Analysis
-
max time kernel
1050s -
max time network
1049s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
d3d10.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
d3d10.dll
Resource
win10v2004-20240508-en
General
-
Target
d3d10.dll
-
Size
584KB
-
MD5
125b30b3127bc5863ce9b931d29dc7cd
-
SHA1
fae14d8ef0290a133caeab9837fa740d4ea3744b
-
SHA256
c5d4d1ad0a4454abfc25c5a949f54bad313fd18b1c75816a3e65447140d72569
-
SHA512
eb4638c03258b4e4c5492d42a039048bc2512eb61607f8f27742b377327425aa42c8b1f46d63779d298afd53de261e9e65d7890ff26bfb34557a113b4fbc9e38
-
SSDEEP
12288:nSUxXWDx1siYHgQ7A4UxCj2AqeMQmKnuCN:nSIXWzsiMgQ7A4uGKFKnu
Malware Config
Signatures
-
Downloads MZ/PE file
-
Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation VisualStudioSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation ServiceHub.VSDetouredHost.exe -
Executes dropped EXE 49 IoCs
pid Process 2932 VisualStudioSetup.exe 5008 vs_setup_bootstrapper.exe 1128 setup.exe 4968 vs_installer.windows.exe 4788 setup.exe 3148 VSInitializer.exe 2120 MofCompiler.exe 4896 Microsoft.Build.UnGAC.exe 4344 microsoftedgewebview2runtimeinstallerx64.exe 1616 MicrosoftEdgeUpdate.exe 1812 MicrosoftEdgeUpdate.exe 180 MicrosoftEdgeUpdate.exe 4864 MicrosoftEdgeUpdateComRegisterShell64.exe 4672 MicrosoftEdgeUpdateComRegisterShell64.exe 4132 MicrosoftEdgeUpdateComRegisterShell64.exe 1264 MicrosoftEdgeUpdate.exe 1956 MicrosoftEdgeUpdate.exe 4608 MicrosoftEdgeUpdate.exe 5012 MicrosoftEdgeUpdate.exe 3708 MicrosoftEdgeWebview_X64_119.0.2151.58.exe 876 setup.exe 4884 MicrosoftEdgeUpdate.exe 624 dismhost.exe 1052 vsfinalizer.exe 4608 DDConfigCA.exe 3436 devenv.exe 3968 VSFinalizer.exe 2812 devenv.exe 4008 Microsoft.ServiceHub.Controller.exe 1756 ServiceHub.IdentityHost.exe 516 ServiceHub.VSDetouredHost.exe 5256 MicrosoftEdgeUpdate.exe 5316 MicrosoftEdgeUpdate.exe 5556 BGAUpdate.exe 2564 MicrosoftEdgeUpdate.exe 5644 MicrosoftEdgeUpdate.exe 432 MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe 4160 MicrosoftEdgeUpdate.exe 860 MicrosoftEdgeUpdate.exe 5920 MicrosoftEdgeUpdate.exe 5936 MicrosoftEdgeUpdate.exe 1920 MicrosoftEdgeUpdateComRegisterShell64.exe 5780 MicrosoftEdgeUpdateComRegisterShell64.exe 5104 MicrosoftEdgeUpdateComRegisterShell64.exe 412 MicrosoftEdgeUpdate.exe 6092 BackgroundDownload.exe 5956 MicrosoftEdgeUpdate.exe 1524 MicrosoftEdgeUpdate.exe 2500 MicrosoftEdgeUpdate.exe -
Loads dropped DLL 64 IoCs
pid Process 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 2672 MsiExec.exe 1616 MicrosoftEdgeUpdate.exe 1812 MicrosoftEdgeUpdate.exe 180 MicrosoftEdgeUpdate.exe 4864 MicrosoftEdgeUpdateComRegisterShell64.exe 180 MicrosoftEdgeUpdate.exe 4672 MicrosoftEdgeUpdateComRegisterShell64.exe 180 MicrosoftEdgeUpdate.exe 4132 MicrosoftEdgeUpdateComRegisterShell64.exe 180 MicrosoftEdgeUpdate.exe 1264 MicrosoftEdgeUpdate.exe 1956 MicrosoftEdgeUpdate.exe 4608 MicrosoftEdgeUpdate.exe 4608 MicrosoftEdgeUpdate.exe 1956 MicrosoftEdgeUpdate.exe 5012 MicrosoftEdgeUpdate.exe 4884 MicrosoftEdgeUpdate.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 624 dismhost.exe 4608 DDConfigCA.exe 3436 devenv.exe 3436 devenv.exe 3436 devenv.exe 3436 devenv.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D84C3A54-4501-436D-B4F9-750E5F727802}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D84C3A54-4501-436D-B4F9-750E5F727802}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D84C3A54-4501-436D-B4F9-750E5F727802}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\VisualStudio\\SetupWMI\\x64\\Microsoft.VisualStudio.Setup.Management.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{177F0C4A-1CD3-4DE7-A32C-71DBBB9FA36D}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{177F0C4A-1CD3-4DE7-A32C-71DBBB9FA36D}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{D84C3A54-4501-436D-B4F9-750E5F727802}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{33ABD590-0400-4FEF-AF98-5F5A8A99CFC3}\LocalServer32\ = "\"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\\common7\\ide\\devenv.exe\"" vsfinalizer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{177F0C4A-1CD3-4DE7-A32C-71DBBB9FA36D}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9A2B23E4-2A50-48DB-B3C3-F5EA12947CB8}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{177F0C4A-1CD3-4DE7-A32C-71DBBB9FA36D}\InprocServer32\ = "C:\\ProgramData\\Microsoft\\VisualStudio\\Setup\\x64\\Microsoft.VisualStudio.Setup.Configuration.Native.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{9A2B23E4-2A50-48DB-B3C3-F5EA12947CB8}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\6EA26FFDFC3C3CADAF6C = "\"C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer\\setup.exe\" resume --installPath \"C:\\Program Files\\Microsoft Visual Studio\\2022\\Community\" --runOnce --installSessionId 3c1b80a1-0ee8-40d3-93be-2dd527678a59" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "\"C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.EXE\" bgaupmi=E1F07827138541C7AD04D226CDB126BA" BGAUpdate.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Checks system information in the registry 2 TTPs 28 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\wbem\AutoRecover\4E9BED298E4A2447DA493DE14F1E57F4.mof mofcomp.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\Feedback\cs\feedback.resources.dll vs_setup_bootstrapper.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Client\it\Microsoft.IdentityService.Clients.ActiveDirectory.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Client\zh-Hant\Microsoft.TeamFoundation.Common.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\ServiceHub\IdentityService\System.IdentityModel.Tokens.Jwt.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\VsixServiceDiscovery\AssemblySearchPathsConfig.json setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\bin\libcrypto-3-x64.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Starterkit\Extensions\cs\Snippets\Writeline.tmSnippet setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\119.0.2151.58\eventlog_provider.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\LanguageServer\Microsoft.VisualStudio.LanguageServer.Client.pkgdef setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\OpenFolder\cs\Microsoft.VisualStudio.Workspace.Extensions.Implementation.VS.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\OpenFolder\es\Microsoft.VisualStudio.Workspace.Extensions.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Client\ru\Microsoft.VisualStudio.Shell.15.0.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\OpenFolder\cs\Microsoft.VisualStudio.Workspace.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Resources\TMRegExArm64.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Starterkit\Extensions\cpp\Snippets\std__map (map).plist setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\ProjectAndSolution\b-StartDebugging.png setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\pt-BR\PresentationFramework.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Licensing\ko\Microsoft.VisualStudio.Shell.Framework.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.Extensibility.amd64\SharedAssemblies\pl\StreamJsonRpc.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\de\Microsoft.TeamFoundation.Controls.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\ru\BuildNotificationApp.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NuGet\de\NuGet.VisualStudio.OnlineEnvironment.Client.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\Microsoft.VisualStudio.Services.Framework.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Client\ru\Microsoft.VisualStudio.Validation.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\WhatsNew\Content\zh-TW\ai-generated-pull-request-and-commit-descriptions.md setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\zh-Hant\Microsoft.VisualStudio.TeamFoundation.WorkItemTracking.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Debugging.Immediate.png setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\pl\Microsoft.TeamFoundation.TestManagement.Controls.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\en-US\ResolvedAssemblyReference.xaml setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\ExtensionManager\ServiceModule\Microsoft.VisualStudio.Setup.Configuration.Interop.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\es\ReachFramework.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\VsixServiceDiscovery\Microsoft.VisualStudio.Shell.15.0.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\PresentationNative_cor3.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\ServiceHub\IdentityService\Microsoft.Web.WebView2.Wpf.dll setup.exe File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\ko\Microsoft.VisualStudio.Services.Common.resources.dll vs_setup_bootstrapper.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\ko\System.Windows.Forms.Primitives.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.Diagnostics.EtwHeapDump.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\es-ES\General.xaml setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\119.0.2151.58\msedge.exe.sig setup.exe File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\es\Microsoft.VisualStudio.Validation.resources.dll vs_setup_bootstrapper.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\SharedAssemblies\System.Management.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\System.Windows.Forms.Design.Editors.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\x86\VSReliability.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Starterkit\Extensions\swift\Snippets\switch.tmSnippet setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\System.Text.Json.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\fr-FR\VisualBasic.BrowseObject.xaml setup.exe File created C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\pt-BR\Microsoft.VisualStudio.Threading.resources.dll vs_setup_bootstrapper.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\Automation\vslangproj158.olb.manifest setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NavigateTo\Microsoft.VisualStudio.Language.NavigateTo.Interfaces.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Microsoft.VisualStudio.Services.Common.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\ru\TFSSecurity.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NuGet\zh-Hans\NuGet.VisualStudio.Contracts.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Extensibility\cs\Microsoft.VisualStudio.Extensibility.Framework.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.WindowsDesktop.App\8.0.5\ru\System.Windows.Controls.Ribbon.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Starterkit\Extensions\cpp\Snippets\if .. (if).plist setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\VSLogP.pkgdef setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NuGet\PackageIconMonikers.imagemanifest setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NuGet\ru\NuGet.Common.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\ja\Microsoft.Build.resources.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\2052\FileTracker64UI.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PublicAssemblies\System.Composition.Convention.dll setup.exe File created C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\it\Microsoft.TeamFoundation.Git.HostingProvider.GitHub.resources.dll setup.exe File opened for modification C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\Microsoft.Managed.After.targets setup.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e5939bd.msi msiexec.exe File created C:\Windows\Installer\e5939cb.msi msiexec.exe File created C:\Windows\Installer\e5939e4.msi msiexec.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File opened for modification C:\Windows\Installer\MSI3AEC.tmp msiexec.exe File created C:\Windows\Installer\e5939c1.msi msiexec.exe File opened for modification C:\Windows\Installer\e5939e0.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log Ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Installer\SourceHash{26768860-CBEB-408D-9F30-87E0DBE11A6E} msiexec.exe File opened for modification C:\Windows\Installer\MSIF93C.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5939cc.msi msiexec.exe File created C:\Windows\Installer\e5939e9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Installer\e5939c6.msi msiexec.exe File created C:\Windows\Installer\SourceHash{E37D72E2-6E06-4F6E-96C5-95C8F0B51E6E} msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File opened for modification C:\Windows\Installer\e5939c2.msi msiexec.exe File created C:\Windows\Installer\SourceHash{7239EFF3-63C4-474B-874B-5A7364E243EE} msiexec.exe File opened for modification C:\Windows\Installer\e5939d6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log Microsoft.Build.UnGAC.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat ngen.exe File opened for modification C:\Windows\Installer\MSIF9BA.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{0AC39B1B-4AFC-4684-B22C-625848E16C92} msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat ngen.exe File created C:\Windows\Installer\e5939c2.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI303D.tmp msiexec.exe File opened for modification C:\Windows\Installer\e5939db.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF364.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Installer\e5939d1.msi msiexec.exe File created C:\Windows\Installer\e5939da.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF5B7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5906.tmp msiexec.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat Ngen.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI3186.tmp msiexec.exe File created C:\Windows\Fonts\CascadiaCode.ttf msiexec.exe File created C:\Windows\Installer\e5939df.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log ngen.exe File created C:\Windows\Installer\SourceHash{4653288F-EBB6-4AAB-9BD6-E34741F0B5D0} msiexec.exe File created C:\Windows\Installer\e5939d5.msi msiexec.exe File created C:\Windows\Installer\e5939ea.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log ngen.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat Ngen.exe File created C:\Windows\Installer\e5939b4.msi msiexec.exe File created C:\Windows\Installer\e5939b8.msi msiexec.exe File created C:\Windows\Installer\e5939bc.msi msiexec.exe File created C:\Windows\Installer\SourceHash{66DCCE57-13F7-43AC-B16E-48EA5C89806D} msiexec.exe File opened for modification C:\Windows\Installer\e5939d1.msi msiexec.exe File created C:\Windows\Installer\e5939ee.msi msiexec.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngenserviceclientlock.dat ngen.exe File created C:\Windows\Microsoft.NET\ngennicupdatelock.dat ngen.exe File created C:\Windows\Installer\e5939e5.msi msiexec.exe File opened for modification C:\Windows\Installer\e5939b4.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 VSFinalizer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier VSFinalizer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString devenv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vs_setup_bootstrapper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz vs_setup_bootstrapper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz BackgroundDownload.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BackgroundDownload.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BackgroundDownload.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz devenv.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 devenv.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vs_setup_bootstrapper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 devenv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString devenv.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz devenv.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\devenv.exe = "9999" devenv.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133623684299333702" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\34 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\36\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\34 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\33 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\31 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsct.76db3e58\shell\Open\ddeexec\ = "Open(\"%1\")" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.181.5\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3FFE93274C36B47478B4A537462E34EE\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F88235646BBEBAA4B96D3E74140F5B0D\SourceList\Media\1 = ";" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\._vw8xsln110\ = "VisualStudio.Launcher._vw8xsln110" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.slnf.76db3e58\ = "Visual Studio Solution Filter" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine\CLSID\ = "{5F6A18BB-6231-424B-8242-19E5BB94F8ED}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsixlangpack.76db3e58 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\._vjsxsln80 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.Launcher._vwdxsln100\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSEnv\\VSFileHandler.dll,-220" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.pkgdef.76db3e58\shell\Open\ddeexec\ = "Open(\"%1\")" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{9A2B23E4-2A50-48DB-B3C3-F5EA12947CB8}\VersionIndependentProgID msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.Launcher._vcppxsln90\ = "Microsoft Visual C++ Express 2008 Solution" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32\ = "{2B473453-BCFD-454A-AB98-B0DE7FDF2A6E}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D7F323E738939D14D9F79F165DE37B8B\ProductName = "vs_FileTracker_Singleton" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0B10E70B-5CEF-4707-9139-484F6C719B65}\DefaultIcon vsfinalizer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\VisualStudio.Launcher._vwinxsln140\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ = "ServiceModule" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods\ = "10" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\Microsoft.VisualStudio.Setup.Configuration msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D84C3A54-4501-436D-B4F9-750E5F727802}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.vsct.76db3e58\AlwaysShowExt = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VisualStudio.Launcher._vwdxsln120\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\MSEnv\\VSFileHandler.dll,-232" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82CCB536-D2EE-4F19-9067-40531F08D1D4}\InprocHandler32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass.1\ = "Microsoft Edge Update Core Class" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{0DD41A78-E3D4-44A8-9EAE-697BCF1781A3}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.Update3WebMachineFallback.1.0" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ELEVATION MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.41\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\41700165BC9412B42960D41DFADD5DF6\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdate.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8BFE3107712B3C886B1C96AAEC89984914DC9B6B setup.exe Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\8BFE3107712B3C886B1C96AAEC89984914DC9B6B\Blob = 0300000001000000140000008bfe3107712b3c886b1c96aaec89984914dc9b6b140000000100000014000000e6fc5f7bbb220058e4724eb5f421742332e6efac040000000100000010000000b7a7b4605e33389f48b33d17cae730060f0000000100000020000000121af4b922a74247ea49df50de37609cc1451a1fe06b2cb7e1e079b492bd819519000000010000001000000016fc4494124fb22d1dd143d205bdc30d5c0000000100000004000000000800001800000001000000100000003c70faea25600ce3b2cc5f0b222ed6292000000001000000740600003082067030820458a003020102020a610c524c000000000003300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303730363230343031375a170d3235303730363230353031375a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420436f6465205369676e696e6720504341203230313030820122300d06092a864886f70d01010105000382010f003082010a0282010100e90e64507967b5c4e3fd09004c9e94acf75668ea44d8cfc5584fa9a5767c6d45bad33992b4a41ef9f96582e417d28ffd449c08e86593ce2c5584bf7d08e32e2ba8412b18b7a24b6e494c6b1507ded1d2c2891e7194cdb57f4bb4af08d8cc88d66b17943a93ce263fece6fe349857d51d5d49f6b22a2ed585bb593ff890b42b8374ca2bb33b46e3f04649c1176654c91cbd1dc455625772f867b9252034de5da6a5955eab2880cdd5b29ee503b563d3b214c8c1c88a260a597f07ecff0eed8012354c12a6be525bf5a6dae08b0b4877d68547d510b9c6e8aaee8b6a2d055c60c6b42a5b9c231c5f45e31a141e6f37cb1933806a894da36a66637893d530cf951f0203010001a38201e3308201df301006092b06010401823715010403020100301d0603551d0e04160414e6fc5f7bbb220058e4724eb5f421742332e6efac301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014d5f656cb8fe8a25c6268d13d94905bd7ce9a18c430560603551d1f044f304d304ba049a0478645687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f4365724175745f323031302d30362d32332e63726c305a06082b06010505070101044e304c304a06082b06010505073002863e687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f4365724175745f323031302d30362d32332e63727430819d0603551d2004819530819230818f06092b0601040182372e03308181303d06082b060105050702011631687474703a2f2f7777772e6d6963726f736f66742e636f6d2f504b492f646f63732f4350532f64656661756c742e68746d304006082b0601050507020230341e32201d004c006500670061006c005f0050006f006c006900630079005f00530074006100740065006d0065006e0074002e201d300d06092a864886f70d01010b050003820201001a74ef574f297bc4168578b850d322fc099dac8297f834ff2a2c979512e5e4bfcfbf93c8e334a9db81b8dc1e00bed2356fafe57f799577e502d4f1ebd8cd4e1e1b61a2c25a231af08ca86251456708e33f3c1e93f8308517c83940a6d70eb32129e5a5a1698c2293cc7498e7a14743f253acc00f30697ffed225206d6f61d3df07d5d972002c6986763d51dba63948c937616d07dd5319cba7d661c2bfe283ab0fe06b9b95d67d2851b0894a51a49a6cc8b71f4a1a0e69a9d7dcc17ed14970aab6adbb72476317faa6d6a2a686eca810449b63b6b2698906c746867a183fe8c51d21d57bf902232dc541cbbf1d4cc816efb19c7ffc224b498a6e15e3a67f765bd1537991859dd5d2db3d7335f33cae54b252476ac0aa1395d28e11da99675e328cfb3785d1dc75859c87c65a5785c2bfdd0d8f8c9b2debb4eecf27d3b55e69faa4160401a7246773cf4d4fb6de0556977af7e9524df477054f85c6d80bf18eed4209d10d76e3235678222636becab18c6eaa1de485da4733628fa4c991335f711e40af9865c922e84221258a1c2d60d9378941892a160fd7613c94686052efd64799a08040ee1581773e9ce053181a501d38959b1e663313273917788736ce4ec35fb2f53d4753b6e0e5db0b613d2ad7922cce375a3e404231a41f1008c2569cbf245d51029d6a79d217d3dac1948e077b257144ab066ae6d4c6df239a9675c5 setup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 5008 vs_setup_bootstrapper.exe 4788 setup.exe 4788 setup.exe 1128 setup.exe 1128 setup.exe 4788 setup.exe 4788 setup.exe 4964 msiexec.exe 4964 msiexec.exe 4788 setup.exe 1128 setup.exe 1128 setup.exe 4788 setup.exe 4788 setup.exe 348 chrome.exe 348 chrome.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 2120 MofCompiler.exe 2120 MofCompiler.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 4964 msiexec.exe 1616 MicrosoftEdgeUpdate.exe 1616 MicrosoftEdgeUpdate.exe 1616 MicrosoftEdgeUpdate.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe Token: SeShutdownPrivilege 4856 chrome.exe Token: SeCreatePagefilePrivilege 4856 chrome.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 1128 setup.exe 1128 setup.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe 4856 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3436 devenv.exe 2812 devenv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2312 4856 chrome.exe 95 PID 4856 wrote to memory of 2312 4856 chrome.exe 95 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1976 4856 chrome.exe 96 PID 4856 wrote to memory of 1672 4856 chrome.exe 97 PID 4856 wrote to memory of 1672 4856 chrome.exe 97 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 PID 4856 wrote to memory of 936 4856 chrome.exe 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d10.dll,#11⤵PID:3976
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf090ab58,0x7ffbf090ab68,0x7ffbf090ab782⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:22⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4416 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4412 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4184 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:3476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4224 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3312 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4616 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4528 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5608 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5640 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5596 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:12⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4680 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2712 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2668 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:82⤵PID:1128
-
-
C:\Users\Admin\Downloads\VisualStudioSetup.exe"C:\Users\Admin\Downloads\VisualStudioSetup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5008 -
C:\Windows\SysWOW64\getmac.exe"getmac"4⤵PID:1708
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202406090101203453.json" --locale en-US --activityId "19ab4748-11b4-4a2f-8c3e-66c2306a071f" --campaign "2030:70bc49e022d74d6faf27eb6c9e8d28cd" --pipe "9ea8072d-cb07-49d7-95e6-835ed8c0852d"4⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1128 -
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 3.10.2154.60269 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"5⤵
- Executes dropped EXE
PID:4968
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 19ab4748-11b4-4a2f-8c3e-66c2306a071f --campaign 2030:70bc49e022d74d6faf27eb6c9e8d28cd --handle 328058 --locale en-US --pid 1128 --pipeName 91d0b37b486f418eac965074b1338956 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"5eb7f12f-31b6-4b4c-8e94-f8a627461014\",\"Id\":\"df2fa7a2-ee3f-4854-a4aa-d2b24cfeaac8\",\"ProcessStartTime\":638534917062353344,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause6⤵
- Drops file in Windows directory
PID:384
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause6⤵
- Drops file in Windows directory
PID:564
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.10.34803.213\VSInitializer.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=17.10.34803.213\VSInitializer.exe" -Operation Install -InstallationID 76db3e58 -InstallationName VisualStudio/17.10.1+34928.147 -InstallationVersion 17.10.34928.147 -InstallationWorkloads Microsoft.VisualStudio.Workload.CoreEditor -InstallationPackages Microsoft.VisualStudio.Component.CoreEditor -InstallationPath """C:\Program Files\Microsoft Visual Studio\2022\Community""" -ComponentId Microsoft.VisualStudio.Product.Community -ChannelsPath """https://aka.ms/vs/17/release/channel""" -SetupEngineFilePath """C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe""" -Log """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240609010212_016_Microsoft.VisualStudio.Initializer.log"""6⤵
- Executes dropped EXE
PID:3148
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=17.10.4.2421802,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=17.10.4.2421802,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"6⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4896
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.WebView2,version=119.0.2151.58,productarch=neutral,machinearch=x64\microsoftedgewebview2runtimeinstallerx64.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.WebView2,version=119.0.2151.58,productarch=neutral,machinearch=x64\microsoftedgewebview2runtimeinstallerx64.exe" /silent /install6⤵
- Executes dropped EXE
PID:4344 -
C:\Program Files (x86)\Microsoft\Temp\EU21E7.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU21E7.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"7⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:1616 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1812
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:180 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4864
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4672
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4132
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Q0MDU4MTZDLUFFMDktNDJGRS04QkYwLTQyMDJGREVCNTQ2MH0iIHVzZXJpZD0iezI1MzIzMUMzLTI5MDYtNDY4My1CNkI1LUUwODJENzQ4MzcwNH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7RDA1OTI1MjctMzJEQi00NkZBLUFDMzItMjA1RDAwRjY2ODRFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtEeE9iakhHYStuUmEyYXRDM3dvK0lFcEM3OCtaWWVBVWJrWHBEQzJjajdVPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTg3LjM3IiBuZXh0dmVyc2lvbj0iMS4zLjE4MS41IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODQzMDk1ODU4IiBpbnN0YWxsX3RpbWVfbXM9IjYwOSIvPjwvYXBwPjwvcmVxdWVzdD48⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1264
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{D405816C-AE09-42FE-8BF0-4202FDEB5460}" /silent /offlinedir "{1EB50476-42DF-47A5-B0C9-1DEAA555072C}"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956
-
-
-
-
C:\Windows\system32\dism.exe"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Users\Admin\AppData\Local\Temp\7f2776e3-c4ab-40a2-956f-5e7ef3d4253f\Windows10.0-KB5003304-x64-NDP48.cab" /logPath:"C:\Users\Admin\AppData\Local\Temp\dd_setup_20240609010212_089_Microsoft.Net.4.8.KB5003304.log" /LogLevel:46⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\10B9B0F7-320D-48DF-859A-270EAEBCB46A\dismhost.exeC:\Users\Admin\AppData\Local\Temp\10B9B0F7-320D-48DF-859A-270EAEBCB46A\dismhost.exe {49C57521-3CD0-4BF2-9242-8D7BAFB30F51}7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624
-
-
-
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\vsfinalizer.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\vsfinalizer.exe" -Operation Install -SKU Community -InstallationID 76db3e58 -InstallationName VisualStudio/17.10.1+34928.147 -InstallationVersion 17.10.34928.147 -InstallationWorkloads Microsoft.VisualStudio.Workload.CoreEditor -InstallationPackages Microsoft.VisualStudio.Component.CoreEditor -AlphaPacksCount 0 -ComponentId Microsoft.VisualStudio.Product.Community -ProductKey -ChannelsPath """https://aka.ms/vs/17/release/channel""" -ChannelId """VisualStudio.17.Release""" -ChannelManifestId """VisualStudio.17.Release/17.10.1+34928.147""" -SetupEngineFilePath """C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe""" -Log """C:\Users\Admin\AppData\Local\Temp\dd_setup_20240609010212_091_Microsoft.VisualStudio.Product.Community.log""" -Nickname """""" -DisplayVersion """17.10.1""" -SemanticVersion """17.10.1+34928.147""" -ChannelTitle """Current""" -ChannelSuffix """""" -CampaignId """2030:70bc49e022d74d6faf27eb6c9e8d28cd""" -ProductArch x64 -SetupResult 1 -UserOperation Install6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:1052 -
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\DDConfigCA.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\DDConfigCA.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4608
-
-
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\devenv.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\devenv.exe" /updateConfiguration /allowDuringSetup /log ActivityLog.Setup.xml7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3436
-
-
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\VSFinalizer.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ide\VSFinalizer.exe" -Task PerfWatson7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3968
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" update /queue6⤵
- Drops file in Windows directory
PID:3132
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" update /queue6⤵
- Drops file in Windows directory
PID:1424
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue continue6⤵
- Drops file in Windows directory
PID:876
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue continue6⤵
- Drops file in Windows directory
PID:4272
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" eqi 06⤵
- Drops file in Windows directory
PID:4836
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" eqi 06⤵
- Drops file in Windows directory
PID:4812
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\devenv.exe"5⤵PID:216
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1912,i,9217567275157126256,9560581369179679627,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:348
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3440
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c 0x3441⤵PID:1928
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4964 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1A4BA0F16D101E2FD2BF7F5520A45EE72⤵
- Loads dropped DLL
PID:2672
-
-
C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe"C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe" -autorecover "C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2120 -
C:\Windows\system32\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp" -autorecover C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof3⤵
- Drops file in System32 directory
PID:220
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4608 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Q0MDU4MTZDLUFFMDktNDJGRS04QkYwLTQyMDJGREVCNTQ2MH0iIHVzZXJpZD0iezI1MzIzMUMzLTI5MDYtNDY4My1CNkI1LUUwODJENzQ4MzcwNH0iIGluc3RhbGxzb3VyY2U9Im9mZmxpbmUiIHJlcXVlc3RpZD0iezk2MTMyQUQ5LUM1RTEtNDVGRC1BNjc1LURGQTRDMTkxM0JBQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NTA3MTU4NjQiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5012
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EFB69266-C6E6-4686-B5D0-A439C934FF57}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EFB69266-C6E6-4686-B5D0-A439C934FF57}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:3708 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EFB69266-C6E6-4686-B5D0-A439C934FF57}\EDGEMITMP_98BFE.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EFB69266-C6E6-4686-B5D0-A439C934FF57}\EDGEMITMP_98BFE.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EFB69266-C6E6-4686-B5D0-A439C934FF57}\MicrosoftEdgeWebview_X64_119.0.2151.58.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:876
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0Q0MDU4MTZDLUFFMDktNDJGRS04QkYwLTQyMDJGREVCNTQ2MH0iIHVzZXJpZD0iezI1MzIzMUMzLTI5MDYtNDY4My1CNkI1LUUwODJENzQ4MzcwNH0iIGluc3RhbGxzb3VyY2U9Im9mZmxpbmUiIHJlcXVlc3RpZD0iezU3NDcxRDgxLTIxRTktNDVBMy04QjIxLTA2RDUyOURGQzUxM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI4IiBwaHlzbWVtb3J5PSI4IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBvc19yZWdpb25fbmFtZT0iVVMiIG9zX3JlZ2lvbl9uYXRpb249IjI0NCIgb3NfcmVnaW9uX2RtYT0iMCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTE5LjAuMjE1MS41OCIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg1NDg1NTg0OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc4NTQ5MDU4NjkiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODYzODU1Nzc2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg3NzU0NjI3NyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iODE0NjE3NTg2MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjEiIGRvd25sb2FkZWQ9IjE3NDc1ODM1MiIgdG90YWw9IjE3NDc1ODM1MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjEiIGluc3RhbGxfdGltZV9tcz0iMjY4NDIiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4884
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4344
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:2036
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
- Drops file in Windows directory
PID:5052
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\Ngen.exe Update /Queue /Delay1⤵
- Drops file in Windows directory
PID:3912
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1132
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\devenv.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\devenv.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812 -
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\controller\Microsoft.ServiceHub.Controller.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\controller\Microsoft.ServiceHub.Controller.exe" ba91af6067669378df666c96f2c4881ff8cbac3bfaa236a8791bcb6b4c4ae455 "/AppBasePath:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\\" /ConfigFile:C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\17.0_76db3e58\devenv.exe.config /ControllerCooldownTimeout:30000 "/TelemetrySession:{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Dev14\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1001,\"UserId\":\"5eb7f12f-31b6-4b4c-8e94-f8a627461014\",\"Id\":\"58bde430-fe8d-441a-b193-94587c96cb77\",\"ProcessStartTime\":638534920003764703,\"SkuName\":\"VS_Community\",\"VSExeVersion\":\"17.10.34928.147\",\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"3⤵
- Executes dropped EXE
PID:4008 -
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\Hosts\ServiceHub.Host.netfx.x86\ServiceHub.IdentityHost.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\Hosts\ServiceHub.Host.netfx.x86\ServiceHub.IdentityHost.exe" netfx.x86$IdentityHost net.pipe://4008B3A88C0CA65C2297D862AD4DF1790BBD "/AppBasePath:C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\\" /ConfigFile:C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\17.0_76db3e58\devenv.exe.config "/TelemetrySession:{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Dev14\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1001,\"UserId\":\"5eb7f12f-31b6-4b4c-8e94-f8a627461014\",\"Id\":\"58bde430-fe8d-441a-b193-94587c96cb77\",\"ProcessStartTime\":638534920003764703,\"SkuName\":\"VS_Community\",\"VSExeVersion\":\"17.10.34928.147\",\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"4⤵
- Executes dropped EXE
PID:1756
-
-
C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\ServiceHub.VSDetouredHost.exe"C:\Program Files\Microsoft Visual Studio\2022\Community\common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\ServiceHub.VSDetouredHost.exe" dotnet$VSDetouredHost net.pipe://4008B3A88C0CA65C2297D862AD4DF1790BBD "/TelemetrySession:{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Dev14\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1001,\"UserId\":\"5eb7f12f-31b6-4b4c-8e94-f8a627461014\",\"Id\":\"58bde430-fe8d-441a-b193-94587c96cb77\",\"ProcessStartTime\":638534920003764703,\"SkuName\":\"VS_Community\",\"VSExeVersion\":\"17.10.34928.147\",\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:516
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:5256
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5316 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7A37C2A-B0D0-46AD-A6DE-21F2009CE439}\BGAUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C7A37C2A-B0D0-46AD-A6DE-21F2009CE439}\BGAUpdate.exe" --edgeupdate-client --system-level2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5556
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezhCMTZGQzkwLTcyQjAtNEVGMi1BRkQyLTQzOTUxMUY4NEZFNH0iIHVzZXJpZD0iezI1MzIzMUMzLTI5MDYtNDY4My1CNkI1LUUwODJENzQ4MzcwNH0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7Q0U4RTQ3MDAtRUU3RS00QzNELTk4MzktREY5QTI4NkJCOEI0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtFK3hiQXo2WTZzVTEyODliUzZxbDRWUkxia2pmQlVHVE1Kc2pySHI0NGlJPSZxdW90OyIvPjxhcHAgYXBwaWQ9InsxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDB9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIyLjAuMC4zNCIgbGFuZz0iIiBicmFuZD0iRVVGSSIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwODQ3NzgzMjU3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTA4NDgxOTMyOTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExMzczMDMzNzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxODUwMDIzOCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1QN3ZlRHdLSzZCVmZ3VUxGd0REMUJ5Q0czUU5JeWFnUDc0Rko5alRFZzdzN05XR1dlU2F0SktvQUp2UFNGdUF4YXBLalY0MzRsSVc1WHBaV2ROcThFUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExMzc0NzMyNDAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzVmMTk1NjEyLTM4NGEtNDhlYS04NDA4LWI0ZWRlOWRjNTZiYj9QMT0xNzE4NTAwMjM4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVA3dmVEd0tLNkJWZndVTEZ3REQxQnlDRzNRTkl5YWdQNzRGSjlqVEVnN3M3TldHV2VTYXRKS29BSnZQU0Z1QXhhcEtqVjQzNGxJVzVYcFpXZE5xOEVRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTgwNDQ0NDgiIHRvdGFsPSIxODA0NDQ0OCIgZG93bmxvYWRfdGltZV9tcz0iMjQyMDIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTEzNzU3MzI1NyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExMTQzNjIzMjg4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTExNDY5MDMyMzciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI2MDUiIGRvd25sb2FkX3RpbWVfbXM9IjI4OTAzIiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMjUiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
PID:2564
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5644 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EADAD3D4-0C48-423E-B483-F89CC2083774}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EADAD3D4-0C48-423E-B483-F89CC2083774}\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe" /update /sessionid "{3EC58544-7299-4D85-9608-8FE061807140}"2⤵
- Executes dropped EXE
PID:432 -
C:\Program Files (x86)\Microsoft\Temp\EUDA61.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUDA61.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{3EC58544-7299-4D85-9608-8FE061807140}"3⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks system information in the registry
PID:860 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Executes dropped EXE
- Modifies registry class
PID:5920
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Executes dropped EXE
- Modifies registry class
PID:5936 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:1920
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:5780
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.41\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
PID:5104
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODEuNSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszRUM1ODU0NC03Mjk5LTREODUtOTYwOC04RkUwNjE4MDcxNDB9IiB1c2VyaWQ9InsyNTMyMzFDMy0yOTA2LTQ2ODMtQjZCNS1FMDgyRDc0ODM3MDR9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9Ins1ODI3M0VCQy1GQUFDLTQzRjAtQjUwOC0wMzk3QTU1MUE0OTF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4MS41IiBuZXh0dmVyc2lvbj0iMS4zLjE4Ny40MSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTUxOTUzNDQiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNTAzMjYzMjk4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Executes dropped EXE
- Checks system information in the registry
PID:412
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE4MS41IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezNFQzU4NTQ0LTcyOTktNEQ4NS05NjA4LThGRTA2MTgwNzE0MH0iIHVzZXJpZD0iezI1MzIzMUMzLTI5MDYtNDY4My1CNkI1LUUwODJENzQ4MzcwNH0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NDIxMjk3MDEtNkU1NS00OTFELUJFMUUtQTE1OUM1ODc3RjFCfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIG9zX3JlZ2lvbl9uYW1lPSJVUyIgb3NfcmVnaW9uX25hdGlvbj0iMjQ0IiBvc19yZWdpb25fZG1hPSIwIiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtFK3hiQXo2WTZzVTEyODliUzZxbDRWUkxia2pmQlVHVE1Kc2pySHI0NGlJPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTgxLjUiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjQxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9IklzT25JbnRlcnZhbENvbW1hbmRzQWxsb3dlZD0tdGFyZ2V0X2RldjtQcm9kdWN0c1RvUmVnaXN0ZXI9JTdCMUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwJTdEIiBpbnN0YWxsYWdlPSIzMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE0ODEwMTM0MTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE0ODEyMzMyNzciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNDg2MjQzMzczIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNGFkOWNiNmUtODI0NS00ZTQ3LWIyOTgtMWZmNGIwNDI1NmUxP1AxPTE3MTg1MDAzMDEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RzNBQ0t5ajBGJTJidGYwcCUyZnhKRnVNRXVmbXZDQTNRMEtubXlyRXZRQXhpbEIlMmIyemVaZGZRdjNFSTFwNTJPc1VVZTZjT3dXN3NyNm9vaVl2T2U1NXFpMlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTQ4NjI2MzMzNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNGFkOWNiNmUtODI0NS00ZTQ3LWIyOTgtMWZmNGIwNDI1NmUxP1AxPTE3MTg1MDAzMDEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RzNBQ0t5ajBGJTJidGYwcCUyZnhKRnVNRXVmbXZDQTNRMEtubXlyRXZRQXhpbEIlMmIyemVaZGZRdjNFSTFwNTJPc1VVZTZjT3dXN3NyNm9vaVl2T2U1NXFpMlElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjM0Mzc2IiB0b3RhbD0iMTYzNDM3NiIgZG93bmxvYWRfdGltZV9tcz0iMzE4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNDg2MjkzMzA5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExNDkxNTAzMzgzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iMzIiIHJkPSI2MzM3IiBwaW5nX2ZyZXNobmVzcz0iezJGODkzMTRCLTA1RUUtNEI1QS04RjVFLTIwRjREMDIyQzAxRH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMzEiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1OTY0NTgzMzEwODM5ODAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIzMiIgcj0iMzIiIGFkPSI2MzM3IiByZD0iNjMzNyIgcGluZ19mcmVzaG5lc3M9Ins2N0NFMEM2MS01MDkwLTQ2MDMtQTA4My0xRTlBRkJEQTFFMjJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjExOS4wLjIxNTEuNTgiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIj48dXBkYXRlY2hlY2svPjxwaW5nIHI9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7NEJDQkRDNUQtODhBNC00OUE1LUJFNEItQTZFNzk3MjBGNzE0fSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Checks system information in the registry
PID:4160
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:6092
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
PID:5956
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
PID:1524 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuNDEiIHNoZWxsX3ZlcnNpb249IjEuMy4xODEuNSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InszNzlFMTU0NS03QzdBLTRFNTktQTQ2Mi03QUYwMjQyNjIzRjV9IiB1c2VyaWQ9InsyNTMyMzFDMy0yOTA2LTQ2ODMtQjZCNS1FMDgyRDc0ODM3MDR9IiBpbnN0YWxsc291cmNlPSJsaW1pdGVkIiByZXF1ZXN0aWQ9InswQkMxQkIzMi04OThDLTQxOTYtQjc1Ni0yQTlCNjVDQUI4NEF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RDZqeFBlVW1LZmg4eXR5NkYwN1l4TTFlWkRIL1RWNkZRVDJmZkRpWnl3dz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjMxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTUxNzEyMzUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1OTY0Mzc2NTczMDM5ODAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTE0MzI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDc3MzcyMzI1OSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Checks system information in the registry
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598B
MD544be431d0c0f3166916bf63414299c5b
SHA1a01cd3dda69a6a03741b62270c5f9a718494d15c
SHA2568ce33f1a263998e1ea1b624665322f0bf43db314938afab4967bd423651e79fb
SHA5126fb9e9f3f0956e486b32e4451e62cca199bb55ef1ba317f89f4c6b11f8f9e2576826761d8ee3b569162acbbb088fa7a21326beaa551d8df9cbf02f2039a2e9dc
-
Filesize
11KB
MD59c39de0eb16a6501bb89654c741c2dd4
SHA16bc7bb507997fdcd4f2beade8b59166be2d7f6f0
SHA256c52de951ee113a4c16104587c1cc2b40ac6258c149d38b2b5ceaced7eec81d28
SHA512d42f2e6dc7b9da56e0711657231398870d3f9e9f0733f42b46f751c1afe9501460e7917e6431352e73620e909ecf217211d1577b2ec758b6e52450adf3adc2d1
-
Filesize
14KB
MD556438e7c72224dff70f4016e64b79a50
SHA19cba69561b92908e2b9331c6c10b4212f07484e5
SHA256cc1fbfa25dab9fb6e072d7a6f097af5aa11bcc6141c0ba6de45731c6993ca614
SHA512b4e97fdad095592b979705ca8860e1760beba8c5a5fc972d241d119af03028f2534672fd88aa285664ab3cd444096584355d83ccbd31858057cc797d0ad0d7eb
-
Filesize
9KB
MD5d606b0343073377974240e52df9901c5
SHA1e581a0e5a6585cb0542d64d549a84bd6ab6b8ca6
SHA256e88b384156d2dded52684b4ba5d4fd372135c4fe39f61d4bb225fd23539d62a1
SHA51289f2202829195066cd41622b4d4fc6b948433f50813c6701598d921933c5416c5d9064d9e09c577908397c9e5bc83d39d695444f81ff6840424b0c2b67db9c92
-
Filesize
9KB
MD58a3c8b4221e238dbc0822d4ed98154cc
SHA18988a7a7600423345b03535bf3c94e5a1eb08198
SHA25614cedaf3baca76e8789c2ea9d7b41896166cfbc5633a1d017b25ef610e2e2f6d
SHA5129b0d2486add6dc8867432d6452e598e9867b31577dfe4a9fb70390c6ed70078e7d5fcb9cecc97e59006d0e689ed8959d4ff55774055765e68b72ff73beb304af
-
Filesize
7KB
MD5a31c1d46833fc6afd7779f1b851bfcbf
SHA128bb5498aa6199e6cf53618a71ea56bc525618cc
SHA256cbd2217b8516429bc10b1050f3541756320032c1c2f50ec14e347ac11c8fd761
SHA512bab5430b6955702519338900a6bf4948b70b59c0e7792066ff7e52049b26e075b060162963e70520be7599fbc916f9bf48aca84dc0e7816cedfaf15c825f59fe
-
Filesize
9KB
MD5e894fe523e3f26e7b55e18707f193ae8
SHA11f1dd36c180e63983698fda5c7a620d31ea5d63f
SHA256126bff2d3142800741b5d015d20f05f748649e89a4736fff4c99129bdb845950
SHA512033d645fb8c0f98cf155be536dd3d99fb2ebe278f13d97c46f7919166587b19d4d99dcc03ca126f3cea16dd1b0b7663ff730eb01c39f0a74229b870516ebad68
-
Filesize
10KB
MD5a8865d37f68d4706a1a019519634737a
SHA1f66e2618a4e6f7e42d6d0b9bed3d67b115ad3b01
SHA256cdf22e5fe7e930ce766ee93dd67c1156943ee0cf4474120df884968d097a0195
SHA512012f082121baddf321370e660ba33c1ce9c88490cf3ddb92532c98618a1950245206d7c8abd7ba49203b135de1c3631429b3ebd700af87c91aeabdc416a57791
-
Filesize
8KB
MD552c42b2fd83c443938260297399d13c0
SHA1e46defe88265cc5c2f526eef35968fae072b353e
SHA256b4023f5a65feb530ccc75671d37ab95274f421713db6e928483a311719ae7cb7
SHA5128735ab69f7bdeb1bef5fe21d4901546c5e98f3ff191b11bb3ec4fcc2f0516208920e156135aedffce80a69d0dd3bd9cb882ec492ba8d65edc94551b8182307fa
-
Filesize
27KB
MD5048d0b0723b5ebe6b3fd3fc0c134768a
SHA16457c837ecc2feaf76e5eeecc3e0a1fa73c74c52
SHA256bc864cf603a96f235a4c7127566cca49c39366c898bd728a1a2d5b1f6d6551e3
SHA51205f9eaa0ad6deac9886ff123774bf1e15673de9afe990bc297885bc60d5ec8d16a97253bed3a3cf15c4b47b52bc34bbf1d73686f90e90b07280bdd31e05ba9b9
-
Filesize
50KB
MD58b60289925429b4b328adb7006c1b532
SHA1cec62bfae8589b906b19478fbbfff9d9071112ae
SHA2564371eace7c9afa7e3d79d3f0c73653f7c56cb5fcbdef8e87982c0dc748fabc49
SHA512db2818f398bfef63f3bd90b5e64977ae02efd56e2f7cfcb89e388bbeb8c3fac894ceeaedb7a4b599acf500a7102c88bf455a129f2f3d5e48bc06cc78c23f58d4
-
Filesize
15KB
MD58b7b0b21edb737cb750d51bec83a1231
SHA1c52b24e56e8f6ee345d96e54631b32fff0c48ff9
SHA25629e98ca166bf13bbea23780bf8334ebbf45cc3731cf6bb4887d38d8819cc15eb
SHA512b604c35872c8fd74994531bd20309bebbdeb80e4ab3dcd5806f29b813374a7942521bb02a4f53b2e3c6fe43cb0291e78b75d5f5770f1f96511ef65b545e8ac77
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\runtimes\win-x86\native\msalruntime_x86.dll
Filesize1.9MB
MD594ab867ef06d046b6f65adbcb0994638
SHA130768967ad3b95aaeb8ec671f96e176a6d5dd1fa
SHA256e9501bd3899c05167ab3d6cde455e7c81bc4bd138314207f3cdfe910b21358ae
SHA51281e20e97829bd2102e552bf78f1da4a6986ceca475c6514c7de9a40adeafdd7b15c15dd10af293df5b4c21e4b1c431c92591d19559c9c71ba5916d14d750c090
-
Filesize
6.0MB
MD5186be3e8a4fc4c312123d115b17129b2
SHA179f2ade5f553ebfdf1852c799117b5e2468438ed
SHA256acafe6f117ff6c8d6fb65ba6405d00f68b2457e22d21908626c06c93fd9c3010
SHA512a257201b6223a8d938a6e14c17236ba66ff23b7b4ae26a63984db593566cc4d241d11d6bf3f2db34bd5c645e63fd7b583b62a0df49bf61aa5ff370c15c8b313c
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
Filesize17.2MB
MD53f208f4e0dacb8661d7659d2a030f36e
SHA107fe69fd12637b63f6ae44e60fdf80e5e3e933ff
SHA256d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
SHA5126c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.41\MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe
Filesize1.6MB
MD5a9ad77a4111f44c157a1a37bb29fd2b9
SHA1f1348bcbc950532ac2b48b18acd91533f3ac0be2
SHA256200a59abdeb32cc4d2cec4079be205f18b5f45bae42acb7940151f9780569889
SHA51268f58a15ef5ba5d49d8476bee4a488e9a721f703a645ddd29148915d555ca2eb451635c3b762e5a0f786d69bb5cba9bffac3eeee196f1ec7ad669e2d729fe898
-
Filesize
201KB
MD511fe091ace9d03b9ada6d5a22d12c0d0
SHA15379ebe84500d425586904e7f9ac0393ab2a9d24
SHA25650f4ed60a507ce9dd1f3f4e7d53053d923cb71594374a25251746a9b2271e4ee
SHA5120f39af99697332c697ca62e2708e0a9200552a55f2d3057b64e9b18df2fe2828be750b14b5336ac9518b4c1282e82cd170b64587cf56b45b840ca231108b7fdf
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\IdentityGS\CertificateInformation.dat
Filesize1KB
MD528c3b82727a5ea653224ea32dc895587
SHA122472322931c5aa6c42eb9ef3b058e4c4c156a2c
SHA25660586cb008247dd45e7cee57eb9515beb54c68308386cd1410f1834350ea0621
SHA5129c95bd0b766f3764b102d44cc1a7bfda0cf9ada39560038f132e3fbfd45054a0b4ed9df0ff3f55c0a4fed80fe15bbf2b5a477f87e0d8affa8053ce8f20dec2a1
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Client\runtimes\win-x64\native\msalruntime.dll
Filesize2.5MB
MD56bf1d412f82b6282142899a9e4bbbcd5
SHA121583e22b3c7650b57d50261f636083960cd9bba
SHA256060fb56757da195e86eb7363c0e9d38291dfd1876bf847c71ef4d0bc49cc1d2e
SHA512e7ceccc890536f8d6294175cc437ac681f0824bcebf98e86e086792d825201b7ee60292ecf94c025d912b850f6d0338a356434ec62dea2918eab94384cad2ee2
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Licensing\runtimes\win-arm64\native\msalruntime_arm64.dll
Filesize2.6MB
MD577e00bc4babd16defec4ae7ba25fbe00
SHA1f4e2aaa62e5d681fd6860579f23af4b1e05536b4
SHA2569187b23577ed4789d1cb6383e837f577687cfb1a9c7d34c2fa3ef6b6636b70ae
SHA512ada8e5b7a5d1d381e30796aa2bfba50716c54f1a30d124e71aef2dd35e9cd0436e29f941baad5c937f9e55e474482e15152cca585514ca95c3f09ed946ae0269
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Identity\Licensing\runtimes\win-x86\native\msalruntime_x86.dll
Filesize2.2MB
MD5d228627a3f7a95b9a57db553a686284d
SHA1b9d520cf69fd41037756982e1f14ba4beb53e5e4
SHA256d68ba651eda3e9d7e1465ce507ab88c9547a6429039b01324ddd78fdb66fd922
SHA51245b5fa5c5d29f581b81920aff7861be3b847978b68732641df4d0880fd9cd0f7c369cb7fa0a8fe0ba135e1eff310b161893de5692ea2c0f306e61996bba6df36
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NavigateTo\System.Text.Encodings.Web.dll
Filesize77KB
MD5fa9d0d182c63c49a4c567f7c1652b6e6
SHA155ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
SHA256e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
SHA51258f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NavigateTo\System.Text.Json.dll
Filesize627KB
MD563f1d0b53ce47b0ac3216281c8bcaf24
SHA1090cb7392ed07a94d237b5aa2175689faaf49b7b
SHA256de069c408673e62b098d6e37e64fc2308f02f3f16cb45e051c08b52fe2d104fb
SHA512386294e2602642204ec02ff514d3064ddb7ccc6f56e955176b09b23bece87fbf29c12a532e13b77a918842b05b171fde6b4d48c7f6567928d9337a3883fef521
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\NuGet\System.Numerics.Vectors.dll
Filesize113KB
MD5aaa2cbf14e06e9d3586d8a4ed455db33
SHA13d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA2561d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
SHA5120b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\1031\Microsoft.TeamFoundation.TestManagement.ClientPackageUI.dll
Filesize21KB
MD526e2cd4ab0e53bb8da65ebcc7c22e88c
SHA12c00f78c1cdf445ee1eba97b9e1d15cebf357b96
SHA2565495b24a196015fedbe0600422121e617907e8033fc2a6ed2739c357f799f923
SHA512fc7ff3533333ac0c718cb8e4b79917b1992fca28f0bbeb236221eb4ad9e9a748b42d474027558066b2084c75d705487fd58f90719a87057345b05bf843fab4db
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\bin\git-upload-pack.exe
Filesize43KB
MD505d8e254f3c00a27fb7ca03072f8c812
SHA185084199d0d94691db4c68bf9685b58dccc4e637
SHA2567c6d3fb51140e00849d1f261ce1b03f849156771d7f3d6c5a8f307d3e79cded5
SHA512a495e30cffdef60ca2930dae1d68c41edaff0975f20ea6cc5de6e4390ae5b1e3f4927202cbce8e043c3bfa6bc9d2d3d35d5eb8a54591121d8faeb9b75422753f
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\share\licenses\libtasn1\COPYING
Filesize34KB
MD5d32239bcb673463ab874e80d47fae504
SHA18624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA2568ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA5127633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\mingw64\share\licenses\libtasn1\COPYING.LESSER
Filesize25KB
MD54fbd65380cdd255951079008b364516c
SHA101a6b4bf79aca9b556822601186afab86e8c4fbf
SHA256dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551
SHA5121bca76c9f2f559a7851c278650125cd4f44a7ae4a96ceee6a6ba81d34d28fe7d6125c5ee459fef729b6a2a0eba3075c0841c8a156b3a26f66194f77f7d49151c
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Git\usr\ssl\ct_log_list.cnf
Filesize412B
MD55b561a90362b8eb9127c792c3f5902e0
SHA1a2587c4e97408b64274e5e052b74e3754892c13a
SHA256f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b
SHA512ce307f87b90e0a0d09335577283ab4509802b43d14725d76c65139f6625f7e4fe636f41c9c398ccc9a2c70b229a34fd796b8ae0e9f5f3720e43f727a60232167
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TeamFoundation\Team Explorer\Microsoft.IdentityModel.Clients.ActiveDirectory.dll
Filesize1.0MB
MD582b4153a5d552e4731876a145fc3ceee
SHA12fba5d92d890ea54b2f32fa7be7e9876672b8b41
SHA2569c530971bf1ac091c4200fb1d662fb5b8c388a4d92a418a31c738223a2247e73
SHA512f14e21425792e4ea398b680971070efc2a9791d9b3dcbbd5cbccbb74e9c12236685edae125f0382ed5078fb1cb309754a2746175fe5480adc08256f77781f210
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\Terminal\Microsoft.IO.Redist.dll
Filesize126KB
MD5dea7ab4b024cff3e29c08da915324586
SHA130f4ed0eb4e1a2e4900e4f133ed7c09958d91498
SHA2566c94ee150cacf59561c1c38bf20e0d9799de5da6ce80d964c83c3879d84100e9
SHA51247673e2b02ba6496899a3125a3992d37ef70fececcb00d1ab475732bfcc014ae803dc0e7c857fe0a3fa40c4f04b6cd2bea2d20885aef8f2a1888728bde50812a
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TextMate\Microsoft.NET.StringTools.dll
Filesize29KB
MD586ccf43de2b37e5f47c47eb02602e419
SHA14054567cb1c6e132718ed7033c8f76b478865187
SHA2565daee3ce65e89af5324d2fb25653707caecc86a9e5597bb814678bb66f3ebdb0
SHA512467b78f629e32ec02249bbfd2d578c6f04d60a376b57365d66ce3316a90b3ebb41f58ed08e61b9e1f3b96f53e3720540d7b6bb0c797b2d69eadb640ba8919483
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Editor\congrats_tutorial.png
Filesize14KB
MD58efdaffbf407c5ae11914ecc954f6e8c
SHA1e28e6746b22cb56526d207c4c314d2762dda506a
SHA256c6033d0f8a531e212ff65b4558b652f25afa309b39eec8d5ad99b0e5fee63507
SHA512f1da670c1149043873c0bfc0098c33f974ff1131e4ca502b360f6908863fd4717ebc944b9ddcb87f719858c90b4b59226c924526b47e628bfc4ced6560166cea
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.StopDebugging.png
Filesize608B
MD599d44b5a0fd8c60bb3c4ea826042034b
SHA1762eef5c36b386004f520236e09a76b0f2042583
SHA256d0e80bce5156459548b965dcc651515d247e5ff3ef6590c3e2ece7853947b5d8
SHA51208cd7bac9e35a783582d8e46963809357aa6f32deccbc53cec5b4a930be036881f6cd2e631c9ef75c8580c76b073069b1216ae3aacfc38112a6d5c394a0edf31
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Platform\Guide\Content\Images\Welcome.Python\Welcome.Python.Run.png
Filesize23KB
MD5527539837e09fd6e8f3461b5a5356aae
SHA14e795a202c5196093f6ebe8ff57ce266faad3f03
SHA256822ca512a32744427d3d0d307a0eff7fa3b1e27c8f84b9af5c4a00865ee53a51
SHA512e3a2363fb0c80bf66f65c7aa9c37009f0fe8218bece77d9736bd62d72af87d67aff53d8d4b7c39d228839082a3eeb74b34195d4b6f98aeb43cf7bc8fe709ac0e
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.Identity.Client.Extensions.Msal.dll
Filesize64KB
MD5352ee196cd65c98b729065aaf6f5c9e3
SHA15da4c568740c6c91e02ef0e9e1dac38c52ae33c1
SHA2566ceaa8b598e7985d5637ab1659566dff9c1fda37edf0f044759b56444f739018
SHA512db12aec8d7e230994e240c7b7fedc5420d3415ff199cc6279b8ae684e81681e139d562d9de39e4eaee1879fbe7a83eef5204e7e17ad475257853519292e107b4
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.ExtensionEngineContract.dll
Filesize278KB
MD5bd8a9ec001944a742e01e5fa7d2fdafb
SHA1cc9d83da1cdf3a980fcf914b43457e550f8fc959
SHA25660a7755a59d9299da418952d60f9638a68e8eb54ba76e22fd6d93d5bd55ba005
SHA512dc3308f276bc0802ec0fb0d977dd13aee696b9b819933b54ea417cc7efe734ee96445d4e2d4b850b89f33d82d1fd108dd44d7fd583bf23345fa8a4f7495ef7b2
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\NuGet.Packaging.Extraction.dll
Filesize817KB
MD5f3b8b469ed25f0655c8e2fd074a6cf83
SHA11e36331e383c2fecb896649aa867fe93301ee6a1
SHA2561751c9875931e6b9092c75da7e2daf15c9f8f96b1bdab9b8292b57702797aedb
SHA5129b29f8b1c3b9edeefb39552a9699270de76167aa5b5d38c2e116bf624e1f9fa12c0767cd44f20a083d91e172084c4dcc1e1d818b475e4b475207acd26b881223
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\PrivateAssemblies\microsoft.visualstudio.setup.nuget.config
Filesize702B
MD50e10866130c2714c060fddd932362b24
SHA10907cc203e315969d5173681623915ec80a5e4a2
SHA256699f9b31b81270d2432f04eaaf72e1e3c2b68b8dd55fb463391f177925ca958b
SHA5129c62e9a5714afb139a07e916a0b967b281e71b91662b66edecf0f287f9f7ae71157077305c5048332651f920c4eb63863794c6a9f656baa60c3f44c4ddfeb8a9
-
Filesize
278KB
MD57a9f33eb163adb9587b5ba52be511942
SHA168a544e6fd0c6e41b229ace728c5df7e282587ba
SHA25621336d89ffc2eab91d1c9c422b653477764d08968310ce66b3ebf1614b17dd48
SHA5128f3645ef3e7325773b1801f3062f7a3327e9406e6ac476104a893573dd1c9a27a2d2e21dee8d793835418a689236a708a5b1914d17d3b8fa1264eaa4075a3f76
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\WebViewHost\MessagePack.Annotations.dll
Filesize11KB
MD5c2d28e4d566ae3d06c93462df8d0b1db
SHA16e190b93046f32df9281efd7654ce0dedaf206e9
SHA2563c11d559b96554ff3389725412531cae07ff9c8fcb39bf4c400a1695ffa53db9
SHA51282b3eefcf4e5e16da229650eb62177dc614329a37b5b971b82fca0abf3ed3b9c2c38d40355da2311d880594c592ce637894b7f0fd243731cc41d1550fad103cf
-
Filesize
325KB
MD5e7b64033f1429a4365893f414338796d
SHA1ced68447b6cb3d06701fab79bdfccadf17c81fa8
SHA256ae0284726ec89e4a7650ce2d4b7dc340d432d3ea875b542ecf9e18d0ae8294c7
SHA5122b9facfb43dfd9fff416c4f6b389ecae72d4e99b5893b4d72e75b67e9ac20bac7dc86fcd4ceba0c10dbdd4a63f85b92c04c55b07e9baa0cd8af5459dcf6c07a0
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.AnyCPU\ServiceHub.RoslynCodeAnalysisService.exe.config
Filesize4KB
MD52680a38b64ceec6217604318684d8142
SHA16a7c75ac3fa9321d6b7370abf24ff079899bc74f
SHA256631dee783643c94747258f22c0d7b19042f4f40c20ef50a3626bbd97f5b7ab82
SHA51293fbb7fd8080aefe5e46491ce3b16e94603243e3193d5d928f4654392a359c508aacaf65be5934b64fdb8dc420dc012ec96987aab3c95f5323edc1ddf21424ed
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.Extensibility.amd64\System.ComponentModel.Composition.dll
Filesize287KB
MD54597e728f51b16cec72b6bce5a5b56e0
SHA14e16bb59a7592fb4ff63c35d0ad8f448064a9246
SHA25682260fef3a01a429ab525a75765f263cb54c5fd01abb87a0a4dab15bfae6fc37
SHA51224f048ed781c16bb854b431ec1afe2ffd768be6c20537b44ba18d72ab7718ec71f664adc3a74f32f694a7df1a1991fc06e6426a0c6838c546ebcca685b493d80
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.Extensibility.amd64\System.Management.dll
Filesize287KB
MD5abfa6d66fcd4a2764c455e75514286c3
SHA142c9b4bf911c9e478fb637c6904d6f1a177e7bb5
SHA2566995bc11aa735e6772222e782eea80238663d11fbe577435310735ce0a197335
SHA5122d02ab4eb94ab6407ec0c94bce08c663dbae7ea791a3e161217308237b3eb83ebf775f7c2a03c0d2050349ec6f39bf93b0f271d46399d4f9c0d33b00ccb1ad37
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\ServiceHub.LiveUnitTesting.RemoteSyncManager.runtimeconfig.json
Filesize655B
MD547329322d261d17635756dbd1d3e02a8
SHA1dd2ec4b8b24e96cab1982d086ebd10ad9c60b139
SHA256cd4b73111d22896893e6e79272118b53f635f8634c8b6076019b5a1c16d4f331
SHA51298d6b48e4d3b28a9adeac9b63952d5183594dcab5ac507136179500bf9bbdfd291e5ce3111908c34e6792cac0d9985a58c173193b64e82a7b73a10f073beac11
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\ServiceHub.RoslynCodeAnalysisServiceS.runtimeconfig.json
Filesize712B
MD5a97f4472863cc9c780e71f1970fcd576
SHA115b87e9093e996da710b96bf662f1d36f71801c6
SHA2568c339aa59287616c804e03db32e946e19c2068fbc2af420b2f30d10b2c67d91b
SHA5124016da49cf41f64e6555cde370da0733b3d34338c89513925ffefd54c4ef5409e9e17d8c9942ebf65bd7d3e727add43c3d45b7a8609a3320e544cf62b6106652
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.DataWarehouseHost.servicehub.host.json
Filesize225B
MD52257a9c6c927cfc9c7e2a45415fed6f1
SHA1d928fde93a93772981df2f1f4b1d90e9196ec28a
SHA2568bcff37d88ae726caa0ee0f981e5a6a1846a5e90b1330d1fd0e5776018252d82
SHA512c71ccacc4fd1b0d8c29859f9d4dd5ac88df79160c1f1d3336f0772886fd95eef3762ba6cdc511b8fceaa65503a639f2453909dc0a54e4fa9fad7226b19bb75d1
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.IdentityHost.servicehub.host.json
Filesize260B
MD529fae385c57c8b8adb10c820eb092b96
SHA126cc5579045969ba24b559584f1ddfa9d9c647ab
SHA25604458aa0aacc1226264335aadaec9c3dabc0a3892762fa265901b668b69e7241
SHA512269f0ff0151adc6b176020c2d126462db6edd47dd5168152d0a6f48f68347022e063811312b844f86437b97f0a17b8c984085e699665e8293b69522fca1542a3
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.IndexingService.servicehub.host.json
Filesize251B
MD5b9efb384e400a26e1d83584fcb2331cc
SHA17dc046fb374efc0418cc36108b843d28161f95d1
SHA256a37224422447c10a65823596385904bb23e0a6c7f7f4e302c749cf4bff16b98f
SHA5129d5491e375be256515016a571faedcdfe168d2050907d37fb988e62771d1c678545ed6483de86d81ea09bc4190de19ca3f48b64e8950870e64a76a3c34c7fb7a
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.LiveUnitTesting.RemoteSyncManager.servicehub.host.json
Filesize241B
MD5156e048be9c5b83de2b1739b298e2bd5
SHA1fbf3a85fac51de6aa4bf6d47081fc393991c8aa4
SHA256ec7c98517b92f0f8506280b1977f60c928e3b3e6049cdeccb25080e714214320
SHA512c953927a31c08b46cf63cd856c5a17a7938cbd3138a94edc53a540f784fc06967273011858dfa3621f805c00739c6b4b0175b7e37a5c569abdd4fd5d33de2a90
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.RoslynCodeAnalysisService.servicehub.host.json
Filesize273B
MD56adacf94917eaa2411265d3365494607
SHA1256d5622b10c78bbbecf4b52c3fa295e1d407eff
SHA2565207382bb7521800ee6fc4ee654b78e57628f43ada57fe5475d016422ff9432b
SHA512be1b835cc9a8594f437d248ac1f0796ec4654d996dab54cf81943dd6cfa9d80ca53fe0fdff7bd022795feedeb3c7d98799fae49329a2309331c72e555f8912b7
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.RoslynCodeAnalysisServiceS.servicehub.host.json
Filesize274B
MD59632653443fb47c70ed7c731b2e93059
SHA194870bcf07ebb8777242eb7cb2501474e95901a1
SHA256aa568397d5afc848ec42b6413ef1fe706c3f322631ce732ac0a2ef0a7b93ee5d
SHA5124b898e01c412583a1e13f72b52f0a379f86e7e986566c8b4ab31567e7ed922cea881c40c0587747a734e9c0919c8c0b26ac5ede264f23012c26c9f1e2df30062
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.ThreadedWaitDialog.servicehub.host.json
Filesize226B
MD506674920bf64a600888a1417eec48900
SHA1e0aaf0bbfac83e3560256634532100d9ac7b0680
SHA25690bf3e509e3cb334471215efebe65bf65b584b7fcee3ef60449f240e6196cec7
SHA5127fc5ddf354c85033d52896f44aeeb6bd5348554fea933fcd2773532f078713ca43040de8f04ff950ae03b549458a13569938c386a517c7236e98204a304d5aaa
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.VSDetouredHost.servicehub.host.json
Filesize262B
MD5fb7e24f8da51c1a56050d6987468f0c4
SHA18b69c04f6f0646bc2a287b0df936709d8b73d3dc
SHA2565a32b493fa3a1e96b0b2b428724bc3906559d37341c7c9c3527ecded8c06deab
SHA512af03a15a12d5239530002753d043adcc98abc9cfcbeff7ed3b8f0ee4fc5232e34247e3663df2b778c3a6187791d3174279eea7ae5bc64ca193181f106e15a34d
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.dotnet.x64\dotnet.x64.servicehub.host.json
Filesize223B
MD5a03119e7a8cbb09ad134e36b850b7626
SHA177002d088bff1a5031fdd3e69c0a88102875a640
SHA2562985a91ca358ba814a159ca7d3e551ae2acfd7fe15d81df8f9f58ae63e4377b4
SHA5122343b4259ba793e6bb24e11cdeebeeeb3e240878c51e00adcb78d2120cde0b2a591ade2168a7c71f0ba4f8716fa3d98eb370eda944354415e3a3d6358e6d9461
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Hosts\ServiceHub.Host.netfx.x86\ServiceHub.IdentityHost.exe.config
Filesize4KB
MD5bdc4cd2a57442efc1aba0c60586d394e
SHA1f7f6c411b70c4e8ed2d6723e6083653981f6c103
SHA2564fe10d6993cf4cbdc426773865ec4077d6596319d51a6662818dc5a8a0c565ea
SHA5123a1eeb358aa79b5084423ac75e0ed57d23fd32f9c22efe76a7dbd2fb913dd45b42f44796da05f6892f24fe3063cf2cc09d4708fbd56c32a8ef8f9758ee2787e5
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\Microsoft.VisualStudio.Threading.dll
Filesize758KB
MD5972d81a9ecddc12f552b0fd6587a66b2
SHA16e5e90d1773bb9864113c37ece1285d5cb8d3d7b
SHA256b9a18f8297719b8bf17d540dc08d51fc882fa226ca902954dc3b0957140b5925
SHA5129a8791aa96a6cf47c692081ac4d8d444e40eeefaaa824c9c9e0e933e1716005c6c5d19caaa97aea1bca975c76328b2c13f4a9b99c327185dd4fada87bb346787
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\Microsoft.VisualStudio.Validation.dll
Filesize37KB
MD555ce53f1e140d12cabbf2b227d14b666
SHA1097dfd15d81ad308b02d272c41aca9388625ddad
SHA2563882be8f796d77c645d62d7a4dd3b29fe497ce1e0a1da41a9ea26ddf9ee69da2
SHA512514eb1d48601e1cfb77814ff10966de184694f2cbfd4eacdb18f947b38d9a196b49a4d485cf3aed6770a86e57690966365edeca244b3b8b8783c808477c6199e
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\Microsoft.Win32.Registry.dll
Filesize25KB
MD559c48aacb1c413c108161afe13fdbed9
SHA131ace4b26d8a069c84aad6001e06c2a5483806f3
SHA256e9a9d281c1a708aaae366f82fd6a1742f65da2918cc4fa5eaaaada0be24277d9
SHA5128252abe64c67863d9e4c70e820f0c69c517b8678a4b4c13a436118bc276e5f21e84522b93566c0bc009effcb251ed67bdbc60e4907abea2f33b6be3764e28d1d
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\System.Buffers.dll
Filesize20KB
MD5ecdfe8ede869d2ccc6bf99981ea96400
SHA12f410a0396bc148ed533ad49b6415fb58dd4d641
SHA256accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
SHA5125fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\System.Collections.Immutable.dll
Filesize246KB
MD5af7880a90c02c0115cd169c7182ab378
SHA16e3ccf50bb1d30805dce58ab6bdd63e0196669e6
SHA256d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
SHA5125377f83cfb8b9892727ed22ba0b9b1a75b2d4750caa6da04f4eeb0f6f9c0f75949226b2ca00876ad1f4c9de02f8ffb1cbcdb3048fbe6d26a6119148282e818a1
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\System.Net.Http.Formatting.dll
Filesize174KB
MD5b676d5e9828d6010339743f236f54ec4
SHA10dff461be2e04ebf6da5f4f2d3eb639cc2e0a8b5
SHA2567b58adc6e23b24cd6615b35e848a002bda053a26d48f9ddafacfc8098e97c49c
SHA512cca0ed47b391b12f44716db1921314e7dcbf2a9f6b0916c78642b4aa814825c570569b103a7f5e298e9c02dbae22e7cb905f08f80f94ad6dcb69fe09085cd8a8
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\Microsoft.Developer.IdentityService\Old\System.Security.Principal.Windows.dll
Filesize17KB
MD5be2962225b441cc23575456f32a9cf6a
SHA19a5be1fcf410fe5934d720329d36a2377e83747e
SHA256b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
SHA5123f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\VsixServiceDiscovery\Dia2Lib.dll
Filesize57KB
MD5be6474b726207994decdc22e84936a3c
SHA1ea1d16f16de16b29a576a1b5cc4baa31bc5db9bb
SHA2566c4cac68010fe032218efe5e9fcf46eef9f77bfaa5f3bd33f03c5ff77d5a8fac
SHA512d204240213a0b509101ae3c9b691e9f6a141946cf3284244f56314183c84d24c1cdaa28661444fb8e1dc018e24f8aae4505c35f9994e368032a9913c9de8ff59
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\VsixServiceDiscovery\Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
Filesize21KB
MD5b340a021abaa327244b5f02542bd1def
SHA1c4471b8c3bf60ed300ebce0bd843f017d205ad5c
SHA25621e9388960143eab0323b9b56443b6c47439973b1682653c37e0e50217e3bb08
SHA5121970ebe87910d0b7759cae3139bdb78b73e04b3c5a8a22ede42b772e1dc73bffa05d82a5684aba1b90fa265e30e510806bc5e782117ddd620612625c0a6b2d64
-
C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\ServiceHub\Services\VsixServiceDiscovery\TraceReloggerLib.dll
Filesize22KB
MD563d53278de054ac54da51d94d2bc0c9f
SHA166eefa94909b3d8e2ed0f1d366c27d9b261c1a7b
SHA2566830c0f1d3f3c17719181e73dd5cfa8ccbb3f3c575329d2120576545103467b5
SHA51245aafdc6d20f6eb49f149e6c5fc3930d78d06169c95ab87f7b2aefb13cda1e9072ce7bf5d9d7a07483972ba9d87f7ee98fcf6cd543fa44c46fad49d0a9fd516f
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\System.Reflection.Metadata.dll
Filesize476KB
MD5b25621450be68d1c0397575dac869eb1
SHA1ddbef3409ec74c286cb7a22d9c9fccacd9562a70
SHA256f79ea5e38af769cbde5d7f5e873564708941a148bb461472019e10373ea4c780
SHA51200c3d7e9c459e876c0a8b4122052ccf7a5f5bebe16dc163c928317efd567aaa523343d34c31f38c260aaff17a36db3c26d41e5cecf3f59bb609328daf3bb84e9
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\System.Reflection.MetadataLoadContext.dll
Filesize251KB
MD55f9ccc82572773b1693e341af6f019e6
SHA19bc8192526e56595971de16e93b853fff3bbc3f5
SHA2561953d4d879a68fb3548b6417bc13e11673dd165e86610c4d7371247a18f8f2f3
SHA512f1d91bd17abe512001dccd09056cf7f85af559abeaa8ab7941038e12a9dc9b7f4c737a74f31ade300f3e6594e0df947b0326abcd3751201f2bee23231de1ae58
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1028\FileTracker32UI.dll
Filesize14KB
MD5dfef8d748661c7c74e115c163c4a7959
SHA1ddaa79171a92aa04ba80836616a65b373714a5e0
SHA256ad179856492434272fedf43e2ca18a852164e086117380fc7390f6b38fffdc21
SHA512498e4e0a58f398f9236bc0821119d8270c01e2ec68d91418cd1184db220bf3d7d8855eec37b6a35b82d4a166c59b407e8ef96e61c2dd05f91fa098d1205cfed9
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1028\FileTracker64UI.dll
Filesize14KB
MD5bc4a54db9ba29117c6fd46f467c23f55
SHA16fdb4405610666e6437e13a8254d50794ade9193
SHA2568fed59fe774db24697b54b98976066f2650b5a28cf1f5fb73976a89d4865b3ba
SHA512c3f0b4c14cb599b97cd21f4e5ebbeeb5e3ffac083f507cd14e1889c09f909eefb5625dea8ea4698be64f7c39acb4ef711ebc2663e8a7c6629c5b774b004d1223
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1031\FileTracker32UI.dll
Filesize17KB
MD5669b0a9c7675a1e0ddf3d476ebee22ed
SHA1457284c735a63d28bac96490df5e8d0913e5de7c
SHA256b41de94fafdcd6273501868505a87e4d4b295ac6d02ca489e7bf63785b906890
SHA5123af5d051e2c8f3364f5390513fa5ef216ad3629e40344b7541dfe0a65093dacf66db6a437377af377911341f3b0b5d460735f18095ead7fe6a6d0d67e0aaeb42
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1031\FileTracker64UI.dll
Filesize17KB
MD5244621c8e111b134f8a647949d63f7e2
SHA15cb1849cdf62353e69817cb1dcaca93434b530aa
SHA25649e914cc611874d9fbfe0d112ca0adb753eb25b0d71f4043aae335a5b8a0fe72
SHA512f60e71b791f564dd49910b90c8288bd9b625b4403f562433a90047cbc5c4677361035f047e57786c62438920ade320a7b7e604a240af28476eb306523a08425b
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1033\FileTracker32UI.dll
Filesize15KB
MD5b7816510175000aea06e14d131b531d0
SHA17cf0ea74bb3d1acad4be2842fbf73d476a27a220
SHA2567eaad7d2cf4e9681fb55f832c91886116928169bf65518cb63a8f7d23f07adc2
SHA512d855d2efaef88ee152e7ecfd32d958c2933eab40fdd562a1d9736ba8b615697798ae36ad983e3b8c82605f5fa715f9dfd432775f5273de14260d9980c401cd86
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1033\FileTracker64UI.dll
Filesize15KB
MD5bbdb4c21d5e275156121bf7f79c82025
SHA16eee2b1c2a98e68b9200d99ee61025ec4c6702dd
SHA256fd3d7383387be59aea585e49473b2517de7eb88605f23a34a146570a04507d98
SHA5122846c7de442085cc17a2fa3f85988933ea9fdf24ce7003d5d840026ec78b11d45cb28828e724e4ca7166f1888f7e369ccc422ca03577ab9c40ccdbba7e6a1e1c
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1033\FileTrackerA4UI.dll
Filesize25KB
MD5ee0df474c7c3e9f6fd62002c01c92324
SHA1d7f6763386981971ddb78fd59562efd55a66f981
SHA256f443828c5dddb7b7f8d2b4aec6caa41937e4c4cc3022cbb89f37b4f19e4acfa5
SHA51265a76b3b2baf93cc2ee825be3906aff511fcc8f006256cd4cb76def96f74f6929dd0361203dad5bb1ec923db8ca2fef4002ee2afe3eecf93e0984f7c7bcd4160
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1036\FileTracker32UI.dll
Filesize16KB
MD58af129679b7e8e2abb5776fdb130b620
SHA1fb713add81c74370e5efb622069b57e309c404d2
SHA2560337c8fdd8f3999fac7a70a86af8e5ab17241b269ede3cc705516b6c3bf6c640
SHA512ac190b81b8dd0c7f003285ac7cf396d38b599383f8506d125aad7c9bb5555472fbacec0362c4cf773d9036e64ca1ee4a790322aea1aedfed550795bfcbcbf6fe
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1036\FileTracker64UI.dll
Filesize16KB
MD50723de9794b04e227f169a27840e84d1
SHA1ba356f6e6e0eb81b16d69f19207c5930708aeb20
SHA25674d69c5fe68b29376f085f8547f2ea2b70a368b198b2625d7fda6a0c8101b2e3
SHA5121794be793f31931a8a91d123733ec9f66c62f0f194d37c6ed851bf9442cff1990d8edc90f3951d79b3bf56f651e4bc5c7d759f03d767c0413eaea454127b95e9
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1040\FileTracker32UI.dll
Filesize16KB
MD5e7c605ed9d56d32376b849ece39f4e36
SHA1fe4cb7bf825dc34d333f2d89b0fe262946c1f80d
SHA25683b361feaa8456d456b823968b5811cefe9cd6df04e62bd45dad013b4cbfccce
SHA51255f80c79a9fe4f554829acb6be4be8126d453c6efe01b7054c73b9b522170cbba2183fc9416b3ed7463c1587e58ba6c3bebf50bdd5e9088f53408655fd21be72
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1040\FileTracker64UI.dll
Filesize16KB
MD5e87973ca4c75b201a508fbf2a6886970
SHA1000af80bc52ba7d7d641e049cf5050d67edc6766
SHA256df6c9642841f98ae41bf09fbcd26c1507096805b42cf44a0511a6edf6ff7c0f2
SHA5123e856f1ed6ffdab979ff6a55eb9f15eb75ef381320073706ad70718c434070b0b38623484fd5496cc1fc9ebb4f15a319690663c5c7a0b9e162abe76dd6eb101a
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1041\FileTracker32UI.dll
Filesize15KB
MD5409a13625f4a002e4f9a5937ef900734
SHA1802fff0d0e53aa801efe28fb96bdedee14628c13
SHA256ce32cb3b010b22f09b8fde794fb707c06e7863bdfdd6e32e02bfcd2068913044
SHA5124e10d48ebb02ee7b1a6f7ee7f6377156b1157ac324da2371764a021da09828202659264c460bb5b6c5faff803bb15fbaf1f9b73b6951215727b7529a01711c2c
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1041\FileTracker64UI.dll
Filesize14KB
MD582daf43d61e78a92ba66360a80c0b934
SHA120ce4d814854267465b7b633b52b9a612d6ae9e2
SHA25642f5d67ea60a5e763a4668a0b4327adc68a944eccd8292345ced8f3a1f6dcca3
SHA5122f0db2c1bcccf4e8de3c36b4044f2b30299f4f2180fb07b0e1eeabc74cc581eb6ee1bc4f60087899c813933191166341f82da0fb00ebaf9c4ed70df53a0e0079
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1042\FileTracker32UI.dll
Filesize15KB
MD5e5a0d353513c62df1b2d34ad15047b2e
SHA18fdde9701cd005d77b955baa0157741d1f643281
SHA2561b5e66d55f5b83e921600e85d515efa0df6fb70bafd8271bef9ca0c6ccd2aa16
SHA5125246b9fb619d80617c09068ec93ff837bdfb8fea00ce697306874334d2ad0d8dd5f438ea8e22c0e5311941778080af2a99c8351586730c4e67c344c7a8364225
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1042\FileTracker64UI.dll
Filesize15KB
MD53d9d9bf348c5ff0648f68d94553d64cf
SHA18cabf6f1e97f879ca3a6d5c459b0d480b0020e8a
SHA256dbc0e91f228544549c30cf917f8a6f8fda54f7768e738f18203f073e55d8384c
SHA512920548f7edcce47f3953b88700932026e326bd2fd86630f544236d6aa572997a59d3b13d2f07b2ff908e96fdcfad1c638fb7b8ec30067976f20af3f711f1ecf6
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1049\FileTracker32UI.dll
Filesize16KB
MD5138d38ac02bebba164e338e7112bbb61
SHA122dc8bb5f385fd523a3bf38e2dc967b349472ade
SHA2565a5e06321358c86f6f90328a028c750ce4367266f9a054274060dc778ccaff4d
SHA51263adcd5e624e61e69eaa2dee6c5857238da79b8a65ddf2fa7c1a2065dae0c47f0d47ef3b0cf82d04e631384e60c7ec205c39398bc4c76968c0247c842d9a53ce
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\1049\FileTracker64UI.dll
Filesize15KB
MD54602b1927520bf3a385a1ace990ac10a
SHA1f453b1ac643b0719d118874c44d2801bb51e562d
SHA256a731011819aa8f6ede50ad061e9d6e4ba5c315b1c1dc02bd1487cffd46169eb1
SHA512f53391d9fccd9b06f175fb8cd095dcd483b962d4532b4e90cd2c4cce1406c51161341e16166e4385663c5353ac81be23fd9955a3acbba68525409d265821dfe7
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\2052\FileTracker32UI.dll
Filesize14KB
MD50af267f8f4b08b60e7c9de95f7d7262e
SHA1406684e1b50e060962b52b6a253b55ec1c9ef288
SHA256b751a6e5828fd362fd4664b94fec5b016079a6d4256cf7481e6ee5fdfee7196d
SHA51213ed6009c6730a23d8c414af3379cf18ca648379ac6f5d6cce94d22156e4a77de4d83eaaffd6dfa4acd7ed040d562d02a2f18893ecad749c3cc3f070bcb9072a
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\2052\FileTracker64UI.dll
Filesize14KB
MD557f8aa537dd991265f6c895892538df1
SHA15da8e5d3cd578bcbe57823299cbdbb26abac7a61
SHA2560625b75b3d815253a585445e854b5b8eec7568ee768acb9ef34ed6e2b7f9e097
SHA5125bb2e83b48466304b2068030b97051a48f528580344a6bb01288ec9b0d259120732d6b14500fa3268bdcd065a522f5e9de5374c559e947f11ada4e8c54daf821
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\3082\FileTracker32UI.dll
Filesize17KB
MD53739b01e5b7ce46f2c0fe36d92457bbd
SHA1c503200795078d6c0455149f0e5057e140014f20
SHA256eb6da364c99ee0236266db8b8d364ca1d2fcdc9754bf48ffc68d483d8944542e
SHA51212cc3d8e7b0763d3991dd6c353ff3d03838b9eb6b5f8c364364f2e3aed5c8e2f15259a5671f1971dd9ccf92100a9c11cfeabf3d6970ba2e0074f903e70cecf11
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\3082\FileTracker64UI.dll
Filesize17KB
MD5ba2b8cab8b6b153cefdb9889d07d3c4d
SHA19ca96d034fc7e099d9b1edb5fa3436b833e3a188
SHA2562c25ae6573a80111c3b552ec53079377235c33865f02610c5803efc549277b09
SHA51289ba1e983644693eaab519ea7802771986e1538c0ef06612f96337b0360cb94f0672549d326d32c572da8373848f011220d78fe1cdcb6999eb63247e7b1963a9
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\Microsoft.Bcl.AsyncInterfaces.dll
Filesize26KB
MD5ff34978b62d5e0be84a895d9c30f99ae
SHA174dc07a8cccee0ca3bf5cf64320230ca1a37ad85
SHA25680678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
SHA5127f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\System.Threading.Tasks.Dataflow.dll
Filesize177KB
MD5523945fefb54ca3877b2bb684f0a459f
SHA1bd027bc503b5c68b87eed0c899f513195afc36ae
SHA25625dac8fceb82e51e33f2d74d2076f4ec0fb67edd92e02402c9ce6be11da39fdd
SHA512faa683c306a3df55d97cc4b5098758097da0cdfc8a84689bd64518d68552b7f710b88fefdb8fe984b94905283dade10333c1fa6cf85cde3bd29ec8e4cf60eece
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\System.Threading.Tasks.Extensions.dll
Filesize25KB
MD5e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA12242627282f9e07e37b274ea36fac2d3cd9c9110
SHA2564f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
-
C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\amd64\System.ValueTuple.dll
Filesize24KB
MD523ee4302e85013a1eb4324c414d561d5
SHA1d1664731719e85aad7a2273685d77feb0204ec98
SHA256e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
SHA5126b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
-
Filesize
236KB
MD562736e7f111e01091808de115076cb46
SHA10013eb5af8267958c2818322dbe36597243541b8
SHA256f505cb3cfa10bf0ab80d4f27bc9ec9bca2970fcaa98fbd84126ef9654d80dc20
SHA5126a058e43b50239d16f361ff239f04cb98d84dbd9435d3462ca2dfeccb9f449b2d6e9d955bedc3bda5b39ccf78066b98af9589809a700cd4a6a82146e908851d4
-
Filesize
297KB
MD52cf51155a4f119022064b54bf1a81f4b
SHA1ba9ce3adf4db4cdd5dc1c830068b5f6a2b3805fb
SHA256c9a23bfeb551612421bc8f72b53c27d3b1c0cd8fa7db055217a369098a000746
SHA5120ccc30f5840ccf55dbf8535ad547726d05dfec9e56e04137406353ab7b1ce8d44c11a7f51efc1cfc72864951476a81f3cbc4c64fcb08f93f3a0fde9656220eb1
-
Filesize
312KB
MD520c6e2a20b9af20becc4529133bc9e33
SHA11ca7dfd041270557e7f0b92352ca5be0d7c9f9a3
SHA2563a94057e329e7a60bda3e537d3dd9784b849d95b270a56409398f6576a283617
SHA5125a45e385fcb06ed1181edfb5a9c04e855da847cfd8107a96bd6b5c65b9ed766b5f9d7dc4fafd9a4b804fe8d6234c65745b76970c4a80b24e14de75e6f6fe0d49
-
C:\Program Files\Microsoft Visual Studio\2022\Community\dotnet\net8.0\runtime\shared\Microsoft.NETCore.App\8.0.5\mscordaccore_amd64_amd64_8.0.524.21615.dll
Filesize1.3MB
MD5f230e815f0ca9abee50d204b20e4de61
SHA1a03a62e5604ef4bcbc6d961fee133860eb4b29c5
SHA256351888cafc5954df2d4ee76106250f805d7d56ee0b013552d6a28620b16ab90f
SHA512c196b552396af3d74a1cb10ad2e2b31264d128906bf13027e3efbef79f9286b099b16c65345f12695dd274e35457f9faedce9e9f15b3d82d623b3e30549b8454
-
Filesize
108KB
MD5c7ae82bb06ae89f0a4d466f043a2446c
SHA1933f4fe293f4cd954b45d4fd21cf5050178516fd
SHA25622c981d52e99ef0c3eea758179c5d2e8b12de4455fd0dc32af82d17dc6b8b26e
SHA5123f80375e14e47e5e5054b6e020f0824b3d8f05b31452af4d5e8c567f0fdec0c933f8c2e27b598beb029b4e957413a033edeb1a0f18ca068d19c7938488ad83fa
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.LiveShareApi,version=17.10.34803.213\payload.vsix
Filesize29KB
MD54b84cbb077c09320031f983b9ba386d3
SHA14de423f7cfc4d2a5f776232f851e6fd6521de3f1
SHA2566ee567539296a1363e081441e52db38762f3b7ff84d9884704080aa577f5a651
SHA512ef19e8d56f5a11b9789da676013de0e6b0f5590fa1aa9139396441e0bd42cba97753b19312a07e125d0d49bf1803dd67c8d6629d723bfde35a228e36ed34fd82
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.MinShell.Msi,version=17.10.34804.30,productarch=x64\cab1.cab
Filesize21KB
MD5abf9aeb06bb1c651d038e229c0741d2e
SHA1571031f337e9e0f6e2c60104cd85d08c369be841
SHA2567719d5f28e7de10d014fbb8cab61deb41ae67210343c34f6f8bf3374e59a8329
SHA5123255297b5103dee9e4bc6a217fb37c81ea49fed3fd3caffc23dba2dda30d201aa4896caf1e76fa52b3d84110f0c308b5b4c03ace64fdbd551d74f0f3a5dcea42
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.VsDevCmd.Core.DotNet,version=17.10.34803.213,productarch=neutral\payload.vsix
Filesize10KB
MD580420814cc5870329134a825e357736c
SHA1e248130ed71316ca097aaae27ae2e03e63377fc7
SHA256f2bb0a5537b5533bd646d72bcfecd41c02a882bfdc7eb405373625e32824515d
SHA512f3802e203ccf9db0125a54939b1d1cfb57b6919a5951d9501675014f52b14bc725d3663bc1a689380f4fd0584b1c352bb62b303bc39d3b85ed9b75886cac69cf
-
Filesize
8KB
MD5c0cf7ae66dc312aec2d3382780faad15
SHA13b5f44aaa6f06966bc475a809913e0a218f5501c
SHA25663bc3c1abcae9fe2cb02eb22bedbe7f1f7da2e4773cbdbf5a8d0f802b3b12dd7
SHA51243632c0c4d9035bf8c0236878254a6abb47401cea9a39f8b1882233facf06bb8e8ea425bbc8b9901a1260de7f65960ac98c491397a7970fef4b762fe41434b0d
-
Filesize
4KB
MD5a7e4a4708e0b9fae658ec7463c653757
SHA1012232a08b279991175f8fd28fc26f2127a43f6b
SHA256cf26a1bf388a29a12df269e05faadd512d994466b72964a4a34e297ae8886cc2
SHA512139f168263533c5f9af28bac348e670964b0fe80a2697b6561d71b8605b014d2afcd949d047864ba47e917f42ce9c4d170b2b433241bf8ace0847895a3986a43
-
C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202406090101203453.json
Filesize162B
MD5ad891c3b02a02419dc60db8c273a8315
SHA1141a08ca0e25d56bdb35fc71e1c767667079114a
SHA256186c4b16ee009564819730b358dbdbb0792fc27e602698c5f0a16e20104647c7
SHA51264cdaf1d6d1b4072e24f3926f91103abf946ff044cda34a9070586c2d2927bcdfc53381c955e447a38965ee426373259759025f97b715158afc429080956196f
-
Filesize
1KB
MD59790dddda1a3ee4ec24362c2ea6118fc
SHA1fe910ba05c96888345422bd8725c7ff0d061fe06
SHA256f712d2e048a1e9b6a4aa152a7c633a35e6d56b26430a1d49195976ef6984f507
SHA5125f13a05139e68f6f4010e721e3ef7bd316af6088b05baa4011eed2cb86e8d402e7b7ff6acca5af22ecbf90cb84e0c4d6ebb1af86c68a22cc9d80f1de75d98f0a
-
Filesize
3KB
MD52e53b92e44d0e86d6ec597356119fdbd
SHA10d1a09262e4e5d388695bbfab9638d18487a7fde
SHA256f48e4a5f7b80b31d4dbad7e5ad302ea9b29f3a72b47d3b4ab9574e1bc0711c3d
SHA51205b4678b487f3f702ef443c37902a5fdabee23056d314f6895022993b7281d97ae246e3b8adfc8f894cc9e85d8569d39da46e7fab5d408cd80e58a86555fb4bb
-
Filesize
4KB
MD52bbbc225816135e9abc11b06844a1259
SHA1d1a330dc20e5eb8a1f87e4c15cafdb17524ee2a7
SHA256c9170da283fae1207093bc61dee1ce2ebd6cfe4e8dd03495e519991325b71fd4
SHA51271e1d3f5163dcfff770a9b60b5d8d0e7fe232e95f1570ef70cb3c1ee4e6a6e75a54edfd66a1099457fc5aaad785e86e990709e40ab470fbf84df3aee7680f644
-
Filesize
4KB
MD52c505b9696329a8e399f9af5a479350a
SHA17d733db48dcb7ac203112d81b0d80168e89cd74a
SHA256e3444b98e8723b7f4bf63e0e002cf930fc12d6cda1ec754def7e55fe50c66d65
SHA51246190d4330f1324f8f8846eaa4bec24c0691ddae0ca4478021c940ba2e1074be60bfb8f262e42a33f065250056cc15a9aff621d79580433a2320d933a4b71f65
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD554a580e2e4c7193abc6381e12b61c1d7
SHA1cdf5ed43a3926a676b8d31c1b97bd3db807fded5
SHA256a01a6c39251fb9da3fbca9ae3eaba8d54ab2fdfe013250af39774e2b736187ea
SHA512921371521f70e393ab4eb18d7f7984ea68900ce9de53299390703bb36c407fb5a1ca19356931da2f648f1a01b728f145ed41809dfb85e8a3765dd669bf8a596a
-
Filesize
691B
MD599e7fb0924a120403822be199ca577ec
SHA16ffafddca1ca5c099771e1835ca0a2f55541ef08
SHA256b94daf751dcf5106e858e0e1da5d4c7745fde8fe576c1a514e419d420bf669b2
SHA512631844a9de925de533d5c6997b4bcd5895cbffe49447d83f7ffb431741c5049182e02cdcde0fee3d25d17f4cb040cd59266aaa1880e205547971bc0d6d40bd28
-
Filesize
1KB
MD59195481d72efab06e88fcdb5adba97c2
SHA1ffd4aeae65c1c86a49616dd088a6a0c607a8c17b
SHA256bd01b7cb9a330fa34f72816ded0f719c48d86c135dc0617b30211d54c4dc1bd1
SHA5129e78ea8cd34a753e75b521b19a70d51af2973f2e2faad7217d6ac3c9a3c895a787cd20baccc890b415795993fd6bbd67e1d162d356e14af581d2e1ff3e2e000d
-
Filesize
1KB
MD51a50bcb6e7dfda866b0067d6fa2efd67
SHA1c93a779772d692a7ca882ed0dd0dd28ad4e8e390
SHA25661c3a9d73ba3a1f725a25729249f4b7eb0142ced3959d04d53989ee0530e1d58
SHA51238fb05cbe0ab8db48f1bc5dc41948420eb9c5e6743ad71c72cda129802f68e4cba938b8d3a9ed1b0b2a2f3c59e544d06b2cfbb772f28f909783c27e8a454e9bf
-
Filesize
7KB
MD5c5c7c67e068f480feb5081bedaceef24
SHA10018e6ef79e69954b4b9941bca1840575d93929f
SHA256b171da880f68c14512e6d555b75eea559b816be6f5d2ba42c0e9215e93857962
SHA5127de672d72979fbcb0a205ec133910898f341479963914687522ddd8d3054519f7e472e26e6c20d542128857afc38f8dcc9c8eafa7b48edf13a2508ac7783b6e1
-
Filesize
8KB
MD5f106b0528d24fddc738308734bee1476
SHA11681e9665fa3a7a37f1652c5fe9c140cb2c9c895
SHA256a33b08ca9d76bd0fd6370010059b9c63ace5610878291c4bd1971d2688f202a5
SHA512899f96de2190f82fa09ddd6cbfca0d4619373ebb89f4bd570a0370901a59fd82f38df41217860ff0b7c5e73c2fa621a2c012accd8f06119a0465a03ec491efb0
-
Filesize
16KB
MD50b2974b0837e441067cca283c2c209c3
SHA11ec16a5b0a874bb14c6996c1c50622d75c224ba1
SHA256747b865ee2d4f4c068bd115371c063544b67218672d23894d7f65607f4e01f01
SHA512f2c590fe4f7b7dbef7d8ffba26124a9de47c50d543dc50ef91fa7df836f236fde3534173d85f83772fb753b9e0cdccc022d4481eaa1ea4b94a86da0a559a8f08
-
Filesize
263KB
MD537675608d825d53ffd2da98549f89247
SHA10b36e0ae8823d77d566b2a10554a5c0f86c8b5bc
SHA256579f15f2071edc0dac6424b9c0eb2323798983a49946eeddb2e35e9cc3251a52
SHA512c7b22500021d998f00a13c4fa80ee66dd9883fce3accbb76da04ca23c4fd3e5a5c51438467d220dbf6c5a94dff444cedbd50001ee47ab4d304e0e621c000dcd8
-
Filesize
93KB
MD5eed32b4324f19f7322d41123ece27d4a
SHA10897cdbc2e1628c212fca471a265ffa989477f2e
SHA256c89c245d0f431d18b71d63c519e9d9103296b6e9b8e79ccb0502d075a0a32463
SHA512825d32dd8372ddc85739e1484460bb72ebbe6cfb52400fa0b204e1bf8f3b8d9ac700c931a8a51be4eb6e8654f448f454f589382ea0afdad6c4aaeb8230b82111
-
Filesize
100KB
MD506caf9d9484fc720732483d6ecfd74f3
SHA12dcc11b5d18743d4d2e2bf500fd118b6da345562
SHA2560a97d50c36d105015e67616d86349682baf7ea43e32c5f7685a3cd4c383fe8e5
SHA512f086b1ca9040469f1db66371153b2709e4ede8ed1318b3e916b8166ebb4f01f6f0085094e46ff409168a8f2d2b0a012284d34eff84a0a53c5e6db8e5d0d8887f
-
Filesize
87KB
MD5fdfb0281655d1e3c7bc973685bd701f3
SHA1473a11898d4b44542f97510fd7d6cdad212d7eee
SHA25600e941c51832b49958854ddf5c3ab221fd36e0d019ff9979ad2aaf7fc87a8b23
SHA512782a1dad08bf4e4fa94b0cfa9c83d86da6dbab491ad47d973d5493c358d54342eac1548be3de2a444642a93c924c053a97f5de80b88ab5575da0da35fcb896f0
-
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelAIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\20240609010219_197a3ff603d94a6195e81e73bd9e5113.trn
Filesize4KB
MD5712a28a180f65440456c1bda7f2e24b3
SHA135993865d6bbcd06b90dd6bfd80c4d5072c79725
SHA256a5e3557cadcc49fc283573581c81c8577e96f8e4f40ca8814eaee7d8520eebd1
SHA512601bdd1cb5f91ed8d9820e9f9927ce17e7f3ae47ce27d02cb243c545aa102e97059deceb2b5c0c1c3edcdcace4cba490af64f97a1270759c0083bb595823dfc8
-
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240609010151_caa8f308871d4026a57f6d42450be084.trn
Filesize9KB
MD5c526be4281b7155d4f841ecf502443a5
SHA17d257ddf0f2e673d56992d0324af41d2b13b9146
SHA25661573ec82d636c3544f52b8448e67363f101455aa6dfb3284dc28d2ba3eb71c2
SHA5125fa64b169f501dc4db2e9675a1cc0ab353433620e80231dda873a7ba5058e499343ad4c8648c4767da001fd3b4f3ee5de4fcca71542680bc0fb91ad2d524b3c6
-
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240609010203_3ca2c1b2e8f94955a00e8978e79a7d43.trn
Filesize3KB
MD5c3b6b656c37749229ad00a6bcee16d7b
SHA193737b66fed9e2750018a95cb621f631c9bc1a76
SHA2566613729e073604762e575ffb224dc292044c90ba2fd3fc97bde1b37c3b058e63
SHA5122b4b72f207c1f32ebfd1e41041110c05c7a95255c525ca4e048cf4c5b9099501b17a3a6d4ef0ef3c84a8ca2781b7a0fbc5b52da26d1a238aa02b55b77f23a629
-
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240609010221_d58d4aa0817044b48722af15f88ace22.trn
Filesize15KB
MD57d962e7e3b931fa775634e4d6da1df2b
SHA13667f08878830bea497ffbedab846bae838e804d
SHA2569034469d58b1bc5692e5cf498baf6a4d8c76c8fea2d0e5248f556c1c7b1925db
SHA512abc54537c025ddab8856bdf6e8b6a152eac4507059841ccea9e8e1bb59519812db172c097d7c80f807de3b81a338c2c56be7acdbd57fc75214083c0d45d3e834
-
C:\Users\Admin\AppData\Local\Microsoft\VSApplicationInsights\vstelf3e86b4023cc43f0be495508d51f588a\20240609010651_fb1e1de600004a1f8233ac45b67199c5.trn
Filesize4KB
MD531bde34f55ff2c8a914c830f7e0a27cf
SHA16b549957452183915d4c9caef346ab4948591469
SHA25615e4b93915ce09cc1057c87f49c477daddf01dff0fdc5c85ae6dc287bf8a205a
SHA512991bc981746efd27f846821f38fc1109c3283121c19526cdee44399639f01667eda5154c2fc1b9ad12440f26d3014cd671ffcf3d79a6c1d618fe34cafb61f15a
-
Filesize
233KB
MD5965456b794ee2fa1f942a9363bc7621d
SHA1205361dcdf0ee4802705ead70b3dfe9292d4a008
SHA25606c3da8636981f01eac98b48794166715b40f56511a053f559f6742e0f0bf79c
SHA5125426885568dbf191e6121d6d8c11550729158268f912fec0759c3830c182d4b45bafa49d1f0a17d76d039ea6799c16609ed672f74b6c5dea27429cf0e88f79d3
-
Filesize
26B
MD5e3c9f3c009c49e91b372ce3be05da610
SHA1df98879fb7402b9b08bdc18fc2f3d4d5ccec12cc
SHA256f4d08ea820b816e2822bdd3351613ed185e4e36503ccc348f4a8a7957fadfd6f
SHA512444aa325d744a7fbcdc5a48cd7b51814e3cca5caf58b0e16316e015f898773a5d3476059399a704a9b4dc6350d06430ba42a78058f2cd8c03669147b346f22ca
-
Filesize
73KB
MD5bf210f79d1ec7bc41d4195138c43c72e
SHA167b16d44ccc442d9357ecfa431759605a657293e
SHA2564c0caf2a3de7dcada5d889050f1531f96627df3d2610e7d5af8c12722eefd335
SHA5129a226206a71dcba49f3682715eb6f287cfb1edd5deeb71a173e5b386256cf75db931f1a34d275bb844779f2a7cf12872cae05c70dcd270a8016c906b6fd13938
-
C:\Users\Admin\AppData\Local\Microsoft\VisualStudio\Packages\_Channels\953abbab\channelManifest.json
Filesize89KB
MD56ca1c2370f512cbb55abcd237735c8b4
SHA1d22a1ee3d34c0a2fd2d6439067046b895dd60374
SHA256b3741977a7a9b79f3626f09b1f75e77419396d43037d3e96df2ca8cac25f1d63
SHA5125cae7ba1523e324c4eeaf5759e390cd461fd477eabc3c99524c7e8250a0d778932dcbd8a51703c2cb751b8e6faa14a7a4c9bf14112910b7430e50929daeedff4
-
Filesize
69B
MD5fddd9d5ad35d7448cca3ccf054036b9b
SHA166d41e90cf120b54f2f2ccaa3b961b46d00472c6
SHA256f822d6137997edceac51579cce8c173563b392347d10aab0c27f5acbc99a83c0
SHA5128add01a02263d0426c40dd899cf88507b04d832b51098266045dac52e278cfe42fd961450b0b6dd971ee54b229c42e63e13aa23ae5e04f79d5385a502e672b2d
-
Filesize
443B
MD5dfdd5a56b714aec0277a395f2705993d
SHA1c754dec43e3f9106453b289a3c6880b20147ba2c
SHA256508f9455f56eded92b3b2063a373c49ab49d28c44cd32a461f253983ed5cc6cd
SHA5120c32e3923c7525208227d4b6e5aacbc98e1dda3a7fa0f92a3d7b1112945987e0b407e7aba00ab277296b7aecfc242d51161a1c4de420bfc9c6497ad8cd38627e
-
Filesize
20KB
MD56d0fca79faea45342ac7d8c5ca14a3a8
SHA1c0644691358a5fecb088d953b39492083e046daf
SHA25632353d84410361ebf591781f5d5e0ba180a0fc3d1dbcf7e2f0000720248d3e43
SHA512fec2d4af958badd190c6f36e3dc44a22fa8be4f65bbdf01adfabbcc645c0b19ea9f8158386cafaeab8f651baff5515582bbe1b20f1b635442960f80cab8b33af
-
Filesize
35KB
MD56cfde68b47995abb2bded01b44954d97
SHA1fdc5c287f82fd5abcd64bd51fa706aa7a233a276
SHA256453e5d0ff8315868ac8952222a9167711e25c7ae925bf5ff0e6d38c4808cea9d
SHA51289af1edd796f840943fbf1edc76b2d915378ddef716971b31cd009c36c1fd93cd1d287ebdf56fe10ce858011da089b98fb5e6cb3b5f3578dfcdca1326a214ed3
-
Filesize
40KB
MD5ff64c86ecc8867cedbb2e52a046dd110
SHA13d98f70e1460cfb8dbe206491b1f41769852c4a0
SHA256d567684c758983a418d6915893b180eed59e8390e0ff91ac9f4bd4324538f917
SHA5126bfaabf53e553cb08c8f5c40fe1799235cf730524694813ba0cb452ef432d9511a934f89aff6351aa05c764d13552ec47bf1dad335fd15a0cfe64a0475cdd150
-
Filesize
416B
MD55906d5d2cdc2e5c5a79517c2f6c032de
SHA1845de8fad7f6121b813f82a25d25f6efbd99373c
SHA25624d5963ce2f51c40ca2b55b21a82732de1959d420f6cdc20f1e809c34ef49c3f
SHA512dbaecf3e8b95ef67722a098678251e9a9c513e6fc7f758554cba83a2c58212153cea35e7f324e9be41b1fb5947f2653f084d4a9dd5a02ce3031dcce24b5a6f1c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
22KB
MD59b5bc10442f86b015e3ec11b15cbe7fe
SHA12022bab52c25622a7ba73c2116967f0fd8462898
SHA2561211fa72349aeb9f8578a8405937b1bade9bbd578b5fbc2d1858462abbafb300
SHA5127b59e801f1e9367ac8adc970eec47a14b01b986001593cda60f381d4f3f6852839c1204dc228e53377de7bfebaf418a2963a31f533f5c56029e1025140caf339
-
Filesize
14.5MB
MD5a5a07b948c056eaa2c21c0be3459671b
SHA147d0855e65e90648150834d34c03d6125cdfbc09
SHA25624b0c575145a9a5cab86cfde7ee35fc9535ff7bdb102b04a12382d22a9788f31
SHA5122cdb62866507df4354d5989dd512651fc3604da8070f9c34aff5a554f571c0280fe9f63d651edc2a3e8384c33d357e3892ac7e16a8071cd58ae07d6a3985fc8b
-
Filesize
48KB
MD5ddc1c6ac26e5f5c68f3e28f61d5630c2
SHA13aa5d19222cf050653270c1ee94ad934a7c7aae3
SHA256e963c0b4c6604cf39719f53ed186d464ca2cfbc962668c90c826d8ddafb3b506
SHA5129986c1ba0133c393b7abf7c7ad944b5f6a2ae954cde169fa5df79c4a96a74a0d88c4f28ff1d910aca3798169f62822da54485209bba5a5049c4d627dacd81c03
-
Filesize
161KB
MD50205522e4a80ed920bec57dd81b930d8
SHA14ef79b10f276b117b84b306bbddc47ca0a642e4b
SHA2562f062ee1e7b90ef9a8e560d81da73ec979de56ae27433f94a86e4acdbbbed58f
SHA51226604af10fa121a9850a8f75b45125b101494ad0364eb6426483763cef52bf315546fc1155502d40c7ed74e384ce9c5154c041e04a259ea188397c2e115b48d6
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Build.7A6690EADA6671048E65\Microsoft.Build.vsix
Filesize13.1MB
MD5fb8a714c0b93365bdb64b3e4503bd767
SHA1d9eb13c31079da0dac86cda1c2d4d0522b276672
SHA256b254298e48fc334ec72600bab1d8734bfa083b72ccf36d066ef33137534df0c3
SHA512c72659e6e8d4f776a518f5a128862bc32c3fa3260e5fe31ccc6b677df42fc464b033e4db6dcbf291ae1d54ac29752436843082e5cabf2ff88c71e8769d14dba9
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Build.Dependencies.EDBF30B044118826B4A6\payload.vsix
Filesize2.6MB
MD517e2f956238d8ed50f8ddc8636d6404b
SHA180fc8a6b5f5d2ab17934044fa16123490a7fdb99
SHA25659ade7182f10221028e718c91faf122c164c335a1a69d78073aa0ae94a9cdefb
SHA512090c8cf0d9c46bd8c40d0f3c2aee66a35c626e3d0283ae1d1d7599662dbe0fde7b7aa94cbdf0d0abd5b6d0ecf8f2b05df9347552de1fdf8e18fcf435163b5a01
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Build.FileTracker.Msi.D9C1DD803F2B42900705\cab1.cab
Filesize406KB
MD53093e3624fe1e6c748e1232ca38cd758
SHA17804c9765021dfe93c9358b6e9dc2cff9054ff5f
SHA256e4a1e03ba6d3b909838e967701b5567adfb92945bf71c4db7d93906007b545f4
SHA5122485f75d063bd22c13df573fe74995117d1ca8f3c568f9c52a342909fc8c17dd60097ce970f126164086b3930357d3e8fd9baaec04cf9e0269616cd4ba15f5ab
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Build.UnGAC.DA04D174AD161A9E763C\Microsoft.Build.UnGAC.exe
Filesize17KB
MD5671e15c28e3286a23add0d2abea36ca9
SHA185cfdd760cf8e194b72dc12318c289ae4ddc5a1b
SHA256c93f193b1616d8d3ebcd8ffaf8770d7f401a986c9e1a20cdf0d8775074bad933
SHA51262bdce0c4955f4776081690965d59e5c721b7d4330cf35c882700ed10131fff930d87a81cbe5a4d8965b257043d5f3efadb1186614f512d7bbc60262f485c996
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.DataAI.NuGetRecommender.0CF7656F7D5DD9A2501B\Microsoft.DataAI.NuGetRecommender.vsix
Filesize1.6MB
MD5247c52c1906ec9227469764b5466942a
SHA1b988c0f3c694d96a2743b5b8c7f43eaff6bf1ddd
SHA256edb9faa4169259775e72872e19eab855b379731f3427a3ff0de1175a10fee2fe
SHA5122876948d5052692ecc30a51ff439e004d3bce30bca7b87d0dae9f1b2133d6d16e100b9ad3655c7f7ee4a2575f988e8dacb3b0d4d506b8d73baddffc3b3589f6a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Developer.IdentityServiceGS.F75B268C823F3A4F79CE\Microsoft.Developer.IdentityServiceGS.vsix
Filesize29KB
MD5381d7ba9aeeb6e8d6f07fc287263dd64
SHA17ea98858b4ca8ec37639ffcc7573000c69531eba
SHA256cf467d84ce84442ee52caab7ad116e37a03e1d0b355c5b4a851f12279abcc02d
SHA512c178f4ad58b41b5bde3e684f8e4ab6732dd45ae778966ca91f72cc441b03b2db17c0bdf188057f907e85d1d138756dd9f416ab04c7ae2409bf5b7e2548e971d1
-
Filesize
45KB
MD5e9da6ae83871495cec51f77c714cf392
SHA14791a34b467d98daf88ef9f832b4b62f26567474
SHA2567574bc4ae2f95c2512ad8f255ae517387e038a0aaba9c5bdf830152552081513
SHA5129a11f6386376fb7b036ea98f67c0c8e428a214d5661590ba2a369002552b85ceb9d2a698cda37ca2e6c6d56719d125db539aa5248f866a680ba82bc41d4a93f2
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Net.4.8.KB5003304.FD26DB882CEDF8F47D7D\Windows10.0-KB5003304-x64-NDP48.msu
Filesize1.7MB
MD54b87d0ad27c77de3861043c6f5295bfe
SHA1081abadf4c08655bd7fb5ef398c7e1cc6d6a303f
SHA256188325e83c5c9489209f70c05729ea2f0694a57d80ca70bd1484ccd8b00f9e79
SHA512c65df3953b8264dcb0297f265125df33d000ab1d8440d1c882fdfaae3dc9d2918d805f876d6f5414db130e171158f979bfa0be4ed3f3621b43bfa7c40d028744
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Net.8.0.Runtime.A30DE8628304DD2B2FEB\aspnetcore-runtime-x64.zip
Filesize43.2MB
MD501fda0f65ff261a5e4be7fc9a6483a07
SHA1424c4864a08c78c7a553ae4a546e12bbb48d6975
SHA2568777936fa6ac179e79d3f2d8e8226e9d95b64d878770e5bcdb4a841b790e807a
SHA512c79342e7d56b81e747b97e65f2c1323e70df83ab226152b5c451e48de1b27d1c5f057fd4a013053ea1c52cbb08f94db83f594ded06337e9c9cf4250a2b20d3c3
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.Net.8.0.WindowsDesktop.Runtime.9B3D431D6BAB7BCF933B\windowsdesktop-runtime-x64.zip
Filesize33.4MB
MD5b5c367d847bff1533d9c496d247bb7b1
SHA17639e0692ef23d87a144d226596306492e09528d
SHA256e112d593db9714d33559d87ac3cad53b8341a3abe3dfdfc74793542df4022ec3
SHA512c0557f59d20a65502a11fa5372b792c5330db95e9e181db3d24a1bbbecc604b989872192fe8b57234f89cc5ba909065b6fc9f3c6cd8ed5ff07f1211908596da6
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.ServiceHub.Controller.amd64.7EA33B7634E6F071FB08\Microsoft.ServiceHub.Controller.amd64.vsix
Filesize39KB
MD52160c0b4d2b1e4a43ddaa6394983a8aa
SHA107cc6ffd028863e412dca7419b45101bf433b535
SHA2560bfbe519d42de773a0f7082eca4cf0fceddf824d72e77dc29111dcfdce00c901
SHA512b9a1d8f6bbe0d159ba9c439af657e977e5025087d1e469faea44cbe8a2b8aa6be7617f7cb0845b5067f56b0dcb3f009f01bf9bf2a775671e7c0e4a8c469f738a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.ServiceHub.ExtensibilityHost.amd64.40BDE0D3834A69431AEC\Microsoft.ServiceHub.ExtensibilityHost.amd64.vsix
Filesize3.0MB
MD5ef563a35c7e19b4514e1232f66b7c2d1
SHA13830588cd615feedb81ed26aa79830b645f6925a
SHA256b89174a8dcfdb05c3384f895b05d5372d3b90786effebb1f8cdf3817fc52b0a9
SHA51296d7cf5fd0eaf28602d322736882b2961615637b245f4fe542544abb2ce6fedc65f7b71c54bb2ff3d8ec20ecb3d0f4b8f6656205ba751fc89ea66e8318708027
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.ServiceHub.Managed.5AD5B460C07D16E5D967\Microsoft.ServiceHub.Managed.vsix
Filesize1.3MB
MD5ea369017be71c1a056369e1e0abf4efc
SHA19fb8385e15d66bf7675918b9824b6966d5858c37
SHA256437eac9da7425c6a62d935c84c03cfcbe4b390a3889a3ca8c6bcb2e19e2364c1
SHA5120c8fd0ea002ee072e20d88a6fb184f27529a85e1d34dd339df605b112e53780533b50299551feda31ed29cb0972d77c208186a186e43e56ca7ca6fcd5935373d
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.ServiceHub.Node.06D1FC5DCFCEE7E49FC6\Microsoft.ServiceHub.Node.vsix
Filesize7.6MB
MD570299f937a288e130c2a2a3e59413f66
SHA1822e9b202cbeeb90690ddc20d81d9b7f7ddcb1df
SHA256692642666890ba7f7061246beaac4c85c54cc2aa3b960ff792ad8fe05fc31e0f
SHA51257c560757e30bcfaff047eaaf10739c4618d499a8069114eb9ed814054555361ba0dc850df20bc00e30eee15029c16e09689a41629ca2790e338cc1fc7156dfe
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.ServiceHub.amd64.702C735B5AFFF4F55970\Microsoft.ServiceHub.amd64.vsix
Filesize18.1MB
MD5ca60e2264217a07087ced1b89ac40e9a
SHA13c7c4ec7c77f43113d2b4442787edd4d64480fcb
SHA2563960c1bf6b19af3ad018af4a97292319c2dedebf88c2925ae884cb65fddd162b
SHA5126080dfcd9296270e5c8903ebe2ccefc94e65671e609bc0d882ec27d25b2d1c81cdee0ab3c7de1ce3f396fd222f574852e0cd6c96fc8bcf533e81c3d25188b162
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualCpp.Tools.Common.Utils.A68556B73D1A2BF54DD2\Microsoft.VisualCpp.Tools.Common.Utils.vsix
Filesize75KB
MD5f6536536a51dcb33ecc33bd94b622d12
SHA1aa7a49b8ba82e4b60476e698c13f34c105b77841
SHA256bdde470d5d713086644ab6b3466109a5f06ac5263a1d5e003587d297030e4cae
SHA5125f44d468b702049cac5abbddf54d424f81e89b0936ec8559c0c19b093537b42e81117d2b4f993b61a1605ff22c9773383d02484b369c2e6b5c3879c02da11451
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualCpp.Tools.Common.Utils.Resources.7D77678AE41E49F6B273\Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix
Filesize29KB
MD5ebd2d93460ebab7ce3634c58bbca9bd0
SHA112cf595628c93e7540f5fd12153b8fa42bd07da1
SHA256da7fde566fefbea26a548ee8d9a084c1dff1647000a57414072e4c41e1e87df6
SHA512c1c684903d8b170fad9b62c72df207c7f57315f7ab4f24775521e95cebb199125d034394dfa9f2089e8fbd09cdca4115e5ce785d38615cb6c70c30292eb41cc8
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualCpp.Tools.Common.UtilsPrereq.05D0F425757EF1DF6B89\payload.vsix
Filesize3.2MB
MD509f3693947f84f62ac05b2dd425f06a9
SHA106cbf933e617918f09494048e6cdf2b4f58a73d7
SHA2565e81ffd6eefa2a33e4d56df566fc7f8f6083b728501b43c63be88b400d4b9988
SHA51229705cf325bd197e0e63914dca6ea0613a5d8043a3d657422018a47b0c32cab088dc4118111e5c4468b0d12392ce0479b373faffb3d12aab7b71f7cae49cd324
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.AzureSDK.DDAD30A76B327DFBB761\payload.vsix
Filesize1.0MB
MD51e80da18ed1a6c327bfe5d4614a57708
SHA110a962587159f5bf21ca3057095354bc167f3f0a
SHA2565f19530b66e1a43769b1dec0c8448a3f656304c559d9ea8741a5772f8a4ab678
SHA5121bb1531f23f1759e969997605de9089191061562f742660b66ddd9c9051619b3c8b3a24756da3c544f8ae887cfaf201c996030955948a3342241e320cd12e789
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Branding.Community.D336466DA46A5B8E5355\payload.vsix
Filesize3.0MB
MD52e809466a8b4c643c20f42d81175959d
SHA18f4681d52e3016e398f2be55b61f97ceac5f58c6
SHA256275bf3c26a2dc3d4b3ca3aaba5171b6504f16947cdedbcba6ffb29dedaf1a26e
SHA51274e4ca65d818ca284df7bada47da7a012cf36f58fcda4a1b012d7167020723a56f52e665bf0ef050c0f6bf22133709a4fde646f5c558513f9980c214409c118f
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Connected.762A8867B5C6349500B7\payload.vsix
Filesize11.6MB
MD5105c34bd316e076ab748b8f0f1c09e8f
SHA1d04e2d7cfcb0a9e3ae7834f481e14bb6401a6e61
SHA256fee40cfd1e2dc2069b445ad247c5711333f49af0f146daed8a8d5e835e88a3a2
SHA512c94818f536d49bf251e40d39d1010b99e19d7c47174a474a19c652e5256299d02f5b89f9da88f1c100e14a37251330a0612a7fda26f1cb9d557e7b69f0e60596
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Connected.Auto.6C001A108DED4D9F73CA\Microsoft.VisualStudio.Connected.Auto.vsix
Filesize1.1MB
MD5db8b2cbc2cd148eef6fbcd3b4637e546
SHA196da5d4929cd5ea84d927773b612538f49fff9c0
SHA256e12d49625b89f56589b8640341449a78825f6c52faf46bcd002d46e343b3e145
SHA51288011e1d2c5811cf0f5635efe295916a4e51a1bb5c05ccf4c2ba5564affd9b614c2be72a07819322dad68213bd9ca0c3f2bb9a6d2961f4be73ac1aca3c2df5e6
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Connected.Auto.Resources.FF49FFFE60E27C4AA2BE\Microsoft.VisualStudio.Connected.Auto.vsix
Filesize143KB
MD5a5319603ca520433f830d14551c497cd
SHA14d085b78b3ac1dde846e1edaed1bcedd3a7ac3cf
SHA2569096f5509632995838474ece1ccb3f71cd3a2ab6c61f8d6b8910124b34b2c809
SHA51292323f52a2c8f2f9c4139ee32787ac4703ffd4c170da6f697e7d52d44942cee846902a00e3fc95f75eb5ed457c1fab5e0c84c5e5b03fdbfedecf50b553f824c0
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Connected.Resources.E35E44582A60F2118F85\payload.vsix
Filesize19KB
MD5f9df263fcf5b900c13b3978df384ef19
SHA167c39a419f90db3e90c6dc13c15eda37af6f5842
SHA256ae060942efbf3684403fbe4e6b92ae254f74f21ddbf52872c8b283a7088fc510
SHA512e5c8f7723f37a6c77036d36f40d0c799b34f19f811cb8a71d8977c8a3109a7f1bef1945d422f2729777b3789377128af123974eaad7dd857a6eb1dd0b77d52ef
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.CoreDotNet.C4249CCD1904C15E7D05\Microsoft.VisualStudio.CoreDotNet.vsix
Filesize3.3MB
MD5d009a89058d316eb5e7ba9f631102465
SHA16586cbc29650209fd0433aee565abd76ef9ef749
SHA256500587317bec477a8e38eeaf72ec59b96c9f4d7a9c5abeccf92fe3296de733da
SHA5128fea409937c5fdd22e6d3cdc1ab56dcbb9003d5ef4d979bf549003ca0a122d4abfa7f5a43d89270a583afc66aa2491f9c4a0ae416b00a7f1ef2b72f2d77bcdfa
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.CoreEditor.51D211B5DC1854070DB0\payload.vsix
Filesize2.0MB
MD53bfe3010971f58f47a641344b3c9043a
SHA1e2e8bd38a7688f784f5222b2525abf74ed5d92b4
SHA256b42b0b77642ec69db84c648e7b570f62e71a01d1ec761637eda62f10f0afdd17
SHA5120c1f58021f2ca9035a9669775631e21a964442a35386839516dd8da43920f21be1ac05b33351965f29859d00b450234adb7c9dcddc1606ff7ef768e790d06bd9
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Devenv.227F7990D5AE8D96FC24\payload.vsix
Filesize543KB
MD5b54c01ab319e1452524c8575a3285107
SHA11ad108345a66215638c6160b2d2ab484d5895365
SHA256d08b6a9706e65b7c33af48d8c5d603d6867fc4b324ad9bffc7156b8183b7c0de
SHA5121ff17a84a62bde980ca9486fee61160f21c2497508b2ab519c267afe8cec4b7768faace510df4cec41cdd2f5a3a872244bc5fd2ed5663b27f72f13010e371cca
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Devenv.Config.604DC2242D035A98315C\payload.vsix
Filesize9KB
MD552d6a1e55d0deee47f3e641f748f47d0
SHA10da94988bb8dbe524f6d736ce5406fa4b39b57a3
SHA2569bb6a62509e5958e357bd61484a815f610e93abe54a35c9988f3a28322f94174
SHA5123e049a3c18a72b9bffc4de553dd38b5749f66b40ee8cb73d1f3055ce729884adbf1bd5179a428ec754a3ffc89c7eb21ab0e997146a65ce24cf4fd4801508b08e
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Devenv.Resources.C76963B94C62D319D1D6\payload.vsix
Filesize87KB
MD569c593c5f221f467634d5968a29b3fb0
SHA173ae0df89138b1bde9b524ff1a20d598ce6c0030
SHA2567b82c51311ece0792d0f2b292547e777032f1015b182b5855178c907eb4eb846
SHA5127547ee4103a18bfe5d5bc242266102a175d9cc00475a31fcc573185a0e939bf1bc5ed06a45b2267c03b58edfd84feea44b1367b11a0086e2b11096a50cb77cf4
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Extensibility.Container.F0447824BD6950FDB9B8\Microsoft.VisualStudio.Extensibility.Container.vsix
Filesize733KB
MD5ab280d64654d096abb929b79ba28fcf7
SHA186bd2f651bf9f877ee17d0e6342106346a201d8b
SHA256aa075d9f3059823e76433eb45e35c5429865b9b9eb9d70512e0a1782a04de236
SHA51219d00cd3f104d1a7b561f1725697f6e7c4d5fc40737b4eaca4809996eb33aa5f90bad03956629d3bd5064da65fd3e11df9990bc0ed71afa8627f06aae07fc981
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ExtensionManager.786C91B69795843DCE01\Microsoft.VisualStudio.ExtensionManager.vsix
Filesize3.4MB
MD5467a3832b4f07cbd0b1773b8f110b84d
SHA159396e683b86b7227896f17cef15c9db88e7ccad
SHA2560f6adf49a16f5ac8270e5cd712ac46b56cd1d90d5e8364954459f1e56c0c4a75
SHA512e10c9e137b198eb3e36ca02dd8c61d6dff04f3e6e6ff058575ee0da9fc0a4a16dd0ad0cc5757b61d9684a38c9205d82f47170c6f0f1003448334b208c75bcc9b
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ExtensionManager.Auto.45DABC17C597AB211888\Microsoft.VisualStudio.ExtensionManager.Auto.vsix
Filesize1.1MB
MD5c23bfa3ca57f714437c5a452dfd8b243
SHA190c0c71eaaadfc52d8f3cdc1578fc07cd28d6285
SHA25663cc45113dddad2d9c029f0cacaab458d893c8d023ab8e5ea2ec32a089808a6b
SHA5129f853e3b5ea5611171914b2f7396535a9c58e40b7b2981502506a007c8370e08e8cf6b2fc4245b60b6d46c338fb850e995448c702d517704fc19080830b6aa9d
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ExtensionManager.x64.E6B62872C54E0146F918\Microsoft.VisualStudio.ExtensionManager.x64.vsix
Filesize2.0MB
MD5ca2c379c06557d9e3a0a2c78e6d55f0c
SHA18588bdbf50a8c1097bb504f48863088a0926cb72
SHA256dcff695f6300fad2b4dfc18ec82549e8a1af3bab1f1bbd2cb0d8b870636b3028
SHA5128cac45c90efd8da2e939ad93998bdfd7ffcafd988b703956c3055c88d8e90f68da9da843841f076596ec3b860d4cd08862e7b8a116980baf35e3296e55847e82
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.FileHandler.Msi.706888729D2B09A429DA\cab1.cab
Filesize1.2MB
MD5169768acc62dcaeed7cb6d46ec9a0e01
SHA16ace737305569c28260b076f04b064216ab44f68
SHA256381fd53d0b8c6d9009fe4cc8b3100d238d17eba19d9ef4f510474f1c6f846c10
SHA51247a77ab94996dfccd548560ffbf7f68e718817e5192f939f10baf2bb7595b628796f54e054a7a3e3ab090667c57e6f4c7439f39baa4be50c8e4854fa6938fa9a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.FileHandler.Msi.DB077E4D458F0EFD5CC4\cab1.cab
Filesize2.3MB
MD5937a4d6472cccf08c36e9c21d3e95faf
SHA13c6b2b69c235f5c46e8858daea70fd0238ee62cf
SHA256ee96b56403cfb70c62cac04836aa0812e1b90356a3489b615ee0faff33f17c8e
SHA51291d7edfb21f75b75e7e60affd3e6aeb82aae3dd4fcc1f629e51f5e8b8019ba571bcc8048d85f529ea997b0e8fd09ca0f26b2f826c014bb9b60c9494a9e553169
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Finalizer.38E7A758772B956A69AD\Microsoft.VisualStudio.Finalizer.vsix
Filesize764KB
MD5fdeb2ea9aaa64a39f3f91fce27b7e608
SHA18d9b1b4ed0d73c15ef7608b4a74f0e3994c7edc1
SHA256a6bf40614edee75069a23da8a2145e6b85463f21a3d4bb76ad2a4c047e5da7c7
SHA5120d09454ed642bacd631c6418a0f6b97ef014ca0fd3d61151f86e76ed993cf2020a94e3866388d8c02376482b4d3e811217faaa06cd2f4014b7ab7f45f5c2bd5c
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.GitHubProtocolHandler.Msi.C5FAA8935F46F72E87D6\cab1.cab
Filesize23KB
MD5ff6c4ec978ccc8241dddbfbc722d5164
SHA14f2fa1a331be4ecd6e8d19671e3cda04121960a3
SHA2565f34a239a4eeb18101dc0ca970d4ce2c726257aaad094825a9c4a9ae6bbb39b5
SHA512e856f1795c2bd5331871434cbe5e71eb1f1bd12840fe66e8041ab3668dd27a66db09f2328c62eb8253f1a9f7d6d3a8bcfe78a35b083b0f073186f9a2ead80b1a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.GraphModel.A8A180A63F0B80A4D503\payload.vsix
Filesize272KB
MD5dd4a8374068eb7b4a8bfe26b3ea1b7b8
SHA1d59af81c12085e8243aa59e880c6d08f22df408e
SHA2567cdde1255433c87a68591271f3837ce2679859c09b26e16cf6b9612b5dcb188d
SHA5124cd94fce1c754c3fea31b2ca20b220a89b2fbb84e459faea67e01c0a3894d5aebb6989f6cafc569c5b9f2a3daa7cebf00969973ea2ff62307bdf6c0dc1ea9aac
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.GraphProvider.C8DBBE2926CE81EFB0FD\payload.vsix
Filesize915KB
MD589ec56d3d11a3926827b9845ebf9c2a4
SHA144161708dee307812bbc87b5a5540d7396381012
SHA2561857f711da42c8f5d7fe9081b3f4cd84584fd17560a344f0ee7eb005da1e565b
SHA512c058554e768371694d26cbe34aa81e82da21e5c143e1c672993eb865f3fddd1b25c7eac0eef6176c3afd8324dee8f41c52a893a5139db1ec51ac27d21d6bf1a9
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Identity.EF5ED96739631143ECF5\Microsoft.VisualStudio.Identity.vsix
Filesize9.6MB
MD5e4dfa84d39fb172581ffa0345a8b8628
SHA199b76f8c595f16ea58b735eee06bd94c6af91f52
SHA256ec3efe0d018ca869c25723d1c6c9d1250bb40a5c2bbb1ccde8aa847c7ccfc8ac
SHA5122f97f35b6661776c04440f608fdda5577856defc202db4783d4afe358a12a1bea258335507a6c15aecea92b9ce25e01779657a23e1c0418f486ca268a5a55f3d
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.IdentityDependencies.A8254722EE075060DB01\payload.vsix
Filesize3.6MB
MD5f266b9b7dbfd1f055ad0a240293b53d8
SHA11ee8bf5fe994d5181ad1960bb9445b65d8f9dedd
SHA256a26d9bd13c951e2e4247b77a045a0fd4366047cf496e8947a717139101c57404
SHA5128079c065a6771906bdb6c51c3b5d7418f262d596142de7e5b14f776796493b74961ecd11e824811a65f40e398b1022a6f6f1f307f8e991404dc1b580c7df5528
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Initializer.D28041DB2C41DD138762\VSInitializer.exe
Filesize82KB
MD54225c7698b3b7a4d489fdbb871e2e4a9
SHA1cf5f6173f646ee56c95d4c736223d024cb8aaa47
SHA256f8048e9f416c5af50e46d20b1ca9d7543afdd1cb29b7afde6c30a7c90ca81619
SHA5129a9eef6496ed0903368cfdfc8b7433ccc8883faf01cd49c2597c8b6036128c320d59e7536cd487fd95045b6d5d325e066f6276263fdbcd3fecfc5feac2afa565
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.LanguageServer.5137309B5A5CB8729825\Microsoft.VisualStudio.LanguageServer.vsix
Filesize662KB
MD561e89bf73ea305a9cbc6c1fc9464e9ac
SHA178b7bd4ee322522a1b02d3407f8b6480efd30b66
SHA256b89fc48ef56eb8e049701a8ff8d03f714562773a133bd8f74dd807ba8c7bf86a
SHA5129f6986ee44c7308a7288198060b7b9085c9829ae433883746190ebab19c73d4d8d444e6fd61efeabd2b4f97194ae2660423078f0d61d5a85846f961134233730
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Licensing.413C57B543B1AD6A9758\payload.vsix
Filesize748KB
MD5d2c096cae661c10eabe546c93d53b1ef
SHA17732357fa4c64bbd6b090ccd9c9e4e5c3c77e226
SHA2560a4ed984fbb633736a15350ae25992e0783ef9ee86910aa803fc37be86967d84
SHA512e00ee7856a52e9638d1cd4abc97a0236e92c7290ab592030c356d3a4363dde0dd0f9e4e5898f27ae381b8dfef089f52ba7466e9cf3c938183dc4607ecbcc773a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.LiveShare.VSCore.ADBBC91FE37F52804E16\Microsoft.VisualStudio.LiveShare.VSCore.vsix
Filesize859KB
MD50c9bc4057d4838f0b8059ff16cdac5cb
SHA175dfb000f6db678fbfe08f690d30833767e35db3
SHA256899f0f869b33acde2981af0a49649c488fab74650b9209f8f7284dd153d12210
SHA5121d4a30cef3708d9007f67079e5192b1607e5a204e6f91e2f9a990328ab5794675f4c7f658685ba5d1a5e5cc54c55fcdf481e7e258ba24cf9ba2af447f4ec4b20
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Log.C056866E7A08E4A336D6\payload.vsix
Filesize2.2MB
MD58fdf7f11071740ba91422535dbfa7002
SHA1f6d554842148e3a898f695b2ef98ee9164657de1
SHA256edd1e49e09698ee1f89c45a044da75834289dc96661918a6a0abfbd0a9e7abcb
SHA512070dcd6260cab215f64c5b6ceabb93bdcf954c0e59c44e4d8569cbd15d3826e8147dcc3601f1eb89a6eadeae171d451d8bbf1cf68fa8dd4080875f49ad251086
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Log.Resources.93234FE64F2FF5BA5C08\payload.vsix
Filesize33KB
MD596a9b69b0845137b99aaccbe17ebe8e1
SHA1e1bcaa76be38ece95b0701171b9fdf47f566e19d
SHA2562880f688806719f2be83b8e5c2d4f1071a7b946f1bb96c44f1cea85a111e05f4
SHA51225891c813162234417a7d1960c81d694b6113722570fe033bf83507740fc441393105a8f63b4bdb320da7560fcccdc916fd3c81a6d08f6efab40c24f07f3552b
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Log.Targeted.9E78910036068B4881DF\payload.vsix
Filesize45KB
MD5c3760633e579e091849796ff219c618f
SHA1c4a14b8871321151aafe2b456187eaa835ab5d4e
SHA2568927ad8d20544e2f730dffffb4fef3db4d4fbdd13481406728440a0d5a5278a9
SHA51264ad5070888d84d22118032cd355059e8fa5ece60f0146459bd896edc27dd85ce22e15f6e9655a14c051d42eb4d5969eaab279cf0070d77109e89e1cd5fa18eb
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MefHosting.B024C36443C43133EC09\Microsoft.VisualStudio.MefHosting.vsix
Filesize179KB
MD54e9ba556a8bfb38bff083fd64620122f
SHA1ad8a7b43a89ee373af2d4f7a98978a743b0a08d2
SHA25668a97676d33bc7cd0349538a1e4a82e621a7c554a28dcf04801fe7730fb9c7b4
SHA512baf19e74a18f6e5f399f7c9d25ffe9d067f390a4b2e45f2ca5148d8f5df53356174c615b5c7822470fad03ab39d882f96d5ce26e1bd916c61c6af5b9bcceb361
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.712EB8CEC0AF97E075AD\payload.vsix
Filesize9.1MB
MD5769720d9b8a6afcd033145685383ac8d
SHA149641aade74a88d7d356fc6204a0d3cc3aa62802
SHA25624d7fd8d6c779df0e771024e34ae4fc1041f20e453d9919e1fd22f7e11d3998c
SHA512098be00ee00565213a150060bd56adaea2ce8233747bb8502040dd31693bcabf6811e9d04ff37f4ef9e0c879c68004ede0378811d6e2cd266277be416f848c4a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Auto.2FF41527F2C796E43CD7\Microsoft.VisualStudio.MinShell.Auto.vsix
Filesize5.0MB
MD52fca27af99b9829feb0fde518fe271ac
SHA18b7481538a547f4ebc7e1d557cf494888c54fe9e
SHA2566e1a566ff2f34921c433639d9ec5dad5221a32602af0fcdc5d7ef44d661334ab
SHA5126277c8da189d99066629833dee0814f66dabd7dce616a76e2ff8880c111ee75d9d18757de2ab2b5d7a2b7cd7faa985c35020018c42ec88365cd2b96241261a66
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Auto.Resources.A9E663A89D741F9F62F2\Microsoft.VisualStudio.MinShell.Auto.vsix
Filesize241KB
MD5121d07edfcd923930d876f69d709c6e8
SHA1bb858686eef0ecff098dede2c2b29481fe87c4f6
SHA256be701221fa292652fdd2aed9f4841207dac8c0268a32958a2716ff5af35ad6b9
SHA512514d9087a189148883778cbd94098f32a03e46198141cf3d3a5fef7e0afecd0907dc4ecd250fd884b6daf64c7ac2fe59625ab3ac3e7dc08daefe931e3308082a
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Interop.9596154DCF406BFD876B\payload.vsix
Filesize1.4MB
MD58d32b33d7532472e949d0c7f14677e4d
SHA1280b0a55c598bc3eccc8126fffdb7bae83fd3581
SHA256719cc4b340f3ee0b628a5677aace37d2f81914819b1d08c3c48c3052837ea0cd
SHA512c553cc787e994909499bf5f92ff7b1e972cb983dae0170904b0165975acd88edbd7e240a6ff8a7b71c61714a1d372f70a6b63e90bd9db87c300f6a17e4ccae66
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Msi.Resources.67E206DD247E34686674\cab1.cab
Filesize46KB
MD54b218568790b771ff5622e5fe533d9b3
SHA1db0b6f626ee1683b048dda8237dad09dbfb212ff
SHA2562180eff2ecfbed70f5292ce05747f7f48f2ff6e31aa639c093f7a168010e2d05
SHA51212b37992f45a47b9dcf56d6c9527c8a0c54dfc56418d4ec4da766a3deb9a50625ae11e18ad112d01bbaa4e613f73b7a6af9fe0825124c06012690c2be65c2c90
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Resources.x64.C075DA57C1BCC7839615\payload.vsix
Filesize1.1MB
MD525d7dca3cbb68ec1c1500e6dbf6b8901
SHA1ead4df82fe1cd97fed09e47b8eb32d90478d33e5
SHA256a38304e339586986049689bdc748b9dc99176a3bf318e385c44ac4c2e5e4025b
SHA5122ffd09e3bc578cccf64830b765e2985d42818cce964e3b7dbec6c4d2dec2c27d04d3ba41dcf1762157d2be4d1e92f3b815fe0b5a332464dc65cd9ec2a7a7297f
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Shared.Msi.505AF3402AA676E37183\cab1.cab
Filesize120KB
MD5e9c452c8a2002f33788930cb13be26d5
SHA198ab25ca836a9ae521af75c6086114631139713e
SHA256d247ee8a57fe5c746e44f8b40453916b8a0722179f092c4f5fc61696aca0868c
SHA512ba19cb0ff4fa006d17c20eaae4925901deb1ebb82dd66a8b42ac9d857500600aec2cd577b9bed0310b0130226636025677ce5bc128996e2d3026c746e492894c
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.MinShell.Targeted.DC73E77E9ED5A15ECF86\Microsoft.VisualStudio.MinShell.x64.vsix
Filesize15.8MB
MD51bd31e1e53e4babacbf346a6f4782e94
SHA18bc82bbd06a036532f1b2a908dd06b0433cb2674
SHA256714b568954200dc1e461e1e6a292ca0aca26d2b253181683af821248be4cdd4f
SHA512fed35a7a867ef1187c370e116b7303e2bc05f9145b50bc1753f32ee150a9290441590e3b43703c90d0b0b78d0ce6f915665aaef47a5497ee855e4066b46fb1aa
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.NativeImageSupport.08834BEE5F5CB1A4D591\payload.vsix
Filesize31KB
MD525bd75006cbf095eaa6cf5a4d88b9027
SHA14c2ecc02e95d45729bc05ae226e7d4a237ff8a11
SHA256159ac78a49b6bbba041f20691a1294ab837801690e7aee4a99cb683239d450ae
SHA512c119ce97b56e9c316ac320105f8cffdaed5f386ea6bd1e02495691e1a72c2b3ffd2e790ddc7056806c9e31e219940bc727227a845d6c99422c9b2c96348e61c2
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.NuGet.Core.8FBF0A5DB6D217521B68\NuGet.Tools.vsix
Filesize6.3MB
MD5dca316cb415ea92b0295df6b55d8c659
SHA19da5f255c8dac10f35383ab5ce314a7e87270de2
SHA25690b63308e7c1a6f1ca24a5a257c0474ed30b00e35e8547c831cb259f767337e7
SHA512174ea16bab9eadf33ffbfc589277b0b4bf319b51deea8bac587af640863560d36a4a1543c56c264efb15354c613b87dbfacba2853bc8e03361ce87290e6724f8
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.OpenFolder.VSIX.70731B735431125C98EB\Microsoft.VisualStudio.OpenFolder.vsix
Filesize4.3MB
MD56baae34ec14f949b2d82c1482cec8199
SHA1eb549753b6c1767fa697dbf661f504b04f429a94
SHA2560937671f6c76a48a6f35fe1ab7ac60075d4422ca5611a50cf09e3d4a3c6d5772
SHA512d10139db2d674ca0fa2ea87ca95bcdf220f7dbbbc106b113e9c058505388fd4466b66deb4ba4175593f5105a18127ed3ea99c6c0c3275da1d039d6ddf3aa8525
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.PerfLib.EC1A5841DD9B11A1DAA1\payload.vsix
Filesize2.8MB
MD506083c21237b203622c5ee68540d0e9d
SHA1b2c899c95ffad35fb57be184a580819eb1db8a06
SHA256d9c052a177c84aa28ec066a622873b9ad846c2d742dddc1d9676cf345e77898c
SHA51255be2a32d6ae977846c661c03aa065f567e4eb5ab17e4afb57fc862ecbb64a36fb268b9e0acb399beeef9027fc55ab481dfe4a14b6b94f3df33bb828c781a0f2
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.PerformanceProvider.C9FFFBAD99FCE909A149\payload.vsix
Filesize47KB
MD591f3341d184e9da3eb559021e7b9ec3f
SHA1ef387e8787511eabad7f06098c4cc6de2a4de857
SHA256441117d913411a845a97dade269327b2d409c95fc42aebd9ea19633268100551
SHA51273388d0448497fc496882eb0aff7da0f2b1eda3348f5600f68e4019e2f4c5645b03fe7371b8ca0aff763e0b9f7264fa0f1c1ce07cecfe79aa52a52c307d57364
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Platform.Editor.537E3F4BEA46165A75B0\Microsoft.VisualStudio.Platform.Editor.vsix
Filesize6.6MB
MD5eafb18db6a655ac9a4cf8219002704e3
SHA17f6e3da3f52ca468e5c04f29d7f1236f77448b2f
SHA256578195a8ff4d0ee5a67a574014a0ba4c9dceecceb9a959c8c22903d6bfa23beb
SHA5126779ff7f49fcf46331e1fe244efe746742f6af03c21b46efb50c2778e5a36d3fff8a28ecd10e2d898484de9c8c23fb6ea50030c3ce88b6200ea13c76e23214e4
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Platform.Markdown.ECEC45A3667C2FB06A87\Microsoft.VisualStudio.Platform.Markdown.vsix
Filesize739KB
MD55918bc76f5b7619c92ca7df250f67f42
SHA14b5be0cc7b3e96f3975c0eb2c6d3fd87ed3416fe
SHA256182384b3192077a3235d4f59da2adff8c892d61519ea9b0e8688d26c21772c1a
SHA51257f57f0bc117b7bdd249b207efd7f78a5b08ba1ea9fa2fde0c29598bdc17769864e49acf8aa60289232179615ac4b91e01ac08c6e693fb8af3340571d65fa685
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Platform.NavigateTo.BA55F0409DFF0A234A9C\Microsoft.VisualStudio.Platform.NavigateTo.vsix
Filesize397KB
MD5f1bae1b16279e84b0a777394486b18dc
SHA12543308fb70b0ac1312b0cbfe53a677ac0d4338e
SHA256d3773587faad4126c755c589ee0e5f06c30855e051cdf988c37a3dcba3d4deab
SHA51281ff879204a7e449240f8b93b2d78be8ddb148802bce69c019879cc42debbf2c66027374d013bcf2da4fa24efaed7976bc49120059ff65b2e31f7c162d9973ae
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Platform.Terminal.DDF8593DCE68CD141E32\Microsoft.VisualStudio.Platform.Terminal.x64.vsix
Filesize6.9MB
MD53c860be34520437e9f874b8161416dac
SHA12102c568c94836aa5a10e68fe7b923de37fda236
SHA2561c9690af8150b516a2eb52f2b6c8fc0d8202e5422fbf4e433d1e8896f680a8f3
SHA51289e4a5490e43805e75cb1914ca1c3ad235c200371e5d18f49fed8d1c3e9a93f8da060d640015e894a1c8c933f142b7fd095bb381b5c314adad81758b614f4ca3
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ProjectServices.BF64CA389F669FF5F7E2\Microsoft.VisualStudio.ProjectServices.vsix
Filesize420KB
MD5c2de59fc3460da7caaa07221d94dc1eb
SHA1dde1a0fe9dfc0664782bb11f596aafc36b49981a
SHA2569d81346d8877f3f0706443164737e4d8eb780e6498cfdfa00fffdacc8c8f68ea
SHA5124bc05009316347a1d8f0739ebf21fa4321036fe48ecd331b1e96e7a2e102cc6c6ecd4e17d62327225a733b3c8b6f884ee0cbf4bd93ab3ec15fde10626d37423f
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ScriptedHost.1927B549147C50B9FABF\Microsoft.VisualStudio.ScriptedHost.vsix
Filesize1.8MB
MD584c4f4a0f7e1746886076a51be7cc445
SHA1f49b3aacf2ba1ed7b990dd34a0eac2332f650494
SHA2564f506372894db1589eefdffe28124168921ac377e9f346dea217a2ca932b6049
SHA5123b6a1739b26ed63e76ea3ec17b293caa0dbe80632d7b08ac9cbfac978f106635a42dd042a07185f286d738c3f57f4995349c4231353b66df49f77a8cde468db4
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.ScriptedHost.Targeted.040EBC79FAD0DD3AEF68\Microsoft.VisualStudio.ScriptedHost.x64.vsix
Filesize225KB
MD5b10274364fd5894496a9c7fad8fcdee0
SHA14132d77073791c9f5d5d56753fd095991f964f8a
SHA256f63a6149d1a4e0331f0cdbdba90d4debbea3399de59cdf1d8f3cacaad014fb0f
SHA51252475a7e27c8095a4954711975e34ec2aaf8e930ad75e438c7995d2fe5a0abeed9a87002a111b2d400aed04b3a8ab179fb111010c695ee0677c68646b6ae8341
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.Setup.Configuration.Interop.9799449B91AA3DE97938\payload.vsix
Filesize20KB
MD52c7ef91bfa9a306cfbdd3b54889da189
SHA1e7c31d0711990da77f76db5802b149251f49b33e
SHA25603d06939c0fbd7ae6bde9e8d4a640b8fcf6c99c1fad5d6348c6b7e372689ecd2
SHA51281b58fbdf8736df950b26fd6b088b9142db8a42f69268473d24b93f1858b5799b522268ca2ddbcf7954ad87e1cd25562b344b75bcd13a2fefa6bd116af3fb541
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.TextMateGrammars.D7D84904322B011CEEE8\Microsoft.VisualStudio.TextMateGrammars.vsix
Filesize2.1MB
MD5eb25716f49217e3727c004f2f4a0ea57
SHA17cabde1866509193a852ef665a4dbd888f8b1d6d
SHA256e9ef5d7c80a836e28826eea83112e44799d209578033ee55f0d6c2664285d846
SHA51285bcc13854fd4cdcfb5eb3d180ad65a005fe0b375431c44954e960ef4d061090a82b69396da67417f46ef056a0a642500a5cbb2b1befe9cdebf14e682893c621
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.UIInternal.D5AC8CE69AA8016CF773\Microsoft.VisualStudio.UIInternal.vsix
Filesize28.6MB
MD5d079dd778b8fc26af572f030fbb02548
SHA142ce653b876f73de8e36ab6e287a2a6eedcff250
SHA256f084a52e30f1412d11a8c0dcf43188a2bb166df05874ba811e8d14a0f5a9c376
SHA512a4743a7cdebc47c369d0bb17e2bdb59070db0c654dccbb250ffdc34961c8fae96186cd45ba963fe6c3cfc979868e8a43a05cf8f62e678b61f3311622533c3e2e
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.UIInternal.Guide.7487B0B41025E6D4BA46\Microsoft.VisualStudio.UIInternal.Guide.vsix
Filesize8.5MB
MD52e2a7cabac226857668c2b8b0860ab15
SHA19b1249b6d9243a40d30daa44a1859ad2041d8f38
SHA25626e233cb1fc75f2bf1edc021ec6a62a7d02877de6b20b8cddead635ef1e64171
SHA51290add2c339681dbdaff3da465f61e6bb2f698aeee661055b9b966a49efbcea1a813667bf05a240356f14941125c059b3ecc0d5377b3c19425f3970622fba0223
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.UIInternal.Resources.51AB7201AB5C897A9F22\Microsoft.VisualStudio.UIInternal.vsix
Filesize1.7MB
MD53d726cb70f86f65bfc31916365708da8
SHA126e539230cd4476575b98abfe0e535af18d43f15
SHA256737934cfe3ffca6f5deb9add0c23d561366b3a36597568199d02892268f63d40
SHA5121703508470a0d3241543dc9d02f1ae8de407859b2af96b3901396590ede42094df1c710df23621a5739f3fdec70a2dbdf39af2ee129ad31beb94239eb23da2dd
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VC.DevCmd.581A22C82C9FCBD20CB9\payload.vsix
Filesize733KB
MD5ecb89268aec849ccddcc28ba16f7b585
SHA13dde7d48a3902e425e8306b580e3b1b9dae65eae
SHA25654143c02b7ad95a3a4e35bddeabb921578c57b9792672918fbf46abab8f3c9b3
SHA512a4deb4d7ed186ebadde47304cea75cf9a7a2b4f25814492f4164f36ba873675c89e2d263479293ac8f4d7b71501584b6f71aa56658a2b145ef2580bcb3032a33
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VC.DevCmd.Resources.F6BE59975C685ECD28C6\payload.vsix
Filesize19KB
MD5af334240814739b4ad78ceca2d0cd17e
SHA1d31bc6611287727cf65af37a1ed07083b50e495c
SHA25606977c8734f66d9c1dd6bead91c7ba7294ab9ec28ee4b548e502391a4c789591
SHA512300a103a733f2c9ba58af8f7b159c215883b598f531dce700e71b0dccd52360d6f452adae4a05ad15e784e3166989b889b38d3c8e4ed0163729c304a715342b3
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VirtualTree.83C148BC5D113D00138F\payload.vsix
Filesize146KB
MD51a027683f5d17bf8e5d73b7f72652145
SHA1cd9fa98445e8dd3615093be968024e36f5a360eb
SHA256c450c20f5d2d67761f3abeb3c58268cc9f5c2af8b19ab75319a7b78fa979dfa8
SHA512155462e7ace1f57f63e8ab68a5f70d7681a9fa99992a9887396e427caf438161a48adbf46023d94f51e3573f26b66e88a6bdc9e6b050a327f37c51d04ffe1b3c
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VsDevCmd.Core.WinSdk.880ED5C40A987E46E713\payload.vsix
Filesize13KB
MD580399f5131d0cb4d9f494b8ac6e9e1b3
SHA1fbe99c09ba8f88966fd5a8d16bbe6b93decd7794
SHA2565c63d8b9dd5d59ac8369f054a2a6cdd907f8d19c65ae2aa8ef1a791c29013efa
SHA5129c3b5bc3d73072ce0e3bbfdb3f09567a4df881006da54c3069d0047cdb8fb66f28099eab71f5ba815545d18cbe8386ca4cf5f93cba07c5410ae54a457bb37dd0
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VsDevCmd.Ext.NetFxSdk.021BD68DAFB6DEABDBFB\payload.vsix
Filesize10KB
MD58b28fe557344be3c1d750877bcf08c0d
SHA16b8206b51d1e994f4d1aa32a2a2db9522efb429d
SHA256fea624f20ab29e143ce59ca3767f1bc1a1757044afb63e93cedeade34630dbe9
SHA512148ce7bca2be850f97f7d1abc9cff4e14c2ebf387be39e48f9eba48cbd5c3d000f03bc3444747ceba677b28f1ca67c18c933cc3e69b2853abc6824a08c5cfd68
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\Microsoft.VisualStudio.VsWebProtocolSelector.Msi.29638BF0100773D5DDBE\cab1.cab
Filesize384KB
MD50144b765538b57b2e54e7e9bc71ba867
SHA1ec102d2a7e07cc546a0f1d46ac64e7ed12951714
SHA25608b2ae9867b069dc9d9e502c8b14c479702cdabbc7088baf195fdb87d38608b9
SHA5123e2761b44b5103033d1ae315a0b0835d7b59fdb37cef45da27f978544f44ff4772fe5c3fab82f32f80b7ae35cc87f75d942cfae9043c8cb9af49ca802b44d6d6
-
Filesize
126KB
MD5ea90d422907ed2c5d09ae377aa5abb7c
SHA13a9e9271482f4da94ecab51f1390e34d3fd4321a
SHA2562617fdb709f65fa5cbd83e4fa43d8d99d8155be02c5619fa774bb79a146317bc
SHA5121b44e7e6f0fbf44ecef5e57ed7556f3ed99b26ef3dc29ccf278bc674e06aee22d28f15a8c3d2ec0720c9bc0a3601a583f86990b41251af844a896bb26ea56062
-
C:\Users\Admin\AppData\Local\Temp\dkfxs3sa\SQLitePCLRaw.Targeted.E4FF9B9F064832143308\SQLitePCLRaw.x64.vsix
Filesize878KB
MD528f0c14c11c646d09e2c1c0c91703de3
SHA1a6a74ea6356f3a3f802015cedf2156852f5d0ea1
SHA256e7be12c375ed9139a372c83a5b97283e6aa959196914e58d24d8ac2498fa9135
SHA5129eba11ec048fd2024a68a50e5c0bb2c2c5ceb67e94e81c33e3bfa93a529c11114249b71cac2aaef0ab01719019f84aadd1816a2aff2e03adc10e75467c25f7ee
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Interop.dll
Filesize18KB
MD5c5e7c4a539ea834661fe20f994330f7e
SHA1e2ff1096f557212dde051887bfd4a450b23e9277
SHA256bc53c6fb22f4bce970c87122579caf785f75cbc91d49f49e54229ba32ac7d447
SHA5127f3f32146637e7393f3f906ece45780c1082ac661fc8f6d88f469e0ca951e9a6bcbac4be8959359559e097ebeec8eb048407cb3276f0a7007c50298ee1294a07
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.C2RSignatureReader.Native.dll
Filesize115KB
MD5aabfd8a438ae79b4f236ec3b45544dd2
SHA132b026ab6dd4ce60c16fa48690f32632f7f4ac17
SHA25695cb344b58ed754e25f60c44f32303de9e65da603db06a9321d137580b3657ca
SHA5126eb438b1fa9bc62c1356d8f21b0706799d94024cf0c013fb435caaba82e0c6bbe3570edc91c71d36e906be0a28e1da854a47a377fa487aefcd5662eea85a1993
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.IdentityModel.Abstractions.dll
Filesize18KB
MD5dc6d5f059a711616234b383d8a3cd5f2
SHA1b53df8e875bedf924a32eebea2abb2018f06e5e1
SHA256d461864929e446edbc6513421f4db8c6465899d9067ea3c33e2131227799b525
SHA51254cafa9ce950c0b4a2cfe6f115717cf113b45f6ef21c701207e37151fb8b01e0d370c56d950ab2c0bdd0d813d65462ed19eab4c9de320f8434cfb0b30589deca
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.RemoteControl.dll
Filesize46KB
MD5355c1a112bc0f859b374a4b1c811c1e7
SHA1b9a58bb26f334d517ab777b6226fef86a67eb4dd
SHA256cc52e19735d6152702672feb5911c8ba77f60fdc73df5ed0d601b37415f3a7ed
SHA512f1e858f97dabeb8e9648d1eb753d6fcd9e2bab378259c02b3e031652e87c29fbabfc48d209983f7074dfc256afd42fa1d8184805534037771a71db517fe16c8b
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Common.dll
Filesize579KB
MD508645c50cb281af1371e8f0ded10ab67
SHA1ae06060913c4be03af0e1736650d64e8cda7ad55
SHA2567bfa4386a603b98af49099d67f5c5d1e7a50b15107f9780e7f7f50f39234bed9
SHA512bfb8a02db556bd1e7808fcaed00bcb938758eefd21f04bd47c6c5a04293b781189ec88a31210efd6972be364334fd5e25ba6a83c972c5ec4cf0b8726cb4a77f5
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.Download.dll
Filesize306KB
MD58a9cbbe63d730d60ef5159bed516bc78
SHA1130c25908dd4201db8e6a2f2319eafc86114b7c3
SHA2564e94690f548ef43a279a1f55807713eb970fa7a0fc9e64602779595778766064
SHA512102ed30752a61712b024c5460e895e161ba22f4583f1148f6c0704edaebf703eeb7b65bd393ffd056df837d5b57220b7b87bc635884b5aa1d6516afb36370c46
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.Setup.dll
Filesize1.4MB
MD5da8106a5723b5d66cd6b1713ece8b91b
SHA173bfd5942bdacc4c87b003c6c5555fea4ba6251f
SHA2567c481dc4e4c2ed5df782a794f571808aec82a71c4fdb1054939a42c4b9f368aa
SHA512eec20eb53e88e6a96ecaa8496256235176ce586563d8c29d1c3537b5e34213209bd225235ae253b60a7266aaac56e655af229ba6b89b87ad24f4ce4349f0cbb2
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.Telemetry.dll
Filesize995KB
MD5bbcc8244db84ad2031ac010633abf798
SHA1de0cb65ee877663da272b4162a55a64ab8669f74
SHA2568fe17ff9da7932dc01a39ed27559d5cdfa9b97ba14cbaa9f719087a241c8b82d
SHA512d5682ea1aa9d50e9a491f8dc25c82907cde24ead2842ea392242e8cdedf49f68f3035042442738e147b5aa29d6328ced68007732298f62466c78fd10b276b06f
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\Microsoft.VisualStudio.Utilities.Internal.dll
Filesize62KB
MD52dc1dc66b267a3470add7fab88b78069
SHA1dbe80047475b503791038ed7e47389c062c15c72
SHA256b044863f98af8d28f4f2f5e2dccb945c57439e1575afb37110e1eec306a6c89c
SHA51244ef73aab50dcc13ccd94c0353c366818afb27ce73772d722755b04add0c4f294c7814c84da6069d9aa6136f2a48683c25062dcddd1664e8d32fed1b38ceca21
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
138KB
MD5f09441a1ee47fb3e6571a3a448e05baf
SHA13c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA256bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
SHA5120199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\System.Runtime.CompilerServices.Unsafe.dll
Filesize17KB
MD5c610e828b54001574d86dd2ed730e392
SHA1180a7baafbc820a838bbaca434032d9d33cceebe
SHA25637768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
SHA512441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\VSInstallerElevationService.Contracts.dll
Filesize23KB
MD5b71306b232b606b7b5e625f6da67beb7
SHA1cd997770324d58abb9fec0dfe1806482509415dd
SHA256142a0541edf1a59c0fa2bf34b6b2db495e29c4f31fd03b2633a9b753a71d39f3
SHA5122de8b42c6eb05cfb0040724a8cd5e055a8a6b388d32a0c495c1b72accbbc72624541b73987c2de0324ac3248bf656b0baf593d1534a7801b400a332fd2e5a483
-
Filesize
8KB
MD5782f4beae90d11351db508f38271eb26
SHA1f1e92aea9e2cd005c2fb6d4face0258d4f1d8b6c
SHA256c828a2e5b4045ce36ecf5b49d33d6404c9d6f865df9b3c9623787c2332df07d9
SHA5120a02beeca5c4e64044692b665507378e6f8b38e519a17c3ceccca1e87f85e1e2e7b3598e598fc84c962d3a5c723b28b52ee0351faaec82a846f0313f3c21e0e4
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll
Filesize2.2MB
MD5a2f41908d5dc93b30daa584ea84d2092
SHA1858e185e27c19177d3bd8682cea53bcdc27a598e
SHA25688a6f127eee41da978181df5de12d65d2337d4427ef66b6be1df51bc29e93f8b
SHA512ee5934249b2540b2eb8f9ea3f344f00d6e512a8f2f86df4ea674dd9e35a91154cd77c62053882e187cf1a629c369ad3be9667f59607676bdc780280de5dfbeed
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll
Filesize2.2MB
MD56d226a7b33583555fe71310e610e7fc6
SHA192bb8ce4cb4e215348c6e22ffc3bf57ec031883a
SHA256613be496ad434ceef6ed29dbba64f27a2612795078977a8b07b229ebba9e9953
SHA5125697f07f95c723de50f65b23d5ce4853e716425abccae187d00ed3ab1812fb0e04af47b5ed241370773522fa3c463c351c9dfc58b10c7962bd2e8c83710a3d46
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\vs_setup_bootstrapper.config
Filesize622B
MD58cae9ab11729425800770c9c8b2ba483
SHA1d6235bb0af785c6c4a0b5a212ff4cfd2b359d62e
SHA256dde7635af97aec15cad909bcd2917e0bd38e2f5c46de79ba21d9b29a2f6d59eb
SHA512e0303d828247326f662d577700dfd54eb406c5c15f7e38ec709e70b338e76efdb22feab7caf250d1c72377b478701dca745d772add8e08cd3e944332aa9e4d78
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
Filesize404KB
MD54108506d8cdc3a03bb7e4496025ee902
SHA1a02d206f205a1a45b5223a73bfe84e25b359d251
SHA256f9bf0a30395e521d65fb1e39a6a76e19c061a8d3806653fc7f5b28b9fb327903
SHA512b4a7aa0c65e3a3279d0845a02e896a85d5f5074a79ee3ab52a8aa422fab759d4fab177961c03f280ca7499e10678d29e951946283b26d2ca107d5be76c76e8e8
-
C:\Users\Admin\AppData\Local\Temp\e1e5d7314299373f72f5\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
Filesize2KB
MD5c301859aef3bf4c0914914e5807f6a5b
SHA1908827ce12d093d2aa3d1e8baa8caf8bfe204fbd
SHA256781ec48ae412ba18c2cea1b67f5bc4a33245fd5f96dbb0e58b218c98ee03785d
SHA5120b9eeb0288b01ddfde11404b15378694145978bdd664b68befe5f776f65f950d35f54b7f29662a64ff91feb4dc0e9bd537864e46a1f3f252e8113ddf95f32f0b
-
Filesize
89KB
MD573226f6a7c95892580d5d21e1ae4e3da
SHA1c2b52f6ddd33be202706f943ca727249616b6b9f
SHA256584e1b192b5f9c1713be9c01a7beb0011c6fc4e59c2e2ee916a1e1694a6c1980
SHA5128300524faa99170d3fe3238ae04bea53ed1c35271b0ef4441013a09bc0459857d3dca4cc37c075e86602cfc234a12b7609e7ad42e2dc30f8c2e642978852482f
-
Filesize
3.8MB
MD5e5ad81756117ef897b4f536179f7e2dc
SHA1db94d4326f3c7c0d24f80b4f8c5263d90086154e
SHA256e95098656cfbba6045e8f898e65b54f96375331ece9121e3bb912b80c6ef24a7
SHA512db1d8c572e0f3586601911cf2167b793010d7b0a255f48911ec013117d77f271325dae87313dd53b3bbceb95280a6dbb81465a26fcd93f59804caa0e8d186d93
-
Filesize
156KB
MD51af176174fb4d8daf6ebb8b01ff076ba
SHA11f9fafb241cd63886ddf88d53fef349f70fd9315
SHA256dcc42775bfa9b1f0399ee6a3d67b14dc81deb6135050587bf007ce92dda7e0b9
SHA512ea7dc165561ae90e736bcf94551c0736a48b8a930aa6ba30313ec37f5be9998ea2c5f7909011950840e32ee36bc008c49f4e8fa4cf072f13ad25543426f67571
-
Filesize
147KB
MD58a3d11a47794147a9ca8d9120a7b37b8
SHA1d3e8f97f23511d6025fab9047f650b8a8cb8a10d
SHA2569638abea2895fc947d9f9310f3b59f0921164b12645dbd4b0ebcfe13de2ae792
SHA512b0c843076771a9c27e1e1976e7b6cbc5848e9951aa89a975d1c7b8c9080d47b2e7422848e7f105c66f6bcc78d430a27d1ec6affa26badc811b85e1848ccba086