152.199.19.161:443 vsstartpagenewsfeed.azureedge.net tcp
US 13.107.5.88:443 visualstudio-devdiv-c2s.msedge.net tcp
US 152.199.19.161:443 vsstartpagenewsfeed.azureedge.net tcp
US 20.42.128.98:443 targetednotifications-tm.trafficmanager.net tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
US 20.189.173.11:443 mobile.events.data.microsoft.com tcp
FR 68.232.34.200:443 download.visualstudio.microsoft.com tcp
BE 23.55.97.181:80 www.microsoft.com tcp
US 20.189.173.11:443 mobile.events.data.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe

MD5 0498dae2d400a2d7dd6ce17e8dd56826
SHA1 1912794c0568edcfd3154d380d4967b5e8c0db80
SHA256 2365bcd615d2a78598b4e17a370b623482355000906a755922f5a1585c75837b
SHA512 e6c211a57bde9c9650adee7d35ef49bf68da1f3e6c904d0d93ed5df11fe3de8eed8f584116957750bc189bc814ec8b1da2dfabd6ab9110921171f32e99f903c5

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config

MD5 e72fa6d2f6aedb4e8814c7a0498bf0dd
SHA1 86836217dce02483a992e9057819997bc2962e39
SHA256 543b8d111ff469b7d1ed2469c872da3e4d8c20ce2121d4823d7e6091c6ef2fb2
SHA512 04bf36b5ce9de2d0cb77b06667e9e3c5c287d914760e2dadf9c3ac2226b82282c990ecb90b9e2dddbe6a56c193ff1f79989c4c2924e9cd6ee8682b69d8995d47

memory/2544-115-0x00000000009B0000-0x0000000000A18000-memory.dmp

memory/2544-116-0x00000000737A0000-0x0000000073F51000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll

MD5 da26d871d33413b7150082db471dc658
SHA1 1c74e3b806d621fbc78db0bf8007456503ba58b9
SHA256 e6033fcdde40bcc1a5aceea07e5ad19f2bdd55e22ce2d0bc396f6aa9a3686b92
SHA512 723c5e4df483ec5da1151f8257815e6126bc124154c07f9d5f183da9e031219f912f9e10cbcc0252e24b67b0daf777a670a6caa83453bf8968b003b30e123e50

memory/2544-120-0x0000000005540000-0x0000000005698000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll

MD5 00edfd7067dfce793de6576fd7bc41d1
SHA1 419fd05f671e57ab14138042ef422640a23afe3b
SHA256 9ed593d65db98f4f42ce094939878c8f6664c6d783e56dfaac7ea45c70790609
SHA512 c7e5822f497b4cd225fad311d01a712daa9da8a3686f96e4b36449372eb989a6c5a93e9288a157a921cca88a72085f99d6dea19218a8bfa478fc5e0e7dbdd096

memory/2544-124-0x00000000059C0000-0x0000000005A52000-memory.dmp

memory/2544-128-0x0000000005B50000-0x0000000005C40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll

MD5 9e04d9ad7637e775b21ef81d65b57016
SHA1 35ce4ca98036ae67d868340baaf2c946664372ea
SHA256 bfe4fc9f30d05649a2c68da2ad3bcb9d0281ed645681f71239d5645eafcc81a6
SHA512 e47e1c1a44840f5e4adae239659ab0a77360ff09d24221328a3a1a39e8f6fa83c4936c36b84aebf2a99a4b3fd1e509405321354b67009c43c24abb0f242e10c2

memory/2544-132-0x0000000005950000-0x0000000005958000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll

MD5 f523e0e2c9603dc1061162686d7bde7a
SHA1 61f0b9a8ee1fefcf1c390cd0a8429e5da4b2f652
SHA256 6043cc0d81ad5739cfe22f5c19871a4652c3f95e56dbbc71dd6a17b5965cb54f
SHA512 79d3fa436db532221d69e0dae09b5a9dd368505ca0377926bc1c6aaf6e00e4168ffba8393c95b598bda27ce87cdc735dcda28242f118d76ee675a5b77a3da6ae

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll

MD5 221b5be0f43a7a317cd1c3202b92d098
SHA1 82b57fec6cd9fdbe8b4aa72d7f6a5a07f6457d86
SHA256 4689cb48e363f31ec0d115a9746a57dfd5cd65dacc42ee0ea33908cd867ec6a3
SHA512 1712279c2c47aa671ccbaf4ed72654c661fd19e7c4cc522a599c3741a1abbc0b0b2c9e5d707a8615bd1db22671d009801e988f9fd57a471ac45c9353b88b8754

memory/2544-136-0x0000000005A60000-0x0000000005AB0000-memory.dmp

memory/2544-137-0x0000000005D90000-0x0000000005DA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Newtonsoft.Json.dll

MD5 081d9558bbb7adce142da153b2d5577a
SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

memory/2544-141-0x0000000005FD0000-0x0000000006080000-memory.dmp

memory/2544-145-0x0000000005B40000-0x0000000005B4E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll

MD5 2cfa68ab860c2108b65abb13fbe446f4
SHA1 a74a8a9955661d778094e9b64ccad6898af2a5b8
SHA256 f8b26ddef80a7671207c5f199a9701d1f102d980dea46ce215b8d7f1d2b9c795
SHA512 48db3c1dfac7ce1c28487246ac5c7257523ddea57bb1d7fd1bdd468370ad5bbc780e5f93cce532091cac07f50d5909e04cc4c1901ccad53258ffb8d6f22c0dbc

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll

MD5 9a341540899dcc5630886f2d921be78f
SHA1 bab44612721c3dc91ac3d9dfca7c961a3a511508
SHA256 3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
SHA512 066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37

memory/2544-149-0x0000000005F30000-0x0000000005F38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll

MD5 50f55482910781b196f481cf5dd66ef3
SHA1 8f0fbecc5a80ed5b972cbb191f59a5b63fc268c8
SHA256 01587ff6c39640107b046080e6b07327a3e2414eb245faa9e651271452d43f27
SHA512 a2b9447fd71fbfaf180b0717d9195b8bab02afd9281410d188de99786805cdc30d44f224d258e99bc73f0cdf1fc0e61f093c03579f2836efb20f1cb186e78801

memory/2544-153-0x0000000006390000-0x00000000063A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll

MD5 7032b5604263264ecb87169b534dbaa3
SHA1 7c58164c051d7c266d43d3d31e2a525d098adde6
SHA256 a6e92fd84ed8f218a7c7743301530609c09b05e069cae87671ea691faff13b6b
SHA512 aa00abbe1f33fc2f52b3867b0d4d6f778e07fa9ada0131c55ec0dd2746948f75396c93d0337aea4a6cfbac0d35e7517f2ea0eafa8147c4d8995dbe32bdaec6c6

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.config

MD5 a1716295292c8279c56a6d9695688ecc
SHA1 956fb3ad300e8b2b3046e9724bc54e4c104c1081
SHA256 b94dde01670fe958f7ef6576951445841076eae1876cd489c0705c15eb42177d
SHA512 75fb2cd1eb9ff07b23b9c4929fdaac820056d75b801ffb69e04113bdfc1a80c35d3711d50a176537ff4260c126d9f91b110910c0043e03a48ee03cca580743d1

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\vs_setup_bootstrapper.json

MD5 ad891c3b02a02419dc60db8c273a8315
SHA1 141a08ca0e25d56bdb35fc71e1c767667079114a
SHA256 186c4b16ee009564819730b358dbdbb0792fc27e602698c5f0a16e20104647c7
SHA512 64cdaf1d6d1b4072e24f3926f91103abf946ff044cda34a9070586c2d2927bcdfc53381c955e447a38965ee426373259759025f97b715158afc429080956196f

memory/2544-161-0x0000000006580000-0x00000000065A2000-memory.dmp

memory/2544-162-0x00000000065B0000-0x0000000006907000-memory.dmp

memory/2544-163-0x0000000006D80000-0x0000000006DE6000-memory.dmp

memory/2544-164-0x0000000007660000-0x00000000076F2000-memory.dmp

memory/2544-165-0x0000000005D90000-0x0000000005DA0000-memory.dmp

memory/2544-166-0x0000000007CB0000-0x0000000008256000-memory.dmp

C:\ProgramData\Microsoft Visual Studio\prpbg.dat.bak

MD5 4518da804e382dbbe316619ea6318fd7
SHA1 afc316956a9f13f8b7e2afb6fdf42d6b2c3262d4
SHA256 d1ee60fa51fb862cbbbcf638da72c6509e0e2aefef5a3bc6b2f3164e378b7ff1
SHA512 a21f43432e966cf7ca1a1e049d70c6c18aa1cf78ead205cf37c02c955a470490a7cde7e27fead9d1e5584a17f9969f93666fbdafbaf89b90c1df3dc99d5bb463

C:\ProgramData\Microsoft Visual Studio\prpbg.dat.bak

MD5 962088288d08bbdb32526ac9439dbb30
SHA1 24b98ef6360a07b898369adb3b0e85ffac0af3a9
SHA256 d4fc064d810d8ecb2ef25caa08a3ad450d1b5b72da878959c304df6776640ebd
SHA512 de5008083677fa76d22c4fc44623904cd7b7dc183b1bb0a93acaa1d992cf49809cae656dd1743e6685101e767118845db509ec98e39073538d0787f06928db88

memory/2544-179-0x00000000084E0000-0x0000000008556000-memory.dmp

memory/2544-182-0x0000000008820000-0x00000000088DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\detection.json

MD5 782f4beae90d11351db508f38271eb26
SHA1 f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c
SHA256 c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9
SHA512 0a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4

memory/2544-184-0x00000000086A0000-0x00000000086A8000-memory.dmp

memory/2544-185-0x00000000087F0000-0x00000000087F8000-memory.dmp

memory/2544-186-0x000000000BCD0000-0x000000000BD08000-memory.dmp

memory/2544-187-0x000000000B500000-0x000000000B50E000-memory.dmp

memory/2544-191-0x000000000C110000-0x000000000C160000-memory.dmp

memory/2544-192-0x000000000BEB0000-0x000000000BEC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jsb0v5zd.json

MD5 9b5bc10442f86b015e3ec11b15cbe7fe
SHA1 2022bab52c25622a7ba73c2116967f0fd8462898
SHA256 1211fa72349aeb9f8578a8405937b1bade9bbd578b5fbc2d1858462abbafb300
SHA512 7b59e801f1e9367ac8adc970eec47a14b01b986001593cda60f381d4f3f6852839c1204dc228e53377de7bfebaf418a2963a31f533f5c56029e1025140caf339

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\VSInstallerElevationService.Contracts.dll

MD5 17c0ba1f1d0db4256d4b08125ef53a10
SHA1 1f47e809325947c04ffc8c4146d526d706869e61
SHA256 96b8a9b40adb428b03b1a599f55b61c0280503455dbafb731a9cb8e457a99c59
SHA512 331ba3923f138a10a80a3cf4e7549b0054d5bfa98db483032ab49b0b1376bb9f56f4daf4f525049ad7d47d0ea10fca0b6d69d7a5f38af0819d147bc8c087b0ab

memory/2544-210-0x000000000B2B0000-0x000000000B2BA000-memory.dmp

memory/2544-211-0x000000000B2F0000-0x000000000B312000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\runtimes\win-x86\native\msalruntime_x86.dll

MD5 94ab867ef06d046b6f65adbcb0994638
SHA1 30768967ad3b95aaeb8ec671f96e176a6d5dd1fa
SHA256 e9501bd3899c05167ab3d6cde455e7c81bc4bd138314207f3cdfe910b21358ae
SHA512 81e20e97829bd2102e552bf78f1da4a6986ceca475c6514c7de9a40adeafdd7b15c15dd10af293df5b4c21e4b1c431c92591d19559c9c71ba5916d14d750c090

memory/2544-684-0x00000000737A0000-0x0000000073F51000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe

MD5 423db308c5177851b4be0fcd9fea503f
SHA1 17c25d998116ec6748e7297b41565640a2f04f8f
SHA256 01d3a079fcec01d9e1185f7ff8738c022cbc3cca19c327ad94a4016b239ce8df
SHA512 932d2a87efe80242d2461c76e3b24492803c455e3ae3dcbd9cf91a3e23b199d0e892f9f0501bb6f4bb4e71b1ad272b6647ca360ac82cc8b8e7de683de9469fdc

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe.config

MD5 9dc3b7d3b90bf16af33d3e5d2e81e8d3
SHA1 89d5a9e305456f755cab58ce0d9c7748552b0448
SHA256 8df494040a078046bf71772c6d9818cdb613263630feb46b0466c72096f7393b
SHA512 6bb3fdaa79c816c53241b939e793fc8f9b4ea9c1d240df3e9c11c175ab8dc3e6cf0de98f4f060bc0203cea14221badb3b60dbf80e06747a9a4087f1d8b39e60c

C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe

MD5 7ef31b969e86b738c50caf7a8d233142
SHA1 22c3b885ebc584a571a2316995c20e05255575e9
SHA256 c57becc7a244dcf5b29aa486ddb8cbd41d16518b58de0a917893958c5e460dcc
SHA512 bd3ec24742def678365ce841df98d154af218b72aabdfc43934f3ddbb57b07edd4ad80050879fe5262de778c79a0f40fd0f7fc9f940516f6992da4ea74281b47

memory/3144-689-0x000002188AF00000-0x000002188B1EE000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.dll

MD5 9a07a7869d09a809d932a2fa682c4e6c
SHA1 234390e8b0e13763533a5c88440757872c3d7862
SHA256 a300343632491e350ee83f920910fbe3d5cb5fb15a54b9a17dd52429a75a54ef
SHA512 824ffe20e5717867b1721c059cb86308aa29f023ff1d4c645aafe94c6bb4bb0c27d9cd77248d0ff5e35f29c198c7f8fc9888ff8985cce62e79f9fe2ca07c3c90

memory/3144-691-0x00007FFB86560000-0x00007FFB87022000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.Common.dll

MD5 8c571eeafd729745640f0ef8e2fa4b31
SHA1 3948cc1de14aed74ffe2cf551bd6f159981dbe43
SHA256 0b7ff8d48e7c49150f9732a719bf87b7d4cdfcf7b4b5fbb54f6bb8a8cf2afef4
SHA512 0cb27ae4554e6ebd4e298809a63e962a7f599d35910d12bf36c91671a2c8fd9e1242e53c9f5c9929c46dd0b74b48b0ca6c8e986058b22dd491f4419a360cc87c

memory/3144-692-0x00000218A57D0000-0x00000218A5932000-memory.dmp

memory/3144-694-0x00000218A5700000-0x00000218A5794000-memory.dmp

memory/3144-697-0x00000218A6640000-0x00000218A66F2000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Newtonsoft.Json.dll

MD5 02a7f7f24d937bf380b7f0002b6cc0b0
SHA1 5a74070bd92e477d21bc7ba07fd5823156a2ad7b
SHA256 e3848dc36b2a858d2d2e65aa69f2e768d49b080c8cc64a070f19cf54620f7cb5
SHA512 5c43ffe35ba72ec00b8d33039c12e1ac6feb2f2aa2d2e42ea593c212bc5b405f0bd74de994069d5e4e43f9c54bf7b3999585b8ebad1a855ce9a8a509376178ea

memory/3144-699-0x00000218A56A0000-0x00000218A56DC000-memory.dmp

memory/2544-701-0x0000000005D90000-0x0000000005DA0000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Setup.InstallerResources.dll

MD5 6ce6357d373cfa27ed2d0567f2d6585c
SHA1 031f3dde9df5799ed1b4d9f8e31b3eaa5e287a5e
SHA256 1064e0ef1248afc67ac55cf7dfdb3cdcff627498ba8687c26a235b7ecf50e79f
SHA512 9e6730a512c1e95f49f1c3d17dcecec6a0f77df368e66ed0aab2708f81c9510d927c50c060d528567c8fa2dfae8c70749220821d75b132622b61f48f48ca9ba6

memory/3144-703-0x00000218A5660000-0x00000218A568A000-memory.dmp

memory/3144-700-0x00000218A57A0000-0x00000218A57C2000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\CommandLine.dll

MD5 d19341e078860c6794951cecdea5fd49
SHA1 d27e2bd6ac200c8f3d2fda2b3ff7b9e458f73629
SHA256 06c5e63d6c5e8b22d5d21db563a3e1fc7ecf53124e1f370d732549f8898a0327
SHA512 5dcc564ec8655866286d40bee978b37e41fd645746279a3551ef93b5d3f93543569bcea44f9163978d2686c810f00e110d543d682ed12ea29869bdc8d7f2059e

C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.version.json

MD5 719efd5c481bf722c42caeff9fe8efea
SHA1 0b099e78ea518f8553760106dd303e3e1a868114
SHA256 c7df0d52a98e33ef8dab30d4a8082343f87952aa993da8ec7f6c24409874ecf4
SHA512 d42059a5c08f28a12a10c8251d05622d6558bc202a8d75979923a12c745a14cc6184ebafa03bb3359c2c7ac258b124f1d59930321ed3e6426377285169dda8ab

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Threading.dll

MD5 7ec0e494a21aabbd8302d424c8f6c611
SHA1 8453c581039d2fc69b55ebf73a8e90ac7022dc94
SHA256 5d232659bc044cf946451a3f1961a9cd327ef80f9f1563fb5ceeae64aee87920
SHA512 998d117fc2845ad6074e68c8c53ea44213c9a1f8b185c4d838c6226942aa581e3d27ad1b03c6cc1b20c2c41ea00865bd609f9ee10f9aba35ad0be7c149c0d997

memory/3144-707-0x00000218A6700000-0x00000218A67B6000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Validation.dll

MD5 a627fd8565f6f442bc7555c94126e988
SHA1 4d096f96ec09228d508701e3d288f854b9906c21
SHA256 83ee28811e6815914191db0c1d65278f62a20995786bb1d416f48e8a3e290274
SHA512 1b4bfe6e74658b00ebed000d82c5bfc242d505b3d48eadcf07334e316feb9aa791f7e803f27903cb7eb1ee5ec5900de4d87afc0a7e6a482f25e2cc84ca9c9135

memory/3144-712-0x00000218A56E0000-0x00000218A56EC000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Telemetry.dll

MD5 bbcc8244db84ad2031ac010633abf798
SHA1 de0cb65ee877663da272b4162a55a64ab8669f74
SHA256 8fe17ff9da7932dc01a39ed27559d5cdfa9b97ba14cbaa9f719087a241c8b82d
SHA512 d5682ea1aa9d50e9a491f8dc25c82907cde24ead2842ea392242e8cdedf49f68f3035042442738e147b5aa29d6328ced68007732298f62466c78fd10b276b06f

memory/3144-711-0x00000218A67C0000-0x00000218A68BC000-memory.dmp

memory/3144-714-0x00000218A64E0000-0x00000218A64F2000-memory.dmp

memory/3144-715-0x00000218A6500000-0x00000218A651A000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Utilities.Internal.dll

MD5 2dc1dc66b267a3470add7fab88b78069
SHA1 dbe80047475b503791038ed7e47389c062c15c72
SHA256 b044863f98af8d28f4f2f5e2dccb945c57439e1575afb37110e1eec306a6c89c
SHA512 44ef73aab50dcc13ccd94c0353c366818afb27ce73772d722755b04add0c4f294c7814c84da6069d9aa6136f2a48683c25062dcddd1664e8d32fed1b38ceca21

memory/3144-719-0x00000218A6550000-0x00000218A6576000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Memory.dll

MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

memory/3144-717-0x000002188CF80000-0x000002188CF8A000-memory.dmp

memory/3144-721-0x00000218A5690000-0x00000218A5698000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Runtime.CompilerServices.Unsafe.dll

MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\VSInstallerElevationService.Contracts.dll

MD5 3f103e7f1a705c86070ed57ff185d549
SHA1 75eb0cf6233a19df8f61a3674f2a81d0fae0e044
SHA256 116aceff3a2c4f278d118324f29276072dc0ecf222be960b3d2c94712abae6c3
SHA512 1886a2b199582a4fbf3cb50a3870ead0fbe95f956b66c0525b89d30a9f0d55ee22dfb0dde909090a62bc79159d6de5c4f9746d9d0939f11e6199033bb2ea1d17

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll

MD5 b340a021abaa327244b5f02542bd1def
SHA1 c4471b8c3bf60ed300ebce0bd843f017d205ad5c
SHA256 21e9388960143eab0323b9b56443b6c47439973b1682653c37e0e50217e3bb08
SHA512 1970ebe87910d0b7759cae3139bdb78b73e04b3c5a8a22ede42b772e1dc73bffa05d82a5684aba1b90fa265e30e510806bc5e782117ddd620612625c0a6b2d64

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.RemoteControl.dll

MD5 355c1a112bc0f859b374a4b1c811c1e7
SHA1 b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA256 cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
SHA512 f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b

memory/3144-725-0x00000218A6520000-0x00000218A6528000-memory.dmp

memory/3144-724-0x00000218A64D0000-0x00000218A64E0000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Markdig.Wpf.dll

MD5 e18f4e68cc56625bd205f309a5517b72
SHA1 4ed70f41533bc1e7612a3c83f72047ac6aea9228
SHA256 4968074072d37f02c5f6e85bcb295115a9633fb3b26d0ed0ddd7b54abcae6edf
SHA512 3bcd269c7629afbbce57764c6f1fdf76d85837148d41503f35c9d949f8ac4d42c09e87fc1fd47944f2a37982afa7d89a98eafa8cd7b990af08f0e21450a1623e

memory/3144-727-0x00000218A65C0000-0x00000218A65CE000-memory.dmp

memory/3144-728-0x00000218A6630000-0x00000218A6640000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Imaging.dll

MD5 83e105b9aa14de29a797de7c4ce9693f
SHA1 51064762644b315ae4a49d11966b580e8ce1ffbe
SHA256 7efefc9326536b95b74cf7d4dd1014c4928d6937aadfb28e4b76c8c44a9a554e
SHA512 971f429be419a77815773af7ac9ab0350a532cc7ecdf17b6bdc354e885f9d92b17a53f90ec3452287f0f5e854ec6da280eaef0aa43c01da616576a47964172b1

memory/3144-730-0x00000218A6C40000-0x00000218A6CCA000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\Microsoft.VisualStudio.Utilities.dll

MD5 ec52c9519320e3f2f7f21bd76f445684
SHA1 1af3d1f8b76f08598c5028c0ed3a36b505985b8f
SHA256 2ff6df707cc4924d458e9ad883c516caf8c3f301e4d963f93c45b689e311128f
SHA512 4ac3fa4bf3c5b3469198b2759693b393ecdf744510c3d169c804a467304e015f88e69d18a10d3eaf7d185af2b8a93cafbd311ec0b66fac6867eb0646b3967fa8

memory/3144-732-0x00000218A6F60000-0x00000218A7094000-memory.dmp

memory/3144-733-0x00000218A70A0000-0x00000218A715A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2MUP0B8L\DisabledFlights[1].cache

MD5 3786de4b37bb410ed52bc580689bdb9a
SHA1 4c21a9c9f84e16a2b969873c343c801bad22201e
SHA256 619374db8a2521ef5adddf7f763c135d1772366b222a4e11f1d69334bc1cbf69
SHA512 c2163e5693ea5ec7babd29af72320950dbe1af1ea0da2a298ca622937c36c73467773115cde8a8a664fcf3aba578b11f8882b5099b25dbab5ad8b47ddd3df808

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GOG26WIK\dyntelconfig[1].cache

MD5 3852330ba333f1eb867efc02cc804d2e
SHA1 43527ef3b8a8dfef01838b38dc82e7d800d9ee6f
SHA256 3aa6de96376bc07e38761d6aa5c95d2992bccbe94d48292e4ba52fc85159dd67
SHA512 8d751abf92a72eef6859a3dec6a23c21971ecb6e7dca6ec383311c1974018f01a7d3458487fe9fe26f67a18581dbb1f70eca1d91272acafa9ca1c101d00e4d7d

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\System.Collections.Immutable.dll

MD5 7b2a749a73990140bb21395e2c786f0c
SHA1 2f1ebb67e21b33c74c4c6cf217ac1f797959f18b
SHA256 d168af8e4a1263b5844180b1b371c5879b21b5b666feef7ca749b10192688006
SHA512 aefaa2ea20766775581da160291c234f5aef3a81a356ece2af4051f6c453c213cde2ebcae1986f9ca113d27aced45e50237fde3e1af8b2a1537e2098cb65abd4

memory/3144-740-0x00000218A71D0000-0x00000218A7204000-memory.dmp

memory/3144-738-0x00000218A6BF0000-0x00000218A6BFC000-memory.dmp

C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\en\Microsoft.VisualStudio.Imaging.resources.dll

MD5 774615d15815526e75b482d6b82074da
SHA1 ff70144475107c420adc612f98fbcceb9348400b
SHA256 6a0631dd4d368d4d6bdd546248bda26a14b7292fd6b88cf163555bb670d2e6aa
SHA512 e17ee370a3e7c522e805bc8b5e48f895878a61491dbefdd9988aef9c3f021e41bc9d913087a43fe4b23bab2da057453cc5f36377db4ba5b98e28633a7cbbf60b

memory/3144-741-0x00000218A7250000-0x00000218A7288000-memory.dmp

memory/3144-742-0x00000218A6F40000-0x00000218A6F4E000-memory.dmp

memory/3144-743-0x00000218A97A0000-0x00000218A97A8000-memory.dmp

memory/3144-744-0x00000218A97D0000-0x00000218A97D8000-memory.dmp

memory/3144-745-0x00000218A9830000-0x00000218A9880000-memory.dmp

memory/3144-746-0x00000218A9930000-0x00000218A99DA000-memory.dmp

memory/3144-747-0x00000218A99E0000-0x00000218A9A3E000-memory.dmp

memory/3144-748-0x00000218A9880000-0x00000218A98A2000-memory.dmp

memory/3144-749-0x00000218A9A40000-0x00000218A9A90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelAIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20240223103801_e8b3abf09de144fc812fe8f4472a7298.trn

MD5 fa48b71acd3d62f72230d028627fe697
SHA1 bec36d144ec81b55f5dbd2338d87f497380f5ae9
SHA256 a58caa75d749a889725b18b7939f98be53b6ad7f1fa0f3f96e9f884e84665629
SHA512 b85534a1ef27998de80dd7305af1f268d5a688009030116a02b7dfae94af70ed2081985634b3d05378d9d60092f54b8e640e8a9c0e4e13d8706909c7a5406578

C:\Users\Admin\AppData\Local\Temp\em1kjtjz.k4o\f1pr5j1k.json

MD5 e45aae2c6be3f2194c7fd8e1e98292ca
SHA1 02751b86f73ab24d52ecce4ab89e4bf610295f05
SHA256 54eec00faae1b4f0a13a3d1593c3263bdcf80f5ddd5b542d58934707afa9730a
SHA512 922603b29b620aa9c3a341fbc3df7dc683bbc315d82071ab994094e019658581dfe28d26ed7f8893f4ebabf7c26dc8e553c59c4aad2402a667a1ca002fec0db3

C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Channels\2608ca85\channelManifest.json

MD5 d29a73b32db1ae25de4e5687970eb9e5
SHA1 8203a341c60870b819a93b51bdb2c7d46e28d0b7
SHA256 3bdfa2537067fd75c4dc68d02b69c1baaba9936e0192f918c05082af367a3a65
SHA512 cec67dfc118e74f37b7e0c59705e18343ac07ee486acbae366a3eba0ad53f8927f9d404bace95940cd8d52bd4722f210a14513cd4ee460624c5653eed9bf8dc2

C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240223103801_25839a0f7a84451baf1bb1c36aa96c3a.trn

MD5 2e1579209b2c452408e13aec11f32735
SHA1 53e2ad9267f2678fe5b43c42f4da4b496d3ca7a1
SHA256 1f52a811ad5110745f9f96bace238b737214286caa5ceb9dcdcd3d02f5d0df51
SHA512 a43cd8096005fd5aee3f0bd618406323a4ab0f56e94aac7c5d088207965e7a4e4a68fa573b429236dd9ccd21a8461489425291ee8ccd6620a43acd9d68088391

C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240223103812_8b641e73d2b84619bcd626f12f605902.trn

MD5 dfc4a4d820b44cf788efca9ff85e294b
SHA1 0fd03a2314a01207ebc9647182efa1f2b83a27e6
SHA256 9418c1bd796b62b5652da75da920491b848ed551127dc6521447dac1dea6bcab
SHA512 5bd0dbecc362c7e3d1ac4c7d83c0fdb80d95da081b34d76c41a212b3f5a12b5481da3018c141186d5ea5348d54e97160b619d08464589c0ede7d1c6924ca96cf

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll

MD5 ac75fe257060a27c27e354ccb4d4dbdc
SHA1 14f6b94ec756eb72806bcf360d8140707a4dbcdc
SHA256 e651e234273785161d0638380b33c590f8241374e2d40481dfa4ce2dce446c7f
SHA512 673234bd25e583ba1e5cd1d6b7ccb5e10b1936f6270d14be231929c9c43254417d53ffc8131ff9c73c1833fcedc39a93e5c056d663a2438586dd0480ef173732

C:\Users\Admin\AppData\Local\Temp\52e9d694838c8ca7aa1327\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll

MD5 48261e2f87ce8006ae87a063e00ceeea
SHA1 b41f999bd85cd8dac650b4289665c5b928a58611
SHA256 2dd11fdaa051d1cce899bd6c3b30dddc3dbb3a3ed65463fd16b90f4b8bacdfa6
SHA512 03f7a81344a85ca42b3e63a5bdd916c91bf3ee6e4301d50489b573d432a98bf9721ae9602bbe0b0bf9d66a44f1dedebc96f2631af57203b237a541fd0b577616

C:\Users\Admin\AppData\Local\Temp\auy0bigp.g4u

MD5 bb64ca1f8f96152ed2276e6a3d509f20
SHA1 0bd65d99d9240f6daac49a3a6224d5cc048b0c56
SHA256 0a8b451dd6ed07e0b414e20522ab0b8058047d251ad72d5bd1273d63a7a93a2c
SHA512 e6e0e8c149d697b9d35c6cf2fd7b8ec5441edadc7485cd5dd8eb4d7037afe01c76b70ee0f91c408b538c4e4a3a6756bd67a532e4d978541c2050ef8e13882ed3

C:\Config.Msi\e5896fe.rbs

MD5 0caacafe310e52c68ac53e030a1ed445
SHA1 503b1e148e9042e3b1f74a97078dc51f32216e0c
SHA256 be3a4507b431848190d41ae32b497bdb66108414b5f2d6bd2862e03d534f85c4
SHA512 3a1b43e909805936a781a63afbe11409e1f629845595e8cd450b400433092a86a05fd07290cb0c4a1a125d2442eddb229b4d9dcea5084b8b48c280b7b2fc50a6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Auto.Resources.04C80808D971051EF985\Microsoft.VisualStudio.MinShell.Auto.vsix

MD5 21a83c11afa0ebb1ae4e00508223491c
SHA1 5b7bb4dd5cae9a418c57d9b04d7849526a28ad48
SHA256 052ae4b7e084693ae8aca3ba67bcfab50d0a4272be3c250567f9760f54694ee9
SHA512 831236940da7f98b67c9e4dc7e3596d6f0552539b2a40ca4455b40d30c19cfa2f831f6458b81cc0cc01770d34398dd26a759887ee6d626fdff5b7b4af6e9b316

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.UIInternal.Resources.FB2EF554A754170D068E\Microsoft.VisualStudio.UIInternal.vsix

MD5 6743d4a8c4849cea197c5aa2158d1d49
SHA1 f4b0dd8f403758e81e2b51ce76bd6d430de0f58d
SHA256 21b4072bd0fc8c6b5437b4b2db8c9f92332bb2c15b3e2b10be800d08ecef39e3
SHA512 b24173ef0bb8147bfd3ad57b32bb06453da129d064d486636b4a4b885df80f1593db51eeb3fd5776dfb36279e8e67ceaf4c6f0e692640dd38e2fccd6d91d35fc

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Branding.Community.03696787AC5BB322DA2E\payload.vsix

MD5 3f486b6634799210e238806ed02ba769
SHA1 3d7fdf94f0fca216d0d83f859a2e72c5389a2723
SHA256 24930084ed4f89de4bce79056e75da607e3691a6f19b82bc706a53c22ce02185
SHA512 438d60a94f06328dc9d36304cf5b3d20318c93c9a4fe6a4772f7f2316cd7b8061ff0810299aa13ce6ade2fc13ae037d305e44153abc4120e3563f32a714f3342

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.CoreDotNet.4081C758C18420C1ADAB\Microsoft.VisualStudio.CoreDotNet.vsix

MD5 460c51dc43223cc14e35a90dd07ab526
SHA1 2ff7777e23a9f0463b48102cf03be82254f6e3d6
SHA256 49e3a6cd16c20db6c092e998a8a7c78988abd536be9effff405861ffcf86a2d9
SHA512 c1e6889f6ce6520b9fed0e01bd224a93cb7b43dbb1676fad4ea0adbf9bc160b60cf0a12a5931f26a42cb21f284d7e27ad9036eff6537e5889bec5d4924e2cea3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Devenv.Config.C32BBB5FD7CEF7984340\payload.vsix

MD5 d791bdc3f64e207e46afb53fe5c6a1b0
SHA1 8a8e63cfe51d97b64f3e824a522e4388e7e40306
SHA256 5c88ffa50ffe006a6923c92a9ca484d71e863f4ec864d477e69b79227c4f4232
SHA512 7146401de158ecb28565f5e11ea411e529eeb76aba4a0ef942301551729e273b4a2ef9877f1f2f0ecbe783f3978c66546053d8c21c6b67cc5b7e468eaf4418dd

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Resources.x64.58B09E56571CB0075939\payload.vsix

MD5 c9ffd14f923579bf58dcce9fbb13d849
SHA1 5c195248f15ba4414554cb94c6277a58de746400
SHA256 c0a0872863f8d757d4a3b0ebeda115efc2a948c6f4cb8fa3444d76a1a235e65b
SHA512 edc0820ae0b53a488dd1bff152a265ffe73e292037d7995d98d93efd993fa7196237f82dfa89eed269b277bffffce698d399cb84f6bb123a39ae08def15f8d8c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.NativeImageSupport.5F1C80A5F434E0570C03\payload.vsix

MD5 92f07eeb50e6c0d4d1cfe416d50dbfa4
SHA1 f6b0643aec8cc34a5a23c65dff15611eda861817
SHA256 81bfe435caa9f8fe2a616cd6f7aabee6896d8bec0f2880e224f5d0e4395a79a5
SHA512 379b86b976d18fb817865be1d0c3c7604ad085cb1d1fe240b77effaa1a4e4a46519555ac3209c2b31443df9e527d611d7f4d70c2145b08f173cc3a631db4718d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Auto.9E982AAEEF7104B6D9EC\Microsoft.VisualStudio.MinShell.Auto.vsix

MD5 eff0f93af822228c61f928a859df9668
SHA1 5b6bbf5639d5ec080196704507ec010ac4be99e8
SHA256 c58d34aa28f8f491f70518283b9de2a860ca3efbea0257847626c73a632cdfee
SHA512 3f176e8642bc3fce7cc94098f2560b94cf0051e677dccf7d6a8dadc766546404c10e14442b6fbca94b3ed21c03714927e4ee2cc6a1c8d1e71373febf52513746

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.ExtensionManager.Auto.11DFBE11F428EB93B1A3\Microsoft.VisualStudio.ExtensionManager.Auto.vsix

MD5 dbf11a6975144e35da6998fd66cb0e58
SHA1 529d590ad7dbb77aba3858ad3ee92c0a05dc78ea
SHA256 7a82d0edeb5d8544be9d71d6b7d88f112dd4e439caeb3b207d612ec0ba6fea9f
SHA512 8c4bf87e01c52f51692a29cf41330645017835dadef5ed5c93cbf2c72faeb024d2fe1087da7966874bc7fe0c6a7d1ac5e76548f15c0aec61117e4955b266c0b6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.ExtensionManager.BE8296988EF77946AB13\Microsoft.VisualStudio.ExtensionManager.vsix

MD5 62b88ac13f974d17284be815ab40e9a1
SHA1 3092a3169c944eaa65641f873d41d7c19fb3263d
SHA256 8d761d35ad395abd07d77ff0d8070c2f42203f9498047e0517ebc153ff96a4ef
SHA512 f358846c06f00f61c4de67559e9254fe0cf70925c822cd767d0cef404e7a4605d53401279fbc3c822f12d0a744ae2d7d5b7c446244f163cac1b8a0777aac449c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Initializer.1DAC8EE9D3CCAC9FFADE\VSInitializer.exe

MD5 e98ce28f9875c51337164053cf9e1971
SHA1 12bf310ac49bee59f9bbba88097ab4d6fd7fe0f1
SHA256 4291777ca6e35efc6b7c597718881e55b4301f35ca24ba983343dbbfc539a90b
SHA512 fe3c221209ee7dacabf0cd01ead6c9669adf310459a6e6443664118f329f273c736f75a8066546c4dcd365a69b12bd87f5ce1601166be82250fc3f362ea38ef3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MefHosting.C0CCC984C68696721273\Microsoft.VisualStudio.MefHosting.vsix

MD5 ec6b7a250075e2ca28a653ee5eaf3663
SHA1 c2815116ed27ada23be5a2735ed8e549f6b4ab88
SHA256 24cd983b39a1fa167eeedb97f84c21109cce64a9d94ca0d9e1c70357ce4ea116
SHA512 c23a702e22c22ebb8d73d22185b78a72a933c501fe3ba97e025c00372d2d51014960bf2e9166276fc43ff2979dde4a930e81aa22c6bed06bb04605b359891299

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.UIInternal.Guide.F0F5765B2FFE23293F74\Microsoft.VisualStudio.UIInternal.Guide.vsix

MD5 e04253269ad8229d580acc46f5663a39
SHA1 8810656184c770602509beb44f390c7d4d56a7cc
SHA256 fd5f59292c9a1bc91a4acaa8b9e0eaa0f4b6de9a0dc79e51d19e40250d5fa2dd
SHA512 c8afdfb236440db697b5dd762cf34a3349f5fdd2b7cf68f045e50d1445cc644fe01aa2c076ce2a13a78d25fbf3d11116fab89642eaa8c231e7821405b224529a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.LanguageServer.3921EE168589F1BC60DA\Microsoft.VisualStudio.LanguageServer.vsix

MD5 c38d5a6967178bbf79b7f75f0019c0a2
SHA1 950eeccbb933d83c666d897db7f1a7c9af988aec
SHA256 f7a55d1d11fe505d0b7c6ed9ed48edd9f2509d102e3c87ee71816ab916c1d555
SHA512 770190794a545091c35499d03f5fcca531883915f59ffb379a5307e6bb19811b9348a68b0b5d557409432ae344b9f03618219b70f77a27fc7ee870a2cde3cdd4

C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\48dcd8d6\state.json

MD5 fad142f7cba02d9281d36c8626192482
SHA1 6c9c35ae7aae2a26d1942b06f5b53e62be92ef00
SHA256 ef63a68fdab64e4b4562fa1275553c13b81a41bab457e53af86c0c53ce26e36f
SHA512 a6e1362434c7cf3d3811ba3986a0ad014f6ab249d0bbc0bd6e62c59d2f72a7d4efef2ffe448a2e0f5e5a0ac0d165bb8c57591c9e8dc39cd9598ee92c805b7ddb

C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Instances\48dcd8d6\state.json

MD5 28991694a2c44b194156e60fc362924b
SHA1 5b3cc3cbb6fe853f37e1683ce7fc1679fad5cd25
SHA256 9a2b8a3251cc3eaeb974fb8290c22aa05a0e9160c05c0c82315c1cfea9d5a8a5
SHA512 b547f893315961c5ab81a813683cc4662246bf747ed75b356e3e6bd53f54c39a623da256369a97eff78bb8dc1d393d10904ee1de358960fdeabae1f99b3d4b75

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Extensibility.Container.3A8B96309101687826F1\Microsoft.VisualStudio.Extensibility.Container.vsix

MD5 49a6b494d9d8ce820e806c8a2d7880ed
SHA1 af6360e8a02e95bf88f0be7552ebfe56afc795c0
SHA256 9d8f2dd7273ab255201fdfcbeb0c9d1cf3136e480166ea7ae03ceb5e29dc8b75
SHA512 c2f1166ecb6d383b36a5e65f95894608d519e868d08ae051513a1af3c946b7abca7626bec307b4d873b87a45672600c00bff9c9acc4efd1b769b7ba155381bbe

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Setup.Configuration.Interop.A5C6FED689D5543E419D\payload.vsix

MD5 90d0b73a243e9339914005b1b2ada116
SHA1 741a8e74825f1fa751c3c1cdfd73fe4cb51eaf20
SHA256 c2947ba80ccb2f7622e5e715e205b6aeaf71bb22af534660d761471e5701439c
SHA512 3c55a79607ba7a71ec4874e379f1cc37133464812921b3d310b36124e2864b5fedbc9e5b85776d1bd71d1f4db7d3fc7f5e3192c4f335056b703c6771be7ad295

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Platform.Terminal.20808B9A71BA3F057B8E\Microsoft.VisualStudio.Platform.Terminal.x64.vsix

MD5 0d6f91c731c0f967e26bbf36d474892a
SHA1 e423d3901d4382f8e4290430f08d1f02662e081d
SHA256 1834dac4fd208d3bb9e9e7120e70b04440589a9e8100475de85bc166d47e7a52
SHA512 24000a351d335dea8d8eb97cf92bad5ad1f78e8fda2c2c7c9017692d6eac4cd38d960cf1d07cdb562cf26f17c4bb3cf1f0fc16b43b390e9a37f7958eb2fabf7e

C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240223103828_89f097d8cd6c4a78a894fc40b4923913.trn

MD5 26b6e169661da6ee51e375f2ca6b0990
SHA1 698cfc485743c4c21716bd14a121ba9d1726ce14
SHA256 88c73b7557a5fc6f04ac46eb8617f8ff355c93b76828c395930f4b442dde7a13
SHA512 b449f728f646e7620296b791aab7a9c06843e195bc51e43ca0fe2a6ea6e4682cdc169674ff9015f68f2241d47be6337b9f1cce1b463c35bc636ede7dad652f3e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VsWebProtocolSelector.Msi.7FF8B5569BCB44939BBB\cab1.cab

MD5 9b93561893199b8c1487606f06757acb
SHA1 69211cd924ced6c9ff86cb06bbef36f6ed425f89
SHA256 7f2c5716d6c30dc6558ddd748aaed2c97e70f0a37be5e2abae6cd8b4730ceda3
SHA512 5f5d701b4a768d3204572b0bd4af2c1c82970838f79376d4b88c1b7b6acbdd67cde1543ccf3052af65849e7e6334a02ec10d8ccbacb1b2d275ee6887117aa3a3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.GitHubProtocolHandler.Msi.CAB262E283853EE354A6\cab1.cab

MD5 4d8c95d106019b1eecb50e5651f674e8
SHA1 a39af8be78e9c391bf32ec45e0dd734f6fec1a2e
SHA256 4cb3b3006332f75efbe19e225b6db817c46748809231c173cdf8036563f177cd
SHA512 1f99a6127c9261e90e07a478efd742da6b4b0396837ecfb1071e518515b65296fce2af4dbeaababaa77b8c0648f1b0e9c4e8d75ebc40dfccc570d2fc0fd2e5d8

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Platform.Editor.EC7FC355CAB353F52418\Microsoft.VisualStudio.Platform.Editor.vsix

MD5 4f2d23fc5c6991517a1cff81eba33804
SHA1 dde995db2d3836355e25855938cc5eb066352da1
SHA256 fb4614e64cec389b7494bd9da1b022bcb028303bda30cf467e6e984eb988a456
SHA512 04239e27da80a3712178dd48889678a8b8641b615ce9dde513767768207797e85434e1372b8f63e95fd452965af2d70218129196b78bc89b78f8533b42c0e113

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.UIInternal.0AD5C29C679C0FEFB1FA\Microsoft.VisualStudio.UIInternal.vsix

MD5 28e8e1c76b3f17587d540e603767b6e3
SHA1 caf56a40570084c510cea7c521d9f0323098980b
SHA256 ee616886be09faaf5449878b922b9cb127ba557bef4bf3fa8350dadacf1e60bc
SHA512 d12e21ce4896d8bab2b419b64be58a170999d307408157acaf83775fdf8170078ed9ab9bd9d661ecfddefdb027416d8736fa1c9c42069cf7de174fd959963c50

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Licensing.CC0DD423F73451D3FAFB\payload.vsix

MD5 451060c9ba8fc8a82a0969116e33eeb5
SHA1 42b6a256026f0aa6a29319d1a1eb04a5e0214223
SHA256 eba407bdfe16212328a6307d07949c478053eb14904ca3f6106735c32ccdccd0
SHA512 18c377aae1a426e93538bcdb44ade1d8da56d6d15dc280a1d26faf6564c1c46022b0256e72610462fb5b0b11e5ce221946f077eb938d9542034a4053fe6dd206

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Targeted.0843CED99056EA39689A\Microsoft.VisualStudio.MinShell.x64.vsix

MD5 2bd26499f9019ac2b48ee006d9aa0fde
SHA1 b290fbf2e01811ee97bb826809f4803f40ebc18b
SHA256 50fb1f41091a773d4f983e334eaab959f5d2e44a106a4884a5884598de443fbf
SHA512 73d961ccbde19e375f362e1e9b0ada494a027276b9925ec4cb5d55e093a743dadd29a355aeaec33fc0431211258b25fcb4a74daf71be8c3a2aa9b8e45e0be63b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.IdentityDependencies.B1C1E5FC4D5A7CD895AE\payload.vsix

MD5 7efdad5e7a9304fdcb143bc125c46fcb
SHA1 648b08ec264b3c3579542326a04a1bf19ef1bc13
SHA256 a972cdf2d9d66a8fadc6a8f578d5bd4d32cbd068c38e3cfe6f74622811aef339
SHA512 2ed87436e50f17ef9aca4c4bc8fbab3ed3a1298fd74d80ad5a68fe3e8a6cbb1fb7cdd95abcc22333ab16647382a332fdab6865428c0b97a528d8d8442456e8e1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Platform.CallHierarchy.ACC0136FCF7605413488\Microsoft.VisualStudio.Platform.CallHierarchy.vsix

MD5 015d4bab0cbe787ac00fbfb63dd68180
SHA1 ed7c9320adb02a1ade11defbf7600125e24afe64
SHA256 443ef3eb9e270a7ceae0fb1412e852cf6150610e5e23fd543c56847ef8d978d5
SHA512 34d56333ebbc41a3043282d0394723a04f4d2f583b83fa4c0f4c6bd19d3acd0d5224573e8c0eb68ff4ef29c9eaccaf255307d3775d2d3a252d1635873f2cf5f6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Diagnostics.AspNetHelper.Standard.40B71FD4972EC0A4749F\payload.vsix

MD5 3ef00944cf4c3040edc1774eac18595b
SHA1 59f2f1f5bd406cafc0bfe57fb556509bbae52d74
SHA256 dfabc9f99a171bbc29e6062eebdf8f2e59dcd853c8163b8ff12fe085602e1ee5
SHA512 7ddb70fad67cd4a9c7b0ecc13159da1ec995d1a0a082b5cc1ec3c1c44f6fbd69a87c68326a6b3600c0b7614d6811602d627b862165c61c0283ff4329be821d3a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Diagnostics.AspNetHelper.08A9843F4D074A2F559D\payload.vsix

MD5 684ef9d9a71bd35140d6cafcc0c0a0b8
SHA1 69742dbc177770b416a72c37607cf30c437b5ef1
SHA256 27a8cebb532b5de6e31ce8f1f41828ccc48f351dfd99ca21e63d2833f7a00f2c
SHA512 e15f6d1866a1c190c6b9f597626b4d135efd2de6060a632d2ef686b087e746ba7c3c5275a917b499d8c74afaf4cd8cd75c9c2efd174022c201755a75dca0b9d9

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.WebSiteProject.DTE.758F9F19821B83C0FD83\payload.vsix

MD5 b78386a994b8c2b0691405704745ad2a
SHA1 303506170adb5b58627460fc8c5adc0e9e22cee9
SHA256 f8edfe25c09c86a3b1bfbf873e127a8e327e1f327fe6ede2c605c9fe8ba5b19d
SHA512 6cea818f7ca14f2585c1be594ccf6b70a6ac54f958eaaef23c5f0679451b7c37699ca46386eda144ce0a0ca0f543e98c548ad9ba0fb821d34dbf11a1912152b3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.MSHtml.5329BE591AA88FB18EA6\payload.vsix

MD5 31da3ebd001aa3f08d78b7a9d6ff864d
SHA1 2633d67f9a0f6457fb47748f0dbc6dca4dcdcfc3
SHA256 a7ed387013707abfa929b930965505a5ed3661808b711b246fe38960e9b940ca
SHA512 9871d0bcedfcd236dd5344d96bd4969136f248e0a9d5ff7a76bf09b6a92ec7a1c886f0fb2cf23530e2aec0e5bc46d487555f91b2b86f4c6b7fdf2eb700fffdc9

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.Resources.Neutral.317AACFAA59D96C5CB5D\payload.vsix

MD5 778138cb797c27ad44a2b3aae61881f5
SHA1 5251cd4cb195edd1c9ffdf14857245cc557635da
SHA256 537277673cc00449c3aaa9e951fe87da92ee01d71c1d316787cb318bf5a51702
SHA512 aa326f5cacf95972e645983b52ffe78715f2f7079a28e04d7cf5131cbf34e46f3af7829b0b386d963a643d5f548974f9bdabb1a6bffca5f5546a9985bcff27e1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Net.Eula.Resources.37569011B3ED40EA2295\payload.vsix

MD5 199999ca21a8013f00cdb2792479eac6
SHA1 997941fbedc52fa36476d790e16c4f484013c856
SHA256 1ae82e5ce0aaa97f3fc37c8bf9cfce8d18d4951dce6c2b9279178aad513c827a
SHA512 bca79f89192cae5f17a33bf00d293bdfceb83c6885eac958b4d021377a06453bb5ea505577cd4e9c30a1fc1f552d2f5a9f35ecde232976a1ed75e522c649c5aa

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.Resources.NeutralExtra.1B2A22438D28A8123694\payload.vsix

MD5 a94d0e4fc297aa8a07d6e8b2c075adcf
SHA1 5bb732da9ffc1c7265e8c11f9d5e572d1d36c9bb
SHA256 3c0aa95a8e59cc205a714dd3931a20f10c25ec090b903cb487daec44cc7f87a7
SHA512 389db53934697ff698eef14f5022ccc30a8ffb69a58dc9b0636eae408e6830780eea07fae96b4dd7983a5eef23b0da0431835da679b2aa4ec3ac16591001cb36

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.CSharp.Resources.Neutral.A39B12EEFBAEF5DA9F1C\payload.vsix

MD5 99b200b1e3c3a137e55492634999f32d
SHA1 4f86dbe9f23a73a81009e1d138a6001fdfd4cc5d
SHA256 7738a766921a7b3ece833021f8bfc59387cfe9ce4d096622be3ae9ba600377f0
SHA512 3e60c6b088d431f342274aec9a713757b7904e3cfb3e9de0e624e0ccc68112db9abe70525a5fcc78f90cd65f5767544ef7c0b3bcb1d79bdd355ef9910c5e8f63

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.Resources.Targeted.AE6F4412007DFE35508B\payload.vsix

MD5 c5408ed3457e564b0071f8e002e2d60e
SHA1 698023c37f5e5b7478d1ed8fdb3047c8c32a0cc6
SHA256 63452f7689f39bd35df6facc8ff606883ac73234094c189651c5dd8b6ae21ca4
SHA512 bfef8ddc5909c6c25c385a029335b9ebff1eea3142aebd9ae256c53c2a25e70d11f8e8efaafd01ea851ff128db0e159b13b6bd827e103656258490db2a16be70

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.CSharp.Resources.Targeted.506541A08802226DC88F\payload.vsix

MD5 22181432ba24b5c6941ad3a8186af59b
SHA1 8d89e6a1311c8f67a8096f9790c995661557854b
SHA256 e983e7cb7a9366575139d031e4bf1d9d9a51e7734190606ade22427f4e36d4e9
SHA512 9fd4c8f9a554db3b44a17d7579d32eab54f02dcd2915b54d5a34a4ed4565f148f55c2979365f8d8adfc69a5aa82b49e776a599a749bd9791c6098d38b125788a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.VB.Resources.Targeted.20E844196305D742AA3A\payload.vsix

MD5 b8f9e8e501041000bf26204a081967d1
SHA1 b50fa3173b0b87be899e5122b080c88b6c970c7d
SHA256 47027daffed895a47291efb2d0d00c0859def5f49ac75524e6e717bb9feee356
SHA512 44cdce3737b3d74956a4f7d7ace8c909804fbe7083207e4c601d2b9b370232a10c59fa1ef433bd5ac2b4488eb2b5debc1be8ffd5bdf4dec8f75ad4b6e36a1f68

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.VB.Resources.Neutral.7E09443BF5645E67D169\payload.vsix

MD5 898b8624dede4072132e887ce3a6d49a
SHA1 b1080a09812443bb1ae6967296f0da27d5539044
SHA256 6d7d3930421d4663a2d7fce4180e7a314070e7e396053bf9d87515f4485152da
SHA512 ac19963b0be5f3d9ab47e906b8d186b0d4577763c61fe1d7290905869cb691593b8e702ab6aff0c205c5cf5cb343cebd3965eae3a5852f1589562c99c398fd4d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.DiaSymReader.PortablePdb.8303BF49427ED8FAFEA3\payload.vsix

MD5 34ebf07fb834d267a365f7169a6d43f9
SHA1 400d4cc482318ef8f827e60dc7ee848cbe80d44b
SHA256 da2a13fd5e73f780d774a2ee625ca2c6aebdd53ca6566c6f8b67e1560d338184
SHA512 b5289575688734b7729faa677af3a0e5f1a86236523f8ff178df5b29483c2344e427e97ee188541cd407217a54d549a4104890858f5ab89ee41adf7b60322df1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.NeutralExtra.038B10E13F17CD9D36E3\payload.vsix

MD5 cd072f882a0938e66449bb37b80614fa
SHA1 a4022355aab9f8a15062e6f8d2d7181945b378ca
SHA256 ec142d080ac9f39fc2f7b77957e454a3bf07896dc55784e9c38942e250b8a80c
SHA512 0a8506805cc349ae63835309753e19165c23337d0a68a44dd3ed0777066dcdab0f388fb1e3bc2c83f80fb1c54c2dd038a6f45e0b26b85ad194da31f1eb2c184d

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\congrats_tutorial.png

MD5 8efdaffbf407c5ae11914ecc954f6e8c
SHA1 e28e6746b22cb56526d207c4c314d2762dda506a
SHA256 c6033d0f8a531e212ff65b4558b652f25afa309b39eec8d5ad99b0e5fee63507
SHA512 f1da670c1149043873c0bfc0098c33f974ff1131e4ca502b360f6908863fd4717ebc944b9ddcb87f719858c90b4b59226c924526b47e628bfc4ced6560166cea

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.StopDebugging.png

MD5 99d44b5a0fd8c60bb3c4ea826042034b
SHA1 762eef5c36b386004f520236e09a76b0f2042583
SHA256 d0e80bce5156459548b965dcc651515d247e5ff3ef6590c3e2ece7853947b5d8
SHA512 08cd7bac9e35a783582d8e46963809357aa6f32deccbc53cec5b4a930be036881f6cd2e631c9ef75c8580c76b073069b1216ae3aacfc38112a6d5c394a0edf31

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.png

MD5 527539837e09fd6e8f3461b5a5356aae
SHA1 4e795a202c5196093f6ebe8ff57ce266faad3f03
SHA256 822ca512a32744427d3d0d307a0eff7fa3b1e27c8f84b9af5c4a00865ee53a51
SHA512 e3a2363fb0c80bf66f65c7aa9c37009f0fe8218bece77d9736bd62d72af87d67aff53d8d4b7c39d228839082a3eeb74b34195d4b6f98aeb43cf7bc8fe709ac0e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.IntelliTrace.CollectorCab.D78466DFA08AA2673878\payload.vsix

MD5 f3302b5603d335420a8a053112d8b396
SHA1 b8c22db82af9a0b721532811b6be0b754d38c5a7
SHA256 b1a3847d76be35d2fdf4ef76a3d255005e7ae8b6c65f9269066b69e6c2887585
SHA512 baaf05f2aac76c0ca240b792085dcd6566cd8fb472b74c7520a16bdca04b899e636c1b897ead763e4577bec047a184eb8a290825cf824eb94290d86a70df38ea

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.TargetedExtra.02B40118F6B3716B6437\payload.vsix

MD5 eb42320e22d70a47a1af436e675339e7
SHA1 e1c9184ee98c23bf88e12f5c9dc2dc0b518bf386
SHA256 4ff633f93dad36884843840a2f3b35198d0650aad0d6425f693a39c11e7054c4
SHA512 6d7d138f254c3d69658d760b10c2b790bf81042d037cde48ff66035a39eb310db1d540cbbc7690ac1ec3d4e13635225448e6b2d9f61b275ada0c43ba37ad62ff

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.Neutral.997E205D5903A45778CC\payload.vsix

MD5 6395c706577af11a41d1a78c0d824ac0
SHA1 e335267ce5543a9559bc69fa8c161f894d496755
SHA256 32fa09fdf3718ff45c9a95769bc78279a2e95ffc1b2c2fee0d5c31c6db883aa1
SHA512 f33150248f6de5a15d28c61cf99f580586324b7318b456928f810bc6b26d6aea280ecebe2b6f6ff56c9f3651eddb7ce22617a3633568b9ebd1d0f7265282051b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.CSharp.Neutral.CB86B2E4E932FEFF01DD\payload.vsix

MD5 3ca285b49a57eecb219dd383a948ebde
SHA1 529f78dfc569e217a728a50011a7871192a2b5ab
SHA256 37db4be8abfa0a3600ddeb30373b9c1a975bd19d3650b29b4d44bd17bc8f621d
SHA512 aa9dbee2b8ef7f8d0d931ec0c0564c766d52cb6ddcd0a95925c159957d7902ee9c115ad9c15015eaaefb58c8c9304c72d09cf620a46ccb0696a946dfdc4d059f

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.VB.Neutral.BD0C0D16EEF8A24357A2\payload.vsix

MD5 1ef4ed88f690af5cffc41ba7ae342f73
SHA1 73c8cc450102cc9e593be687ef77c5ad9200f83e
SHA256 ae2c88a158f926ec0718ab9716ebab0aab9554b365d13a8cf4df3fd24a3f210d
SHA512 14878acc61274b67142c58f95deae8c8e7cf6e53acad6462449530de36b7c8ddae4e9f8c8e2f6d5dd26357182a3f0e398f534e4692845f80a568c88aeeef1977

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.CSharp.Targeted.BD4AAE5F405DC97FC053\payload.vsix

MD5 b8984a76c93edbdef9127ba40e8eb740
SHA1 268bc90004d32a69a2d19cfda32a1795305c5be8
SHA256 390a338d9d2a8ab54c576ba9f9fbe65452e8a649331d7d5408f4bb33b3eb2d85
SHA512 eda34b23bc5aa05f8a12e73fecdd45c5c6e4578201ccabf83c647f5642f55b2ef1d9b6575a1fb6a689a5302f63e2aa0e8735363b3bfa84d6401bd71e862239c9

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.GraphProvider.D6EB884A51A16E550883\payload.vsix

MD5 f7fa6ddef62c0d98fc7f5b37b3731c18
SHA1 073153d3d8a2c4ffc5f8cb3cdde6e57421bfc993
SHA256 545fde52bf98ed4403cd4157a55e81e62d5d108f2e8e2061cd559e8e88434e54
SHA512 c0d2d8bc89d0b400fbd6ba729543d4e414dd4ffd51d6090a02be162a2d05e5c1852c4b66059819661c54b69388300d310e8f03c78d73d7aaa6cff52dc63f915c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.GraphModel.24FF7903C97ECEF7D92C\payload.vsix

MD5 d2882cf411b02022abcc6a4a1c88b51f
SHA1 ba708e98b88a022472baef357cc5a0c763927591
SHA256 0a5abb5284f7652b3e1023fcfb79f786e862429a63504be02bda04cb50c0ceb4
SHA512 a5899ceace7263bad29417a8cd00c4554d781fe20dd7e970b63b6d75ec8d68e55220f565d8958173b114a51160309d19b9f6ca9be648421e4062c32b7ca2f4cd

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.PerformanceProvider.04C97619E8B0F75D6838\payload.vsix

MD5 75b2a99ba6726cb3ef12ff3e2b60a48e
SHA1 c0dd90f4d7f43db793fffc8bcd9059bc04bfc4fc
SHA256 8b45851254ea531bf6831afdec776a4b7c625b4d7aed95047c92106752335848
SHA512 52aff86996e82cc0899a1808e4add06db563a04966cda0ee51e7392137e4b30f5cf9826eacbc07d66411b2500c743a5c39edcd9159277ec99f0b9acc737499d8

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VirtualTree.0751D50E674264674751\payload.vsix

MD5 24a49323043e7be49c2cc8ad64019380
SHA1 ada87dcad168d1ca416dae3c21aeb55198d913ca
SHA256 8d5a50b3d8a76f1f8afcccf520956c0b38f6867f6693dec152b4bb7d9ca20843
SHA512 f21e1b9130e460a178d91924181e06981caf25564e6fe5cf428fcd2304a5279b8a90059d2b20ab00e1a612ceed2a3e14e83ee829442b92b67806289bd14263ca

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.FA9B24373E1AF7BF2CEC\payload.vsix

MD5 7244147199c79b6940cc10fd8654156e
SHA1 f69c719cfdd4e6d48e302fce9b14a417e4d6b06b
SHA256 aa8bafa54282dbd71774901101aa3974129475454790b0ea5b486990f03c4612
SHA512 f4496c43c58608b474057cf49260e345e529a251d7afce297031ad027c2ca87d20b09ea6a2dbe6ddbfea250ff0b88830c3c6be1636f2ccda75b05d4400ec62aa

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualCpp.Tools.Common.Utils.Resources.4761E2A26318FD0DB8FA\Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix

MD5 b6d5492b7312bec9cbfc9ed64c37c4fe
SHA1 9e70eebb975d1faf7fb8ae42882c8d54630f388d
SHA256 1aa72bfab0e259ed14d5bbf404133860037db9105c44bffc7fbac9ffd3157b3b
SHA512 2b071c5d6f205664c90cfd201c31d569999cbe51812d867ae9a2c32347962b5dc3b4c6ffb905cc1d99d029671bbde5462a910ce874a54c5a6fbc8aa10e0c19eb

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualCpp.Tools.Common.Utils.FF19C38604D301D61C6C\Microsoft.VisualCpp.Tools.Common.Utils.vsix

MD5 a73b692781b2bd97fefd3b4de073bbc6
SHA1 80911662f79a487ecd08a791d6c49a8bb5e06ba2
SHA256 cd20161a8a51a84447746bd91b551f18ea29b3083103e792faf707ab4cc9d0fe
SHA512 36142f257133fca31dfbc1ade627b0c9625d44a344dd15f59869bd077237aeaa12284e046da78fe6e7e77ec9aee83afc4f85387c64c67010c7e8180b3e893714

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Base.Resources.54A1AD4BD0EB054573AB\payload.vsix

MD5 2f8513973df9ccb45998ccbca4de1377
SHA1 2b3d9a44a832319231a385fbc5f471fa8567efcd
SHA256 f04c5e0476e80a59a970ce336d78a4db7f1060f62decc48a1776d4ff4a4a0619
SHA512 20301ab22ce3b87263c14704a45a1625ee10b0a05bf79203b9425fd8d3b7a765e99451e8cd6a25237eb62e31abc28f8f874dfa32d69c8355829ca463daa984ee

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\Microsoft.VisualStudio.ExtensionEngineContract.dll

MD5 f267281fb7cd84fdd5f82f61b8ac47bf
SHA1 8125685867d7ff7d2ed508bb990aa073b2a8acb5
SHA256 39663a88b71c3f34456c6edcd8882dfa598c528c53f65df2ebddcebb2d89360e
SHA512 6b37e10a6d87d0b3a92629e0e6f831ce8e188da65add378e0cd2f320b09cd30ba10d999d19d569e22e680b287b6cd312c5fa1d039417face291b58a8f99707f2

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.ExtensionEngine.dll

MD5 04940e6c660e943052bcdba23158e9d6
SHA1 b5a8385051dd9be802ff933911593004cf726ee2
SHA256 288a4394dc4560be37569c8f1f0eb29e52cf5930bb5f1159e8bebb31e0c5dc4a
SHA512 1fab7b4ba80de645c2a84b7f6871cb2118edd63870a6dacaf5f295112abf2f0831b2c53b26757333cc8e1d1af51a6f070d111b61edadc82126a5ef6d2fedb993

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.ExtensionManager.dll

MD5 7fa5fa57c78cf88b8cfe49a0a2b2eb41
SHA1 500f4ed0ccee5639e55ce6f712701cde8097ac1e
SHA256 5d633e5125f8d93d5db0b8a70adb80915d3c2d4ee7aeee5d31aabe7d9eae6840
SHA512 236bb30c17ba6945481e2d9ca0aa0ac37a1cbaf9a0b9112f96d396d0439048a8857c69b42edd32362a2fa561b5a333d38cd32fde70cf1dad16469309dff977cb

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.ProductArch.Targeted.0D1F4C7A8D011EF5FAFA\payload.vsix

MD5 57a821cb672e475cfcccb79026899634
SHA1 688efe14c2525600a093ccfb9fb36a7c48dbbe85
SHA256 88581856f780d774b4e15bcc016b4d2c45c7b6ac0342d341369d861eb968fe9a
SHA512 3a7411d9a559bb27b64e8ea7ab8a1b2a9048e807fd72e8808c9f0d7e77d87b91b5e81b85fcedcbf4b5ba7488b6b755370d3df7394546a2fadcb2c272042d1b1c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Core.VCProjectEngine.Resources.5A25BE1D24229B84469B\payload.vsix

MD5 5631f39d6858f338263467dad063ac7e
SHA1 4282f37103805f1b737bb582f42f73fa21c4ef3c
SHA256 a4f9dd125cdc6d88bb55dd202665ce1ebf3d8799f4d5ea8ada8530e87d594da2
SHA512 ad76acf70e152d7006af4660efe0b32773ef4a6c346b5294f691960a8f3d82ca0f5087983a024b6269766a6a4377264edb8197e9691d15048432ecf7086bec4c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Core.VCProjectEngine.9994AC61C01821F6EEAB\payload.vsix

MD5 f5421796256434dd491076e160252bf8
SHA1 31932f5589bf50c38416cf24c64220596a7c539c
SHA256 215aeaeac576a46d09e71d7d88bd6fa8cfa459a8193f3e541c25a413d121259c
SHA512 047843b43ee139091eac0369c7e2328952a94169b68a79155abaebb46a2ceb7ea5ce8d2fa8de37e6ac38f5eeda6a10bda056b14a660c4e8d847bea5002e68f7f

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.ProjectSystem.Resources.6336C468058DD5E54D7F\payload.vsix

MD5 415b8c4e8ddcfafc97ffe3f80b703403
SHA1 c76e3617659119024b49caeb4c8c514c33741882
SHA256 a5a86e3d740371476022d5a3e33d18afdc1d124a1a3490337b599a1370e86662
SHA512 1958e28ae1c17f77083e51c6b9adca7bb8a75bd7da121150742e6d5fcd4447225f93130141123a07664366d6e2ec071a476b8538f0c4bddc859bc6c402715677

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.LanguageService.Resources.F4818C7933369B75739D\payload.vsix

MD5 3f157739fe259305c3c877d84ad6e797
SHA1 0835be23fd57aaa6ab683f0c7357d8ac3b791016
SHA256 8844ec227c78644cfdfcae49a8488558199bb5eeb864ac512d3c741e00451088
SHA512 decc78aa27263722e17b9e42128e51c2b5f49374b1b73db8d137b48b7e031fb1f04b9826a409597588590ee230d93eb51db65905c925725ba635b5f4451eba62

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VisualC.Utilities.Resources.42DB33E4A43B7A06160D\payload.vsix

MD5 e04e48a9e60f1f945f884c873019c1a6
SHA1 1c60b654b8ace813c1ce96ef7bb379325d1c00d7
SHA256 a50fbe9cf435957d8b6ded37047a0e7114c0364634028d96650d2d7cd52202e0
SHA512 26357919f6a10bd5674498835f482d76921c0eb03891d69e0c7c9e400f82eeaea86c90d1aa7c6df0f4c4a22edd68af45c5c47b4e179495d385cc3707640227ab

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Community.VB.Targeted.AC2C65CE28277A67E76F\payload.vsix

MD5 b2678e7dd54e5380fc46821535738ffa
SHA1 246cbd4598beb0436f644e149de7ac89925f5dc3
SHA256 f17b24f25594348b52675fde6f801b8d972e8327a3cd284053f2714328c2dc0b
SHA512 c4fddd55ebde7e959e1c65e74b9af34666d898ddae1ce6b60acd6f0e8a3b7e8533b469390356cd8a506fa13451219c53db27a37ee35687f82d14d058db1a11a3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VisualC.Utilities.0C786A76A3B7083AC44F\payload.vsix

MD5 c504e9f385abdc03c2f332a2c4a322be
SHA1 a0ac64341cf2cc4a944730379017fd702296a5e5
SHA256 74f751bdd1eb316c5d19549281ae0ad855bf803d1243d59de769ec158f569d90
SHA512 ea74eae1d640a3ef5b8f86906565e82379d21cacea793caa6eb856bffc3ca7a1fc9c5a496714c970e7910b1765a104ead3e0ac8d691203fd1510526f63633dd7

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.LanguageService.Dependencies.A35EA90F791D861EE775\Microsoft.VisualStudio.VC.Ide.LanguageService.Dependencies.vsix

MD5 df9cd559fd5ee5f2ffd0ae8127a0dc88
SHA1 a1874b9475950c7899187d963226e5d499844d54
SHA256 9bc618a7775b50e8f953e267f8eae1afd6e71c8a5c8e82346474d94854c23e7f
SHA512 e01880a30b0cbc57e44aa21066a2b368ccfb5b452d640219a2c3127e88dc2751d8a21f3206466bbeb729d95decd4b1c7b36e8cabc26b1fb5a36df1ed458419b8

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Core.10D5C9CAAEF992D04052\payload.vsix

MD5 4760cfbd43055e4b9f4978177c0cd52a
SHA1 cc626d7485b47929919688abec0214b5cd5f8afb
SHA256 3c5041ec30d3085ec8deee485d095238571a421b6710f2153a84270f619c2529
SHA512 2911a0a014ca4ccb11f0b16580ada83bbe1107b5d0faf04c6b04996563ca408b6e59106c65efb5fbafc1cb439f7ab79c092ea014f498299b774b5c1bf2e6e15a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.ResourceEditor.Resources.CA54A44FB3C2F26C4923\payload.vsix

MD5 f5e5b56f934e78598e75084c71d1f08c
SHA1 5069d765059a41703de6eb335215d50247327aad
SHA256 b5bbabfe3b5b7ddc650d52eaa816f59d3da81f7b92e857d331185cf649806c94
SHA512 7fee2b9cd153430290e1a8b1cb673a418059ee77348d6df25b109eb0af7a20d1337669284afcd4200e068312212d4c06a5bd881cce41041ad35f90ce280f4d4a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.VCPkgDatabase.46C68BDBC6A3A15D3492\payload.vsix

MD5 e8e2b9797a545928265161209a9e966a
SHA1 343985008e1b258fad321f6f0144b9508ffaf010
SHA256 9fe7ef67daedfc4a943a4517c0175430ab593c0a934f70b7802ebccde6589d63
SHA512 2b90e289cd4af02f953303f25714da8f853630b106a4673a78ef426dbffd27bb471111028a9147bff102ee9407f66322e572a48b6760243b6d420b3c73283254

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.ProjectSystem.48D87A6209CE00E466C8\payload.vsix

MD5 6f8ac9425cd967e0d98f977e254e22ce
SHA1 8ede5ba46627049e748f832a51597c6fdbc7700b
SHA256 2449ac197d574690b95e457abcea3c066c26ee88f07f2d01dba73f8f898314a9
SHA512 865aec4fb3aa4fed377d8d24feb527c5ef9098b65f5d72f747cf45fd24fad91e74c88ad74a8c0a91031042c9465ea436489e75db97a642a45b11e28c39ac7734

C:\Config.Msi\e589702.rbs

MD5 08fd9a0b8db6665f9a4736edb01ecc8a
SHA1 f9922c210d6df630c6daed8c9480876d9816a301
SHA256 d3f4801e5231b165de61952a53e1db15afae09188312d0a7d1092e00567c67d8
SHA512 0ac9a95b0011d15103038bbb651d53b128ea37eae832ce8d87a8ff274e246dfe56934ed691f3039ffdfe32dd3599a5c7259dc6d8d5f16f41af72bfc5c9c9c66d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.ResourceEditor.757E72ED4F31222B41FD\payload.vsix

MD5 46cfd2a97453e260d0d1d0e8ada7b7f3
SHA1 066ef17cc8053539bbe885575b15310b502f58a7
SHA256 6861293896c2023971f95d73735d8f548b339587fb3ecf959f0a37740da1da3b
SHA512 508dc6bea06d6fc4df3d5b3e5dd85ef1ec421eefd85cad66d232c751dc988fdf485973a37ea31148aad0fd77c7c8bccb2e86521948a06a745d8b43a97c89a3a5

C:\Config.Msi\e589707.rbs

MD5 1483e2a1a90769af444d89e8a8d7b0d8
SHA1 9be061085d9041aa5493e741942d1f4093ff0ba2
SHA256 d097c7335683da38575d8426af962991ad509e161060230c029eacc18169d19b
SHA512 9aa144776ff2ce53e38b62eb50db0b0867b75955f8c362ee3357cce9815e1b7d9b2852c381c55dbba721b11dd3f533969e0e21544fe69cd2e0a63000d7fb3e64

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Base.E80A158BB96B512E6FE7\payload.vsix

MD5 1b439d30b27080d6ee5caf640f94b482
SHA1 8bc47cba2d85edadc1ef92957193df0fe2a982c5
SHA256 d4501570fd197ae7c9541cf85f958b0f35b5546e7c3dd68c9ccc0a801f138fe6
SHA512 024a92986202fb5e0731efba4fa6a3da350f6b51d7c7c1492b0457cf2d646a32b6b47efa8b74371b3b31b7f1ad9448c8544b50b55cb8829446e073191c3d2b64

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Common.Resources.02EBBD7D60609CA80583\payload.vsix

MD5 72c62fb3ecdfc47f2014df0ee600938b
SHA1 9b9916e6467bd1df6ef68cbed7140c79facae5f7
SHA256 eb00b6e0ba234110c438c79906cfd72065019e848f61bd084d9595d6b7b16936
SHA512 8e0307246229d8cc413832dbcc88fa898945a9e00c59ad935fb0c3b398c1378a531799ce1da39ed2123cc0d04605f9b334068f361754f141526e29088ca6ea91

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSVCDis.3B04A15A03DB2F83DE51\payload.vsix

MD5 814c60e263adbb39516d69fa5d23fac6
SHA1 63fd8a61cdb39a6202223caab5f8e88ac20e801a
SHA256 1fa88175a4679469762ecbbe4c0783d5c671c5137e37384739e3573acd1275ac
SHA512 35161ba71fff905931ccb96a6f7048059f88a0ee88226d44067dd8711b44636c49eb02ee7019a4e5bf1e08e645d71a53b25ff34009326dd030b37e8e70a50fa3

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Common.F65055DECB4395B25773\payload.vsix

MD5 15f333f36b4a19add4c1513ac4b3974c
SHA1 89a964a51222ccf2cd609aa0999e3aa5bd50f9c1
SHA256 3f64e4979890222f73570d109d8b7b920bba999d05ba0492e670abbeb660e307
SHA512 a7dbf0b55c40deb7cc5f3b512f8c0b7a9229666c9c8221c9d0440975adc094861ec94de7f5df6537dd26c06d572a8c5d64a30647ca1a83b1dadc1f945e1b24be

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Debugger.Resources.898D650839AD5766DB5F\payload.vsix

MD5 d4a28cdec823cb4f4f5c884de4f8278e
SHA1 ca5022312a54d27919bd0ec99dc9e6387f7f031d
SHA256 a9b7c63ec9ab8ccf69ca75a2cdbbd627932c474b8c1c95bcdd9961c7e381a9fe
SHA512 69613469a4577b4f5e7ea92ecb8a897fef7df9a200853b2bf87e0d93ed5ac86734c7d36fc53fb495b579e13911243a1502ff5f646e6f3c8bed7b1abc0061250d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Debugger.Concord.Resources.D9E77D471BEFB6A7BFE8\payload.vsix

MD5 f68dbfc26b463d02bae611078c179289
SHA1 7198e6c98252fcaa148938d200c6ce4a93dd4df1
SHA256 9b381463102c87f0283ea1e012a197b8e6b5e92c4367669bf9b0d2cc3f5e7df5
SHA512 51e32b70ccd0443c1e6bec7a8ea6159b6215680cd76552f077ab9dbc4543c7ab13515315adfe3d7bb4d90cd8deb291a0d97380aca1f99a59fb2756393c4dd125

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.VC.Ide.Debugger.Concord,version=17.9.34615.36,productarch=x64\payload.vsix

MD5 11fffc9a4d2763058d2a2b2a664d93a1
SHA1 9263d79da1e499e1d7bc86c501da7e85c6b3c3b2
SHA256 75f0adf4226631f7233c82fc383aef444342f261c0f5927f485d15a426ef6674
SHA512 968f64fe95bf56ce44035af78714725c8d9441360d16586b3ef66dca2bee305e0a7517b1c0915a6962f22aa504288ffbdb66f23cc1311cd0a2e5ee07ef0b8e7a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.Net.8.0.Runtime.B0C599B87530201BACB4\dotnet-runtime-x64.zip

MD5 48048bb3545054596c8bb04dd96f2129
SHA1 321f5933594f59b704d1356b558102d3184727ed
SHA256 495c5566db8db70273adf3003f8f4f014ca2e26b4a1b40ba45175a9f11c41cb5
SHA512 f4bb810d10ac35a824fc35c3ce87545f02964acaf7677706b6a40fa866fcdbfc7e639902ec778e8e8ec58e609c9c8f8d659d18edef0ef2fa50251a6a12e2391f

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Dskx.Resources.3892944061245C619BE3\payload.vsix

MD5 fef66254f6f26e81973c2bff389b75ac
SHA1 c9339d223dad394dd8f97f1dd3a963aa04749fbe
SHA256 df8d9b021e01e8bf2efe9adf6aee078a3c91e211d266bbaec381398749df170f
SHA512 01821fd3bdfcdcd6a63ae4a44c14d3470a3f280c50b284e1c50bd724089789f7de2839e0b79bafc01f01659ffbfc652bc9a0573238412940bfe3e1b95663594b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Dskx.A14735BE982574378F10\payload.vsix

MD5 60a97891857dc1a141b3e33ca09ccb13
SHA1 2aed5c7f1194d043cc7d354764f654b6bda2af29
SHA256 1df1200ff8a580b3c044282c2c3421a9be22c590a82316724e801ccbead52234
SHA512 2e216c486af9c558e7cac9a51a4605c36ea3338e0de1baecfd21c967060292bb53c8dab96a275cb834f590af1ab46b16ff19cadbe6d08439ed2b16b05aa6dde2

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.WinXPlus.A157FA826218072F9511\payload.vsix

MD5 40f8136fe726f76080d3c358e6849b2e
SHA1 b20fb3e1c79b087591b677806c739a905b4f1625
SHA256 648c546f717fb96c1baa5e9e172c358cb99483a0e659a40038c023b3140d5e77
SHA512 7de4e6d8d58a45fc693ea6443cc9b20b80690a6f519b65e67739eb020314c4b4172ecb91634b1ed1a207cb064a3b999408e2fbf56bf8afaf8ce68ba597f2e4e7

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.Base.Resources.690EC9C84B55EC7476D4\payload.vsix

MD5 df44f11de0aa86b9e1ba2389571e5a39
SHA1 c0a42ff94ed9408a1ae0889ea5c0435dee2b4255
SHA256 c851b2efd9ab6c0018d598b85d4c74e546de59f05167e77bd98083e247249562
SHA512 ef2a124a1b6fbc717b087c9baa6d1f92ab04de37b1f2a6ce0a08d8b22656bd3adf4f327ac4363247e3d642fb05bcde591dfcb9772bee31a4b91797e85455eea2

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.Debugger.B908623910041D1CB7F9\payload.vsix

MD5 a149696be6ada1d02db5e4aab65437d2
SHA1 0f52b548acf32ff16a8afbd85d9624ad6c59d708
SHA256 98782689a7091574af1f94b3aa80d2f372122e8d066e89d2c4df0be1e851f4ab
SHA512 375f24638fc3f925991885d786a9c7bba6970e93a090772a2c099d5507e9792e03a5fc953a4e8d3937a10c487bf95c01cd79b5d31c05f8b6c197a9cfdfad9ca7

C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll

MD5 8d05888aab4c43003120c5a5fcf6d675
SHA1 2adb6e06300f3c61b78644a669b51556dd812df3
SHA256 441012f5925cf64e4ec169883cea683182045cedf1f0ebff0c93d5a4cac58767
SHA512 b1a7ab7287695cfead4745cbbbd6631bd312228fb3a4f8efb7420521bed276fd340f1ee2f7167c5cf05c918db47d13bc5010fb0b31683dcffd0b9bdd5a1b7a8d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.Base.47C8A42B751CAB79B074\payload.vsix

MD5 4719ef77eb3e364300184bb106ea3568
SHA1 b1dace78b06ff49048aeaeda47cf5ed5a9a6d3b6
SHA256 f8008f7195113b2fdcac4e34c4968460438b1fe55bc81b839056247807097af1
SHA512 2514735c9a43452cc19c22b4fdeda1e8a9df72633a7755adbb31ebdcb4f429b4cde3d956e51511430756f7ea2a176fcbcacd5da55f6dd03beedcd50bcb3ab73e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.X86.CC9B1B329F55D502E07C\payload.vsix

MD5 fad022f963fb085b646a267adeabbf3d
SHA1 fc013a2d112b820af70973a604769d9f700a7901
SHA256 fe1948df66c94b505c489e46d7a2551b5bb27fcfdb515d30e35c7918fffde6fa
SHA512 de6db5965501d6845406d87d7915ea30533274c05e701d54fc58bc35a0bb7a10d742644f0f6f51b23aa50859a3f5fc068a9bf35609e5849afe1c02da4ba84765

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.VC.MSBuild.v170.x86.v143,version=17.9.34511.75,productarch=neutral\payload.vsix

MD5 3f1ca53cdd010da9ea727b4a4b1cc230
SHA1 fcbc3d6015da6cfd6e05b02da4902396327d59c7
SHA256 e3ce64d393269e4360c32c7af11afbe5d7dff3ce319d9b296451b368f36acf26
SHA512 b9162d9cf77d5e2690eff956678164d03074f2856cbdd28acecd48745ee3413381066c75068582953dd30fa0787c5124cfb366668565a62ca2a19b31ea991f8b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.ARM.3D159774E5C0B9883E18\payload.vsix

MD5 2b00b8645c24c60b2c38b9c1c87f79ea
SHA1 38ad241ac7b022c04309ff98e42c3a8d0fb8e7c3
SHA256 b84cdc25c9e92d98869074da1f538ac2ce3246b1baf90271cc9ea6bd311848e4
SHA512 bdf514f3315c5644054f9cc13d6752bef3e92c12a7141877048506a28f68784907912448be53056a5e31cf6eaa71f883b9360d186f770caebe5af9151c3148a3

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.VC.MSBuild.v170.ARM.v143,version=17.9.34511.75,productarch=neutral\payload.vsix

MD5 a4924ea4f01eacdfc8e5e69f2e99d715
SHA1 acbaa2efd8dffca095f6e9f796669efd0e429a64
SHA256 fd328589f157667b36da8ddcfe3e1106b3205d6e0d45ad13cad545af9d1fd709
SHA512 8361a477d5780a0c48475c896ae762f874dea63474fbdda52e0bd1e14efcba617c7c555744d0b51733d67f94af9dec954776f277fc145be3b56ac85b4a90935b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.X64.39F61107C51C0E20AD4C\payload.vsix

MD5 76d02f34217ed74ec397389e1b6f01bc
SHA1 baf56eb8d55e20fa6fa091040b7f6c7b1d75453e
SHA256 184ea4e2e8497163f5ffcdef234ee834b03a27338d6f2a24bf81c06795b56014
SHA512 390f25c49e504b7b78f1ed0a1465ddddb4f6c51fc3a42ce4c1ecaf7a7a3999e9fe451340bc5e88d518eccd8b5933dbdde13e69cd2495fb250afaae4710a4cb74

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.MSBuild.v170.X64.v143.883D2FECA89947C1F7D8\payload.vsix

MD5 34cce174964c749d1218bb8d5fdaba87
SHA1 b90928229ccb2b03d963c779b016a91c0711fdba
SHA256 6a5d1dbbff334650b7946dbad86dcd77b25ac9e642c1943840542ab1c5e6e5cd
SHA512 d75f3811101f8234756770f1740a6ff0fa9bbb7b4c7c5cf7f51670eb3c40ca7ac6d328da0bab89eb5d7a7f86680bb8b3d8317e6d5a2876f1237758a22ab46e16

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Remote.DiagnosticsHub.Client.3577E0E163DC8BD2481E\payload.vsix

MD5 4e34c2bf57b9b5ce41d4f7136889aceb
SHA1 3c27f13559eb1617401aac2348545b48bddad449
SHA256 dc4a705223e37bf8b7c6cf972898c38c4a11382fbf5f5e8fbc4563a42c671873
SHA512 00e08633290d3a803f102cdb5cc6648fcc8788a764510bdc5612f343b6d3476353377e36efd78f0ecd20b1a9cc0c17b2ad615c630c33b8203a81607b566c46ff

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Remote.DiagnosticsHub.Client.395CF8D5C2C44F6664DB\payload.vsix

MD5 0ac640a8ff167fc022a121ec87406a3a
SHA1 3480d3fb2551601c05f77ebcb48ff61ea7307e8b
SHA256 b9b0ad8e2d6f3ca3aed201799fc611361a4db56f2986bb62a13f59cb204fde60
SHA512 2dda50f953e6b072453573c79211c72180fb8e032d6724271e9dbf71e01fef0e4965cff368f9ba90117142d96b1d106b31cc001d709c5908463f9d34192c9fe1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Package.DiagHub.Client.47577760957E03F8588D\payload.vsix

MD5 9f1a0efedee46010263eae17c7eb2880
SHA1 0acd046603a25944c24d4a4ed0d8c9b7176c1dcf
SHA256 2ba73077437cdc7ecc363ce06910267bc0d0bbc55109a3fbb211578c5c338ae3
SHA512 27c6c99cea05715d3b409a6c571231631c0ed314853aac38727eed348975c377d60bff193b34d5365ff2f5909836903c49df7401312b88d8ed0badf22ce9ef7b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Resources.4BE3D71ACFBC02FA08E1\payload.vsix

MD5 179c62707bb172c026c9b42e5b25f2d5
SHA1 cdefaffde7f3c0bc4f3b2533e1538b5fef53e068
SHA256 cc7fdee4b488f499e70b6938adbea879447c69a502401984418578718afc237b
SHA512 ae77550add9ac7e5eece99f33a8a3b95bb51246c4c8a3c47427e021924ee9a4104cee7f40e90a4d9280452427a272f71e64aba71a8235ea47120ef0ade519575

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Resources.B32234EBA5CC94EE5C27\payload.vsix

MD5 9e50a0d756b6ccbcf8e1b39a4b080a5e
SHA1 9a9ee8096f3c0959e2e1f9e7aa9382b9f4d34f00
SHA256 a32e6559297333d527b0127854ca490115489c0e21e30606a26c5baf255b8e19
SHA512 39372ad2f04ec50145eb177292fafc56f0a3c5dd08037ed052a36fbd8c90c7837be8b7bced415e31e6577de5b55c1def8e32b476b4b548c7548ce18fb3499cf1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.Net.8.0.WindowsDesktop.Runtime.503C3B5E0A978308F2DF\windowsdesktop-runtime-x64.zip

MD5 fe3aa075e1d81c27c8fe276d53dc8a13
SHA1 ddc3d397d1954685cb340075672fd11853aed59a
SHA256 180c24e8bf92ef2626df7094dca6014112501eed5d337aa975c87e081b88d730
SHA512 f62fe6727e82161317cf221af91fad95daa81135a0131b9a046ab65194c054ec5f4087041d0606b34221618452c43a1fe36172c3cf1a3917e656d83151168ee5

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Cache.Service.9AD52F32C1132A2A6BB2\Microsoft.VisualStudio.Cache.Service.vsix

MD5 9b7a1122b4b33d6ca95ce34fe532a4b5
SHA1 a37c6852cc2890aa692a75f2d22e6513139b4731
SHA256 75316d96a9de124e0dbf724e4cd8ec16de057b69ce75b02319183974822911c2
SHA512 a1372ffcc4fb47b747a99ef5405ea3821b44c02a2057dee242692f03191c7031f0878e64a3bea3715bb98db1a239f4de911cf0fc6e50e4456f4a3cb4160fc213

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.IntelliTrace.DiagnosticsHub.112DE7C43701248EE07F\payload.vsix

MD5 86e7ee75b91a35c02e53a09c39aacefa
SHA1 a654d11ec99c00b8edc857843d028d7b6ecc45da
SHA256 40d901f1c6a00f6bff38902c9ee17499499405febd5b8445c021314264b40290
SHA512 14c18121123230c0978db34a5bcc0b34013495c23d0435033db50343c3201fff007e3186687907d19cd7546807268af786bb546b23291fa18512eecaab621567

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.PerfLib.7BACA37E162B3962176A\payload.vsix

MD5 f3bcd7559478b6970eb3ec9742ef1acb
SHA1 3a192e08f544bbf5155331b5230f013fb0af72fd
SHA256 25056d041582fcf47e0163f4c67c4d344faa6c03f321e09460937d998a2a1777
SHA512 6cf49089d6cea29b62da9c3d9857b26e8ef94aa0a4aa4692e0830ac157fe12f5dbc513baa346b99d27a06b035ca8e0474d2cbfc2c56a9dedf5de0407898b6fe2

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.AzureSDK.CC20A30908966FEEB034\payload.vsix

MD5 6149587f08d60a066623ccc40945fbc4
SHA1 8f2228b5ffa87713797773933101064f3942617f
SHA256 85a2418d47ec10ba60f49e102c0088e80c8a6fcc50b9318281e6b3a57912e4df
SHA512 883b05df406e140f34374933e677df0b17c878004c0b7f841b65b2d1be2a66fa2e822ba1706667a12d3d9de0a462b9814919262ef0e95943dbde9268e456881c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Remote.Resources.425354A6F5698AC30555\payload.vsix

MD5 0a487ddff869995b3441e04dcd348a90
SHA1 ce7f83b6213a847b977332518ca4b7eac36be144
SHA256 91ef26457bb07912b0eb33780a8f68b12eee88fa690a21f88e48d0918625c4f4
SHA512 8294c28d6b4c5b6c1edf9c9de3a65445e8551d5003a78b2a25bb1a124bef37b857be98e76a41a14d7d560dfdb41a52e44a3f8b94adea354b2262fdc708fb8600

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Remote.Resources.A2009EE9079E4A30A407\payload.vsix

MD5 8c96e23d86b59840ddc3ee8e9519c82a
SHA1 1b4f4f80765feffc11d13e39acc89f03515d9e3e
SHA256 b7faf1de8eeee142af4511d0c5fdc6bd863f3e11af2f3df413f552ccfc51915a
SHA512 d9606d9a204ab93eb094a38dd821169f1ac793cec03b8ad9f46c3030738562e0d970dd9df2163a8d8dfb1144eb5d6e39434e66b2fb74d67e7da2fa494288ebe4

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Remote.Resources.A9D230DDAB9F3A541B44\payload.vsix

MD5 e55e8f1e32f6c70995d0884040b3a429
SHA1 2c080157132ea13bd500ffd53e791f225fb35364
SHA256 c3d692a07f35541e31271fceda74e99cb2a2752d6773228f876fad727649f5e3
SHA512 055dd14b7be1a7a9da6fba2dcf9de510c1d022196647ed0b45d90c88a554637ca643182c15f76f29ba64dd889c284a949dc61b2e20758ef33782211e34ac2fa6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Editors.0D99F53108C8F73DCCC6\VisualStudioEditorsSetup.vsix

MD5 f562627065598e93c22f6b8ceecb4fc9
SHA1 53992340ec673dc0ea950008644decf3b66946ee
SHA256 c478a70dc323ffd2783aaca7d9f2e56ca364801938e46d456add75d3c5aa84ac
SHA512 4b8cdb356e0409b695eca32d58fa15bbe5e71f42149a87bce089738e7ab1fdd59f31e65126e468b6cabd165d08fa15c8acedd4e24a81908a5cfff4f72e656329

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.0A9E9349289D8C7FCDC1\payload.vsix

MD5 47b3abf529384fb49c9b14e826cfe5fe
SHA1 385e2fbfe526e81637d7131b71afb11786586276
SHA256 abb48585ff5fb9d54954bb5d0a4af1a03a73d974df031bcc5ad44f1d2ab0c83b
SHA512 0993f8f3f2342f6e8d40bbac54bda244dad335e9af549a3b96e0b64990aca12611c0ab3d3647c86e167dc37b8277ee2c7291105f5e61deb5bf07c234a96489f2

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Remote.Resources.6514E0556DD80EEC20F0\payload.vsix

MD5 4a7998dc3abd03d425f127caf3d838fd
SHA1 c000ffd26b2b9f5b6b34af353f7f338bb9cdee7a
SHA256 fdc966b37b9068c8846b5de5c265663ddd5917ec57988bb49921c87ffe4ad0f0
SHA512 9ce72eda39475d97b392b28bba68366840c21a0a99a0c9d041c15833288ff94dbc21aee169c0bf14836d867d209feadc8bc089b2944cde81d73c4dc04752f759

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Remote.C3DE36956B8B0E72EC53\payload.vsix

MD5 f983749d56247dc08d3523573bdf21bb
SHA1 2cb64b2306c415d01ce50e9fd379535339712c2a
SHA256 c16f37f585c2bd03f205cc5d39b22804503da64b9f8699c6fa04b76b5fe83606
SHA512 b385e29ef309225f513ec03066c5723b6320834a1dcb4812fc961aee2fa1172405f8c030e487255367cf4991bf95c5cf306af8d5db88eb6fedc42a77da7806de

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Remote.81C9AB3E84A95AB2222F\payload.vsix

MD5 43dc96cd021a062d6d2d3436607433ff
SHA1 69fcfcd2d8b5bd173623f32ca9b704b1998c58a9
SHA256 4d71b48e635f9455694e8522e8c092287ad01fa110e4594c34204284be0a8aa7
SHA512 af75120145c00c8afbed399dd8e8e83f728ef09438617b52b3aa2fe5e1887a8ac3663b8e66a9555af0d1254a8368ee742b08201e674f7fbb0263b2050b724a9e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Remote.940CCBF1CAF82783A4D7\payload.vsix

MD5 d867da04b6234b1121c37b4dbeeae8eb
SHA1 7b53233fbbfc75c69ec9a6cfd5ff37823ff823a9
SHA256 b77b30d3a80cab0f8d52856a646f36240c58a1d88d41cbf62febf671b0bdcf22
SHA512 65fb239caa5259f9f640a7f0f2a52674bfc3a86e89c8153445222ee8260b9b19a6c637a9aa207540f1087484421f6117c2b7d87c609b552d61b8ea93b15ffea4

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.TargetComposition.Remote.FA22DDCB6D44800C9183\payload.vsix

MD5 47bb980ea61b00bd0fedf6af4050be7f
SHA1 1ee7f8564d24299f0d629ab24767d2e9ec5746b3
SHA256 09b161f4c88dd8da5ebb36847082b5231c0278ebfb42de66dc6755ff137e2852
SHA512 4253260ce4eab61bd08d1a9fb25d6742d92ed8b0a6aac26c632f7fbefc3ef9ec8ad149641e106c8758aaed955a9ad1ae2da1acb0c05ce32da4766ad72ce8641a

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.TargetComposition.Remote.081B385BC7E3A08838FD\payload.vsix

MD5 750ead9f52d010fdac87659c3115f775
SHA1 6776bbfa6771fec07ce7f375d01c19d1ec35bcd2
SHA256 2fc1d9656fdfa1ac0f536d8b62886d7fdbf4aaf72328b463e041085313cbee9f
SHA512 0479d42cf6b41f29492cd110385166e02c03a41306c829c81630068b9a1469e1e4917ea8f6b657d8f0fc438acb74de43f5344401dc6063fe762f895166cb3a38

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Debugger.Managed.Resources,version=17.9.34511.78,language=en-US,productarch=x64\payload.vsix

MD5 0fa0ed0d55109212fd23bdd2a6069449
SHA1 5abfa160860efc6e06e6cc33cf3db3c3c69b3a24
SHA256 f911a7e6264c0a4207fff8a2dd597c44c4dc57334605f04fa24254431f372cba
SHA512 1c84653a8ce604ac81a1dbc829e76ef8aa1432b24aa05aedb747036946860d590b52b85f0f9fc65807d4ebeeed2e590ad9e05ea1e6b4a00e3d79eb4890fd1261

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Managed.Resources.E8A354F6BFB5368F4880\payload.vsix

MD5 f015a75ffa5b393406328b7b0b8622a3
SHA1 9d45a9d87fbd2edda548893cd43414f7ad3dd17b
SHA256 242be29580b724947b5e52ff7b25b4c6ddcec1463eca448303913de0ecc54647
SHA512 e4686336ffb61d5fc13aa4f0f6129cc93a086864b0f8263cf1ba0064719bf9598c3f311b3a7da6367e8f05ed2bb50a1f434b7f33f6dd51a49a89810608676361

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.TargetComposition.51B7492F8C3B971FF74C\payload.vsix

MD5 3f7c3d053a8a11fe8854834f4ca1b845
SHA1 896771e9712682bab60fc043823a22486e68f8cb
SHA256 66d8aa3defd54b277d0c942a5ef3537d01032eb1bf9e417bbc14ad48a5dec350
SHA512 16b94d71e06f694d76f53c0663a0b76dc82e204fdb8a1aa3b15bbc8a14b0f704bf5d48b56f80e6f18f65c9fb03da2ebf79e157f840c9591fb5d9f5eeec59607b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Concord.Managed.128BF207E08D0D7E42AA\payload.vsix

MD5 0a47e6c7a687cf9d8d3586cf8da48a94
SHA1 4d7c14f618d03d5819c584b9952f115db55ff449
SHA256 d54428573359fea3290493edbe0ccde4f7d9ebdb8a940ffeca1d627915f39c53
SHA512 eecf31ae3b2271402acfb81797bbb502235d53f678ecda6cb1911219c6bb403b8ddafc0ca438b7568bb37a7f6b765d129c99ac465f7cf35771cbf1244a322b10

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.3E35331DDD741136D992\payload.vsix

MD5 c74f3e75ec0f0fcf12b83867aa36702b
SHA1 fa43f97e9d68401d5393df24203e5a2990b4460f
SHA256 c62e89a533b19f4be78a22e8e19d87bf3d98baf642dca2c8e88039d14eae852f
SHA512 c050685b272d2ef9a23a48bba9f413a8c2d7c6161d3ccb64d342ded00f952a7495599fb23caf28ccc9b18f236425d1f9f38b219d35f8d294967553e37f32caed

C:\Config.Msi\e58970c.rbs

MD5 9da13bcefd26d7be90411515da154a35
SHA1 c6164da21f98936ca1fe96c5d2a2f3067b278301
SHA256 cd062a8e565e2eef948aed72b44dda6c8b15667b1a58b31f7d591713e76c0452
SHA512 b0f04baed412d495b71633e531a302bb9079045f1b2e1cd37671c9d3bb0bae8121de7eaca357f676e0418e0497bb3b461efe02621bce830c8a0e5eea4368e39e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Roslyn.VisualStudio.Setup.ServiceHub.Desktop.Config.B5655BBC90C13E57BC6D\Roslyn.VisualStudio.Setup.ServiceHub.Desktop.Config.vsix

MD5 4e08deb3079a33c99348855d9cc72626
SHA1 633df7c75bc68202f798a1d9685f744234314c18
SHA256 44401460ada80976be80e1b08254e4177321d75511e730ed9879a660e91f86fe
SHA512 dcb4f73179b9d49563ff15319b9de5eaef817ebb214da8742bc42715f4b6725118b15dfbb23e80219217b84f27184c80217734f825c0a97db07d263226a8ca23

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.CodeAnalysis.ExpressionEvaluator.2946FB4088CDF07076B6\ExpressionEvaluatorPackage.vsix

MD5 82fc13f8a5f1be542f77c69c97a4854a
SHA1 9ecb25eb360375de1e0a1ea054c34a8e1b4effdc
SHA256 19b1ea29ebcfc10e3c63f60d2f136f3d072288158fd64c9c63020639a046290f
SHA512 41e0bbc04947d43a4c6e9ab254596cd4e9d922793000984ccc08cf22c95eb6864ffbcbc39934e5dc209ebbc42dd9bb1f3e6e56dfcfb82c0326341582bff4fd6e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.DiaSymReader.CC47388835E160ED8044\payload.vsix

MD5 465567646168e1e5acab1faf5fdf1c50
SHA1 aea25652f8ad8ae9f74d9d3acc8647eb807af1f0
SHA256 548ee91b0e8cec53755ec1f61ff6beb8e89d2c11fac39681b3609b3a83d1a17a
SHA512 e537b5cab799aaadcf8404b96d0b745f72b6dc59d6943fa6d7e0751dfd8218f70aa278723fc3fc30554db72f5d3b944580f3acdcc591d87fe1ade4877a986fee

C:\Config.Msi\e589711.rbs

MD5 b4ece9f921b68fc6c1be8c31b3ec4fec
SHA1 79b6ab5b5880322442d90fc011cd86d1d308d07c
SHA256 03c2b9de6e51aba7ae31d3712fed6e9694328c3785bd1c52ea9765fb5b87d05a
SHA512 502722e332ecc4cdbab4f7e393c155eb7adf7a079b62598da70c5d2fe7f17147e0f8b7086f6e315defa179ac23018e498d04133ee60de99bb3477fdbafc6f3bc

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.Identity.Client.Extensions.Msal.dll

MD5 352ee196cd65c98b729065aaf6f5c9e3
SHA1 5da4c568740c6c91e02ef0e9e1dac38c52ae33c1
SHA256 6ceaa8b598e7985d5637ab1659566dff9c1fda37edf0f044759b56444f739018
SHA512 db12aec8d7e230994e240c7b7fedc5420d3415ff199cc6279b8ae684e81681e139d562d9de39e4eaee1879fbe7a83eef5204e7e17ad475257853519292e107b4

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Managed.CFFEEBA4DA163E1D3DC0\payload.vsix

MD5 d75f647c41a4e22b8107ecd7355967b9
SHA1 fb7a916f16af4f5ad86f6df1719c52f384410514
SHA256 9d152bff85c5308a1be8e553da7b556c8f6ab6c02e032c0b0138326923e71c2a
SHA512 7ff4f306a858919a9b12477ea800b16741301df3cdcf93de9b9ccd8c9da0d5ede4c6ffdeb30864af5fa5fb8d43a7e41d6617235a54f0574dab05e7468b0b012d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Parallel.Resources.705AD00D2DB01E0CBF9A\payload.vsix

MD5 8319dbf6032b066fe834588c74487f8d
SHA1 5a979e4e3178d9e9e555651ee8b01108c331466c
SHA256 588790cbeb7467ea05827d03a23029f2d0f3b8a33087a6d4b5361e7a0395318b
SHA512 f8ba5ecac890fce7aa34b8b30834ad634ab9ca61d18bb9e10fc2a8c47e0594bca0c3b8e097d1970def28260649aba9826359c2a26da4b43cfea8ee9fdd4ccbc9

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Debugger.Remote,version=17.9.34526.213,chip=x64,productarch=neutral,machinearch=x64\payload.vsix

MD5 ecac49c042974239d835973dc0101d56
SHA1 a26684efc072be4053f8d4ddb1cc2f5da7ce549c
SHA256 10338554250de542ee2a3c305cfa034af4fe4a7a4907de80bddbc9ce84538516
SHA512 f0cab3a7b19cae29ddc4765fac90bc7455d00ac6544619ddc49c365620f76b081baa216595068957c9d52e6f5726053d8287bfcd5f059db8eb2f40510b064315

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Parallel.27AB63890CFC0C7272F6\payload.vsix

MD5 d4edbaebba4dec030f712804703e23a3
SHA1 86b3916b060c867a81a4b40381139d1348a31d52
SHA256 a8c0e24f380d134f312d6a9654d67f0ef3da8b33f83d1c92ee4f208cfe17cb66
SHA512 688588a58f96b71c972c96fb1b6528f4d2169cd39233d06473e42eb13b78716001c7d479b77c147c5e121f55e36a5025639e975a8683f0f0d17e89b67dcfd1db

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.WebTools.DotNet.Core.ItemTemplates.569A79CD48EA9BDB48F6\Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix

MD5 5d4ba3a0a75d4d3adab49c9b09dda62c
SHA1 d9ed4bc6b6e224f84fba9d690bc7dba13032383d
SHA256 d51c8e877ebfff9f6131bbdc90c7800c0130ab0f9844d567f62ad81708ae3aed
SHA512 71a04f5dab5b2645224dede41b56bd5f7308c6ae201287a37c55bf2075e9781c87eea2b3e86eb9fe7cc4f0167aaaf03d35c9611b545956b89f60594c89670ac0

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.CollectionAgents.00680D2726B31A69C535\payload.vsix

MD5 3c8d42dacbcd5edc8dea951edb8a57e1
SHA1 3cd7ef332f28a734d29e7490ad1c321959d2a4b0
SHA256 fe94d99095b7f4e654aac2d33ce8e2b98882fb11de1e0d2379fe6e0c9d346541
SHA512 c7a448c2bc3b39c022fd046d2fb1006e75cfd4b3db4c58eec86ade0c2a6673671a9c287cebb44b948796b250df18085a63a77f15cb4d34d41a1fa515624a67dd

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Web.Azure.Common.60391AE33D9826B44D4E\Microsoft.VisualStudio.Web.Azure.Common.vsix

MD5 e400c74c47b916a38b00f375225a3dd4
SHA1 4db2647b08e1d4bfe79626e906c9a62887cb049b
SHA256 60213859ae1c810899a2bf86272d005e39dba69d938c78ce8e19ce7833aa6d62
SHA512 b7ebf61ae05128db59cffce768caa2a40e73ede4beed4c040b71cd679fc0bbd5adf19eba1aa1544211c35b049f1cfdc1688a507b64a64e514e07856eb76c64bc

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.AzureAttach.CC1D0AF00C61F720703B\payload.vsix

MD5 ee4c915d3838b964419e1655447e30e2
SHA1 9a6a6c5fd29a041521818f732eba2ef3e000fc53
SHA256 f634b9749f04a8db3351692e36b2147d49dcedfb235ef9c643fd621e2ebb8776
SHA512 40aa0fa92b951e8e3b3ef1c2fdc3a6932e0b7f570d7d9a6ddbbeb998afc4784a0f2298fe49131838b44e317b32e4f61dd70185e26f4fc23f74d775d94029743d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.WebTools.Shared.47D9C0A99821222478D3\Microsoft.WebTools.Shared.vsix

MD5 42474da0560c95ae9f0527b37d7b0042
SHA1 dc909ecd9cb34d4106f5ce70971b44040943a584
SHA256 ff2dffe783de71921719080f0ac9a34eb8630b2f5900d6b706faaa1a41063151
SHA512 0d18beea7c3db4e86f3e581c9809e86a63a384124ab2902e8014c33a0ffa214305588cb94e870ca655b712bc024634c9c0305929e448c2fce72538a7f4b2a705

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.EA1388AB7B15AE79D68C\Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix

MD5 784b9fccc7c74f7283d56af744e3f464
SHA1 456328abc39c2fa5cf7d53a4a3bd12022d6a8cba
SHA256 02d4a7d02e6571862f81801b543c1e78be0b511185245dc7d6846f1132608b56
SHA512 716805d7322f6e30f28883180e21b411c3bd85ff3d96064702fd41dd1b1e5d3500bb1667d69bd6b557f50eb236d1e2de638b867febb377860f7509b98c7081c0

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.BrokeredServices.C26ED6DA411CD0E9865A\Microsoft.VisualStudio.Debugger.BrokeredServices.vsix

MD5 e8264f1ad752666c321f5d5532b91923
SHA1 59217518c3604fa03de2646e661e7f8165818630
SHA256 e29900f14caa6aacce968231dc7c2ff4c357691d024aeba805394255db27afee
SHA512 d445cb16f08502243daa93ceb6af474c1bac75473f2cb23b9154ad72cef47530b38580f568987beda387a0a5baec79a654ffce70d548fa243079d15a656ff7b2

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.Remote.Resources.D0F2B8EC2074F5496651\payload.vsix

MD5 ff7bdbf084aa361a5c5d0919d4c374ae
SHA1 cc9d8982b3fa70436e7544eb821d2da542bf3e4b
SHA256 78b281e96e995619aaa3f69d5875e101180fc9613d30963e16a3b424560434d7
SHA512 8b31c28bb05fb99a5e9bbf07d9f88cf0e6468db7420f96655afb44fc468f949ba93995bf6656add8fccf8cf4d6dc7652610829ba612d1dfc9fd96913f0f97372

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.Remote.Resources.02D22153EE4B701BB526\payload.vsix

MD5 5d306716b62205333944cda78c1a0996
SHA1 3b117c210da3288ebe35039be1fb497e0ac164c0
SHA256 87cd9f8cb9df4d4707295ffef4a5fb43b60e2d0e794ae0874a519b61d9e18b6d
SHA512 1bc2a325373864d22a355e0bec51812631de33dbc6c04edf62600ca68235f60f7186a50cd695608223d34cc4bf34acf48ab0042a5e54a28689844bfed777ceba

C:\Program Files\Microsoft Visual Studio\2022\Community\Xml\Schemas\DotNetConfig471.xsd

MD5 05dc64fb0f4ba4ba5bba0937d455324f
SHA1 871a6db8758fe00764bed77a906f31221dd74949
SHA256 15020da358a146c10dc2c420a3277648e27bae9b8398ebc9c910c8d24aaa4601
SHA512 932bd9a0d02a28f58cfba3372b71b4110b3c646e8425f7af94c2681af6b0aae91b9019e53870aa510261d3cbdc8c363b1ff89ec2a708c995e3eb2b3735c4196f

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.Remote.3DDFB9A6CA974BCDA13C\payload.vsix

MD5 3a28299082ab927d06abcc871368fff3
SHA1 00ea51bea768e15efa480b57b5ada5365daec76f
SHA256 5e8969d536fb78da8796f9686a94bdc0345672c0126ad6e73c2a79c79ba3c31e
SHA512 784586158df6d4c8773b9ec4bf53e6f6e8c0ab7dc2d86212e33089a9051730d36f37819c34c321ac3fb457d6da61c9067bb0c5bdfd5e09284ed402fad6cd7357

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.Resources.7F57F994FED9184844C0\payload.vsix

MD5 393c24cc32b4c417fd97329c38c6d695
SHA1 f3073df0345d3269e9b6779f68a0a7bc305951c3
SHA256 f4ba075b959eec1312258b3ce05b1fd5373da7028a4b5b2090325410befa9f5c
SHA512 cce2ad2b8b7faa7d20cc69c28efcf4ab9ecd68656f7913e30d14c79c100667bc0f979fb6f696fc163c8dab35018f2139f0c058901b50ce5d3e24543fba765421

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.Remote.A6A7E8350D7EA2B4D37F\payload.vsix

MD5 d2cffc4cc9c3f521c476212adbcfcf11
SHA1 2bc74b598ef3428dd69c072b3a5df944f1610e69
SHA256 08be8ce6d0370bb22860a260be7deed6344def538723fe278221d67747838c0e
SHA512 3123895dd81e387a803ccb2eed4679d97c5fbc494a1e2afbb7c76c3424ee3e61278b8a3b31a39a3631b05498bc3d4822bb9752276c9dcc5d35e064f729a92c79

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Debugger.Script.385658B36F2A543518AA\payload.vsix

MD5 370f83116e5b902ef3fd4680548cd54f
SHA1 5e4c467b31bab942317570d6ecd93cbac67e45f2
SHA256 7f9b423e9a3853bc242feb086ec11fc5b57ac1c135ebad080698f49d7ecb9b59
SHA512 47544b9dfee76501f34beb5807d2d29278eac148279e23e6a6bab5995a71720fb0bf47b2e509ca2fdfb723a4374e088df01facfeb43622cf98222f6cf30f2a14

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VS.VC.vcvars.x64.Shortcuts.CF40848A44E1A49F9495\payload.vsix

MD5 2a87607d1afa3aa79ed9dfa9e28dcd81
SHA1 2e1c2e19353ca7a4b84598641075262530deb343
SHA256 6493ddde9e7953a4906dad25e5e4b0ddd5891d627fbea93fcc6c40743c46107f
SHA512 e8ecd268a930ee6d014a66cc271d401d3094912e73e2354654be274d1c6c3fc9a030de52a0ed42d443a1af47b7a2de4b538182c97621b9838d5663ddeba1be7d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VS.VC.vcvars.x86.Shortcuts.3B1625D0F25B9DBA78AD\payload.vsix

MD5 fc8b2aba7707ca347b1f76ef3b496bd5
SHA1 b92fdf1d08283da612f6eaf5d68d9e1ebe38f300
SHA256 5b4178f00e84766126b903230f2b9fd05ef1bcdc7ba3639bc9d1aea58f31e4fc
SHA512 c94505ddfbe0deb391503c8c27b894357d9b6195b31adf7d4a926e33157d47522fb01766854276ef8fd750a04ee0af1f1dcfeae76c7c4e1861527354e28cd5c1

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\CallHierarchy\CertificateInformation.dat

MD5 28c3b82727a5ea653224ea32dc895587
SHA1 22472322931c5aa6c42eb9ef3b058e4c4c156a2c
SHA256 60586cb008247dd45e7cee57eb9515beb54c68308386cd1410f1834350ea0621
SHA512 9c95bd0b766f3764b102d44cc1a7bfda0cf9ada39560038f132e3fbfd45054a0b4ed9df0ff3f55c0a4fed80fe15bbf2b5a477f87e0d8affa8053ce8f20dec2a1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.vcvars.331ADB40EFAC292A7821\payload.vsix

MD5 e0a316445d2fbd6996dbd019da698cca
SHA1 d7d22997cae3530d4937cdcbd9734b0d8129f1bf
SHA256 fe7a86b6f81e584aa1b64389c8edaa7018f8164daa84c9fed3e0a885e15b9edc
SHA512 d33a9a8db2be56c57f0c2110dd706f5690e46ab9114e38f956f96f2cd2f0ce455dd7f2be7d7e4dc6de9a7506adc774092462eb5376a47c5c398d311879b2fce4

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.LanguageService.49AD9302B26D8C25CF65\payload.vsix

MD5 742bedde62f65d7bd711047bf0ec5981
SHA1 da0a7116ad4438ef7cfa34c336c3ea286b7ac966
SHA256 e303918c4106171b497b7c15080c0d58b3eadf79bad33a56308318be023bc10a
SHA512 af38b77552017ddeef713ad28dd83962e9ec0d32c21014f1543c401b08d86d9a84c4a1ae4d50526a2e00116c1eb4bd1fb7713c2071dfdc05e8588a98ccf77f5b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.VC.Ide.x64.D65AD072FB22D8A1F1CD\payload.vsix

MD5 cfa2175ecef58b6e1ee93da7b6ee55bd
SHA1 e61b47884044907693d43c1a7bf3ca3c4c5719a6
SHA256 4ac7fd59474e4dcd51fd5ad3af1a96dd3a42836d89629bc3ead3dd0ea2addee0
SHA512 16e10946c6143e615ad1aab94f6c11eaa1da8612ad139319be17358130e02b9e6dac2dc8eb71baf5e5d4f8a405295ac6798f3ed546f00869f0b28fc74308b033

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Connected.Resources.377CBBEACAD24323C3F6\payload.vsix

MD5 50b1b8c58ee5f3d53b5db8d387923664
SHA1 cace2254c3a091eeff26e091e021867c006c2c68
SHA256 f76ec148d7da0ddfa860d835e130eb6603337de703d7f2615c4a4b422b2d0ba5
SHA512 0b8ba0a464d4681109849e41eb0fe52a2591304266d1fa8b1671911d2c1ca2305dbe973d2f7496051b9a3ddce85fb0907480e551853c7623f0256ea5c6635cee

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Connected.Auto.Resources.0AE1250C4952D636EDFC\Microsoft.VisualStudio.Connected.Auto.vsix

MD5 49eb12b26417217e525c603dffaa940a
SHA1 f5281c4e94ae461cc62a57ff542b4a48a03fba54
SHA256 cf24e49436e2eac84168ed2dbcea143b53725b97a835e2c0a1f3231193f243e2
SHA512 147d18b820f3185580ad17693d4e715820c8988d8587f6238778ad2963efb6c7e90c9082ac75bdb6b9ec3241e3fc9921bcae54590ae3d60c767b428f1ef6d8e1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\SQLitePCLRaw.Targeted.73B4B1E53C5AC6F557FF\SQLitePCLRaw.x64.vsix

MD5 0db9f29b43ed8edfc5e5f6d5bff1deeb
SHA1 617761833f32409ff0ff003b5141050066d5733e
SHA256 13531092f2c8b2a6037be06b5020b4a03e2d6f9f15e24e5b8f370375e0a864eb
SHA512 7f68258457a2307411689b2a845b50032f90b34d3cc23d75ee7ac32c026824728ea026d160437a4b42ec66ac40f2317234cbdf88b80d437e852ac269f46cc397

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Connected.Auto.55B01A3856D4CF98AF74\Microsoft.VisualStudio.Connected.Auto.vsix

MD5 b940a7f6595831d9f183649d6a61ab2e
SHA1 a427b04925c08213d1ab677b5de711a6145de979
SHA256 8ef1042af2813d97bf79ced3ee79f9355b8d83afb175afb46dee4fe917b99d5e
SHA512 0ad6b65fd1a9489147686007276a7bb44e8acd8807f6c64702e2d2ca516de4fa9023dcf9672cac3ebe954c09f5bd5d58a9e5c8bb94123e2ce603d427413cd6b6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.Developer.IdentityServiceGS.1071EA2C4ECAC5734DB6\Microsoft.Developer.IdentityServiceGS.vsix

MD5 90edf80f91bd4420c9ba532541644bba
SHA1 2f587c530edd985bdfaceea17210a7d307eeab18
SHA256 833beab2d651ad1eedf1ea72084f5eb436991c54df3e1425f623e718838407e6
SHA512 6259e9d59e11fb876f63d8064dd607460a46c2b59715431e845455deec5d0a41e65b0c4373da24c40ef8d435910bdd292551fae3c3b42a191bffdf53099711e9

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\SQLitePCLRaw.8BDCB16A293EC3CD3FEE\payload.vsix

MD5 bef95b534b5cf6b1e0bd8c4d080486b0
SHA1 e1feb21dcf6f39fad6429f591c21ccd179b76d5d
SHA256 a78a7fb7f80dbd01fe018848269e946fc174a480035f492614dfe64c6789b593
SHA512 168033a390150ccc32e20973ea21c70fa1a1895a887f2f785a43eba64e878064242e7781ce204fb7794c9a66fdbb43dc8e1315d2da02edd694f49700fcf9f054

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Platform.NavigateTo.0D589E5507B5DE340D19\Microsoft.VisualStudio.Platform.NavigateTo.vsix

MD5 6f51a93a108e72d2c1fe088ec7cbc914
SHA1 b9f30b6aee00d1b9c8a57c66f03debbb69e785b5
SHA256 fb5bfeed66ae3976ca9e8fe70cc5827875788b8c44ec1613d1bef30764cc6188
SHA512 3171f3e33346a8b62ccf3c2747f8fe6a3a3597bfdce5692bbcb2f7d7e6a670969930717b2ed8f34861021a87ffb3f0f15ba750c8704ed91b894a1146e77de1a1

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.CoreEditor.143CB3BC9878FD43FD67\payload.vsix

MD5 d3df7b9e7fcfa963d038d1ec76d5f238
SHA1 b7ba8615d763599999333f05a3b2a39ea77809d1
SHA256 8d6a71745ab4abc413b73dbbb16fb7d6a674f466122e20a141afe80489b77b69
SHA512 dad79bc13f2e83f8055bca9365dd217ef4faf86a1f2626462bcff58e363b36e2f0114ba6feec6870bf0e6f43e42cc152de8280fe2d5500851f38b410d287f535

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Devenv.Resources.49BED5B3DECC99DF7FB4\payload.vsix

MD5 0e67ad1fc47cea1bb21ad86e8aedd4c6
SHA1 cd33870998c844319c094f0a34ff2cc4b4061c65
SHA256 4cd331407cb8a3263526c7e208f8c2a4a37712057105235124fc9693845833f2
SHA512 da88bbadbef6d4d872489978a1cfd04c71367b328b53f64a1e4afe756901ddbdcd4a8dad544d5f6bb91436e4f3d31671ff13d28a8d44126e7f1b01725ab1dfaf

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Devenv.824FB24B73ED55966A17\payload.vsix

MD5 a2b9d97afc89ab5c500020f1195a56a2
SHA1 d14ee7466824951af9b3d21af0b88e532cc51683
SHA256 73929279e7210cfd8d6e26c4a6985914d52dfe65718802a21c80088a9ec99ff0
SHA512 4561f5664a674f60c69ec686c194f15a6bff82464c64fc4151376bccad039f84d9dc44338087e69d26b05ce34f55cfc484d66e182e7324f21b11a7169aed61a0

C:\ProgramData\Microsoft\VisualStudio\Packages\_Instances\48dcd8d6\state.packages.json.temp

MD5 0de1be4b4d01c4461b8b160a7e1962d4
SHA1 86bee361c01bd2bcb57ccacba3274e4449fef242
SHA256 96819025e01a5202e685c28d2d202c1a00a77e9173ba868ef0824df97b7a589b
SHA512 46118fca9d11060fd57b771efc6a380169e41a1d022174144a11cdebf73933b466030ab6f491242ff8e462a68fb785a24ddcac26ef6f4e28d1a66a7e648b1a01

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Finalizer.DB5F92A3B0284B83378C\Microsoft.VisualStudio.Finalizer.vsix

MD5 eeadca10759c35ce87b9cde360328b0d
SHA1 4ada85c0898686b20f1a8d10ccceaed95410b8a8
SHA256 d3c36e12ddb18809481fb72adc254cb0926f7a29a1251968271cff47fe368c47
SHA512 4c1735b5169c3d9ab4409f57e09bf2fe61d75d9eee60a0cfc995953e615459b2848436d7788a4da2336a6aec50d642fd6bd6f9e04b25b7b2c1627d890d8acb69

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Log.Resources.9C275DBC3EB2FD375454\payload.vsix

MD5 0c6f361b1b9165c03ce8492c7af4cdd7
SHA1 564eea13e2ea9b07f32261a3d62ca22bbb605b40
SHA256 56c4411421b4ff6758bf0c27efde9b95819620d15d35c11382e2fc41531721c4
SHA512 f81d50f7dfad87fdd676d5f2d536019c68b2bdc527d5fa166f45479a1c97558122749ae81faa0585e034a9a2203a91f945b286ced2c7e4899d8b900eecb769e5

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Log.Targeted.5AF5AFBEDD90777E8AD6\payload.vsix

MD5 67db3737e5f95b4eac55a66d5cb656c6
SHA1 4d840dc25d0c89167993f81024995e3a5a39057e
SHA256 0c946779907cbc4243eaaadbefeb2c9a12997bb09b05b2bb7b3571774c03a622
SHA512 64a303fdf03c1a041268d15260388c4382e32231629339c283345ecc5016ac77c0ed781377044ccbb14887523fd686bca972aef71caced48c3c241f01f05558d

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Log.7287FDE0277031D27808\payload.vsix

MD5 9639b18094a89fc9004a43b882519de3
SHA1 0fb5b7994730893d8a05231b782fc2c087ba7575
SHA256 2078d8d10355d18733c4f2840a581f8966d914c9a991820d81114ff68e6aa4f8
SHA512 9d6f89182d1f51dc9c79520d75e1be6c4f485739d0cb283dedead55523e41008f4c4c57b11ffd35ecce54b4e7849fd41c77fc276184c069643cfbf561b2bcf22

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\CoreEditorFonts.310177BC7B20B281443E\cab1.cab

MD5 0205522e4a80ed920bec57dd81b930d8
SHA1 4ef79b10f276b117b84b306bbddc47ca0a642e4b
SHA256 2f062ee1e7b90ef9a8e560d81da73ec979de56ae27433f94a86e4acdbbbed58f
SHA512 26604af10fa121a9850a8f75b45125b101494ad0364eb6426483763cef52bf315546fc1155502d40c7ed74e384ce9c5154c041e04a259ea188397c2e115b48d6

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Interop.5EA99E3080C0AEB619CB\payload.vsix

MD5 c5ada2cdb907fb9f8b6c35f68da186b1
SHA1 64d5210c292223b2666b55266abc7494c168acea
SHA256 0dd94d12426e92d598c6acca6bb7136cc8b7a3006aeb204aa8c9df938cbbf03f
SHA512 10dd5d00c3434963e1c428e83fc79fd7964202c8b527d451cbf67fb2352a4ed9c8800a5f515fd962c27655744e4f21b02e777edf1fab95bc12d5e9f4dd291048

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Msi.Resources.43EEC223FE8A25EDCA47\cab1.cab

MD5 9c69fd93ca162ee9da0f6a229207428f
SHA1 677bba11ffbc55225a15b4d9c09135a8a03efda9
SHA256 36931f958c537fbf43a17cef7e5723bf7278da2f8e5952763cc26bd9af202d0d
SHA512 38e07e8f0590ad89b4c0dc274ce8706ab0e833dbf409a86a5936fb16edecebebe02d6740567d064faa4a7d4c2ed3aa614f6ca87d1b9d3c8a3a74c812bc8016f9

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Shared.Msi.28C5D3054C400A7B43A1\cab1.cab

MD5 0e3b5284d433e80a931a326c5409ec8e
SHA1 9d30a22e338ca7bb8f01a1d1c9fe07c950b9154c
SHA256 1eb1ea39081244932421b0cad147ae2b87da6d990a2a4d00128eedc2cd3ba527
SHA512 4e692857f2d7c8b706747d2e627c054329636cc935471db6b5be901c9907ff14085b6d9a27f16930d32350438659f72f0844ea444b3f56dab5f3177bfaa64e2c

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.MinShell.Msi.0E6E9C9F11219FEFCDE2\cab1.cab

MD5 8951fe2948f9f2710c05abde412e619f
SHA1 d25ca9ed6d63780ea76d6b8f39cf0d734fa8d9e4
SHA256 3e9869a952ee79e11630533623e17ced1250caa4bf032bbefefedd917b69623d
SHA512 1e9a0f6f87b42e6a23473cf54f62db50e2db580ea52cd4fa6352159bdbe1982caec1608001ff47520274065c00f79aaf5b71b0358c61408692491503eb26ac79

C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.VC.Llvm.Base,version=17.9.34511.75,productarch=neutral\payload.vsix

MD5 8a487961e68f40d8fd4c2fad7bd99475
SHA1 b13ff6f48508e5874ca7fff7b88eebe279fb4e7b
SHA256 b5cf827918df8a5b087a1de8e22723bd5785c89ccc67ebfa8833e51e31da83a1
SHA512 2b9bb29e84410d1d6970486e131b2b386fab0a189bc6cef88a259cbda1febac709ac073f9ec0bf0519412ccef22369988783a3557d080363083c27a2ce3e710e

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.FileHandler.Msi.51CCC862B19A655BCD12\cab1.cab

MD5 1c5667ce65793716e3e89887bc9bae33
SHA1 ee3baca6ff4e6cae119f79c5e3a140c058ee9490
SHA256 a3160c6e0b08a4a2b134fe3f14c947fd26058f7871a48072bb826879cbc60748
SHA512 725b6a27ef11df14675f104736853ff8ea1854e94c894327e90d5974beda63fb80fbd3e463457719c9a2a2b5d11535f33f20f182acd8e3c129edcbafff770618

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.Connected.9A1868644F63E69DB279\payload.vsix

MD5 4dc5fe11735cfe278d7fc98bcc6b864e
SHA1 5717ed66a74f6a753656792ca9a68b3f145a44fe
SHA256 c8c5165918fdcd1cb67d9441e8434f0b77861feb51f97f3cf0d793a096c7507a
SHA512 67b4528f9b5983ac0d8e7eb8ff102ee9fdbc9b963e14b3c21438cb47bb9e42a117ebb2f747efbd9787b7aa5c65403994f95967ef8210c5d1747763de0fe72513

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.FileHandler.Msi.9C4238D7B7E37F9C5FB4\cab1.cab

MD5 23cb4f33ae913859d7f12cd2f71402c4
SHA1 13d952f21e57ee2179fe8c56666865f05d6e2fbe
SHA256 96717c4fd26e0ffc783feebcbfe344d591a3cd8a9818697ac42cff4fd6df3b5c
SHA512 b1d503935d0f4501b9e6475111a930d9b24468af9f28459913ba3382208daa6f14584bcec91ebef770ecacc74e05d23bfba3cc46aeb82348fa14cb63f15e7a43

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.ProjectServices.FD3471F0E8C1BA3DA913\Microsoft.VisualStudio.ProjectServices.vsix

MD5 a38060d5eceb9616a0f602b1357a9d49
SHA1 f71272b63b305db851465f2515623327bf3e8982
SHA256 284674981563cb7932efa45093b062021e2eeeb1981b61601edca53ceacd879d
SHA512 b187d0d2939dc86969dd47464d258a53e6d823b3ed789dbb3f7952013439d7ff5f468a0bb2e2cccbacafc85ad34c0b99fa5be9ab5f742c6d91b653e66c7a111b

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.ServiceHub.Controller.amd64.8DE1BB51C7344FCBDFE4\Microsoft.ServiceHub.Controller.amd64.vsix

MD5 22dac934d59a6643a3929bdabe8b7f90
SHA1 9efe45383b446814fe1c344e59007d4a4f6b8e96
SHA256 ce0c7db89983593778152443c6f9e0c1f7ca5d82106115cf55a3a978410dc9ab
SHA512 aa67ecb5624a2a0dd1357c75797c47562d760dba5629e6e5d023aca1b60016dc194d064bcc2e5b8da1074b0f44ffb1eb35f2d1fcb65d73b7fc9a860c92069f49

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.VisualStudio.OpenFolder.VSIX.837178DD61A49F9CEEC8\Microsoft.VisualStudio.OpenFolder.vsix

MD5 7f39f7b0293bf1bcc2afb6905243cd51
SHA1 f7ad23d93835731d709f044c2097621e245f9303
SHA256 966f847eeda5449c7d341d7a5e6d339a9d2ff432aeeebe5400f93cb8cfaa18e9
SHA512 6e7ea64aae8673b6954e1d312b624d28ca8158fe51493031b7481e2c0fc846d20a4d4a3d614a412ab2586731a9359f9c1203c488fc5f326bd0c16206e4a85982

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.ServiceHub.ExtensibilityHost.amd64.275ADE86D1D45F628C29\Microsoft.ServiceHub.ExtensibilityHost.amd64.vsix

MD5 3f929f0d0c99067fdb366619afb09f65
SHA1 3d79898a479f63e277ae33f0ab02a9e0a99d0408
SHA256 2520a154b9e6b9b2d00b8275b62fa98ed5a5b357c2faff71019dd7395a766c14
SHA512 ec87206604acffa945101d9696e02e28baeb59a950581f04869dfda911a92c0845684dd028bd359d58b87e0a30ab277304754ddf7c11b23047776cb8be0abdaf

C:\Users\Admin\AppData\Local\Temp\o22b5rlw\Microsoft.ServiceHub.Managed.BE190645031B6DA5B97F\Microsoft.ServiceHub.Managed.vsix

MD5 e66c1f19a8569f9222cba649bbed069b
SHA1 8d05854a21bf22c79e28fb6adcda88a137a4a7e4
SHA256 67be5c1ded4d6a6dccda00194cb7f436bf11fa317db70881cb36ff1a0fc5e689
SHA512 08fb17b890cf6c9b13b5e7af36e6f6b1c65b4c751373686c56872e29658c54085e8cf635a652e00461f3379b2af495f2ca8a99c0af93c183f80fe2f6c77f8d3d