Analysis
- user interaction
yes - max time kernel
822s - max time network
890s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 02:50
General
- Target SaveFile100lvl.zip
- Size 37KB
- Sample260510-db2byagw71
- SHA256 c55e4238e9ba17e6ffaab3fe0acace9d52230ad8a4e9c49d75787811d3b9d289
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 40 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 6 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 50 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 24 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 59 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SaveFile100lvl.zip1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe054dc728,0x7ffe054dc734,0x7ffe054dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,917875071152367264,14393297408596898273,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2076 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,8143518200489089258,16139005503404915723,262144 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2040 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,9001405899765717751,3661514175063970892,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2384 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,18397006940452677407,5631455791613114551,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,14851448456774652080,6128087556774790689,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4208,i,7786804305976652701,1811894324059243899,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4624,i,17203278317611776474,7387491030298406044,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,943589762848173717,6847592636758216465,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5256 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,10027990422296035813,10452803265042066960,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,8284794678904253515,12949519454990961124,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5784 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,8506687483104743462,11220324179643325404,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5588 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5684,i,4001431586280046224,16154579683643893070,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4648,i,16441637439386293568,4541379483521192130,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4360 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=876,i,3515788903589419013,1113327602716019378,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3564,i,15428998780568698255,14751030385268831962,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3332,i,16983640879617992305,4545183452385845815,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5804,i,749092962428172658,10433237665403215118,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5996,i,7582170232700826288,5336750911816169034,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5860,i,3620624677316828862,6753769668546562991,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6208,i,9538394454518124973,14068617155737768909,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6188 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6252,i,3299217550102062740,333390308319505683,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6556,i,9710638310990967522,16051542713970660510,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6688,i,13898346264070168011,8994181060720097602,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6888,i,1569846292909056737,6021100666413093812,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6860 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7124,i,7892215546287154246,715470762977783576,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7144 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=3524,i,10432709187777178514,7046569182038853589,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,16276727395106277642,4038876969108728923,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5856 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,16923277677463626924,14118481588528129939,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7476 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7544,i,12117086959165623931,7270729720756728318,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7456 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7036,i,10743955770927284451,5096026127009018798,262144 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7020 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6864,i,3427928125023079544,15023774996499695192,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6500,i,17734577784069304645,9833996984906462914,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6892 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6884,i,1811779938084876825,3840778043348035242,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7256,i,15392699410177669125,9752737980228665559,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7204,i,470615397698415394,14918693526280131212,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8072,i,15370404577352677024,12023284936400434584,2097152 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=8092 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7960,i,16598043885664690879,2187593808697579367,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7180 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\VisualStudioSetup.exe"C:\Users\Admin\Downloads\VisualStudioSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\ba4ed6610741927c24305b\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\ba4ed6610741927c24305b\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\Downloads\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\Downloads"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\getmac.exe"getmac"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202605100353592006.json" --locale en-US --activityId "92b6d505-33d4-4210-84ec-fe2f1003e39a" --campaign "2500:68f580c1ac5d4f3ea75541c55c49e9b7" --pipe "62355d8e-7efd-44cd-80ce-10cae3e38f54"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.5.35.35368 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"5⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 92b6d505-33d4-4210-84ec-fe2f1003e39a --campaign 2500:68f580c1ac5d4f3ea75541c55c49e9b7 --handle 459624 --locale en-US --pid 1520 --pipeName 9004481836924342813063a6789e0217 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"4411a715-8d28-4c81-bd7b-bedf82de734f\",\"Id\":\"94870cba-d656-4224-93e1-3c55170cd92d\",\"ProcessStartTime\":639139784541501077,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 92b6d505-33d4-4210-84ec-fe2f1003e39a --campaign 2500:68f580c1ac5d4f3ea75541c55c49e9b7 --handle 459624 --locale en-US --pid 1520 --pipeName bf1c98ff38934627ba3669c8c513cdfa --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"4411a715-8d28-4c81-bd7b-bedf82de734f\",\"Id\":\"94870cba-d656-4224-93e1-3c55170cd92d\",\"ProcessStartTime\":639139784541501077,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause6⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause6⤵
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=18.5.11709.182\VSInitializer.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Initializer,version=18.5.11709.182\VSInitializer.exe" -Operation Install -InstallationID 214c62c1 -InstallationName VisualStudio/18.5.2+11723.231 -InstallationVersion 18.5.11723.231 -InstallationWorkloads Microsoft.VisualStudio.Workload.CoreEditor,Microsoft.VisualStudio.Workload.NativeDesktop -InstallationPackages Microsoft.VisualStudio.Component.CoreEditor,Microsoft.VisualStudio.Component.Roslyn.Compiler,Microsoft.Component.MSBuild,Microsoft.VisualStudio.Component.Roslyn.LanguageServices,Microsoft.VisualStudio.Component.TextTemplating,Microsoft.VisualStudio.Component.NuGet,Microsoft.VisualStudio.Component.DiagnosticTools,Microsoft.VisualStudio.Component.IntelliCode,Component.VisualStudio.GitHub.Copilot,Component.Microsoft.NET.AppModernization,ComponentGroup.Microsoft.NET.AppModernization,Microsoft.VisualStudio.Component.Debugger.JustInTime,Microsoft.VisualStudio.Component.VC.CoreIde,Microsoft.VisualStudio.Component.VC.Tools.x86.x64,Microsoft.VisualStudio.Component.Graphics.Tools,Microsoft.VisualStudio.Component.VC.DiagnosticTools,Microsoft.VisualStudio.Component.Windows11SDK.26100,Microsoft.VisualStudio.Component.VC.ATL,Microsoft.VisualStudio.Component.VC.Redist.14.Latest,Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core,Microsoft.VisualStudio.Component.Windows11Sdk.WindowsPerformanceToolkit,Microsoft.VisualStudio.Component.CppBuildInsights,Microsoft.VisualStudio.ComponentGroup.WebToolsExtensions.CMake,Microsoft.VisualStudio.Component.VC.CMake.Project,Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest,Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest,Microsoft.VisualStudio.Component.VC.ASAN,Microsoft.VisualStudio.Component.Vcpkg -InstallationPath """C:\Program Files\Microsoft Visual Studio\18\Community""" -ComponentId Microsoft.VisualStudio.Product.Community -ChannelsPath """https://aka.ms/vs/18/stable/channel""" -SetupEngineFilePath """C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe""" -Log """C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_015_Microsoft.VisualStudio.Initializer.log"""6⤵
- Executes dropped EXE
- System Time Discovery
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=18.5.4.2618101,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.Build.UnGAC,version=18.5.4.2618101,chip=neutral,language=neutral\Microsoft.Build.UnGAC.exe"6⤵
- Executes dropped EXE
-
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\\windowspowershell\v1.0\powershell.exe" -NoLogo -NoProfile -Noninteractive -ExecutionPolicy Unrestricted -InputFormat None -Command "& """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x86\VCRedistInstall.ps1""" -PayloadDirectory """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x86""" -Architecture x86 -Logfile """C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_264_Microsoft.VisualCpp.Redist.14.log"""; exit $LastExitCode"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x86\VC_redist.x86.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x86\VC_redist.x86.exe" /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_264_Microsoft.VisualCpp.Redist.14.log7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{850A385D-ACDE-421A-84C9-ECC834E90ED2}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{850A385D-ACDE-421A-84C9-ECC834E90ED2}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x86\VC_redist.x86.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_264_Microsoft.VisualCpp.Redist.14.log8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{BB0FA373-E32B-4E2F-BA48-AE2A6A684E9E}\.be\VC_redist.x86.exe"C:\Windows\Temp\{BB0FA373-E32B-4E2F-BA48-AE2A6A684E9E}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5CAE75E6-6D65-4774-A5C4-B4BFD7C423C7} {83B90D02-21F1-49FF-8C55-BA2C66E28F8A} 79089⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=980 -burn.embedded BurnPipe.{1636BFCE-B28B-48EC-B859-A61526509B56} {29913B09-6A7D-45C1-A917-9A33A397C547} 821210⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e4ccf1b-d073-4cfe-8a24-e86185719b56} -burn.filehandle.self=980 -burn.embedded BurnPipe.{1636BFCE-B28B-48EC-B859-A61526509B56} {29913B09-6A7D-45C1-A917-9A33A397C547} 821211⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D22E4AAB-5907-453C-B93B-2D02D59DABDC} {C0131773-CAC2-4951-AEFD-E48D177C8BA4} 899612⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
\??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe"c:\windows\syswow64\\windowspowershell\v1.0\powershell.exe" -NoLogo -NoProfile -Noninteractive -ExecutionPolicy Unrestricted -InputFormat None -Command "& """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x64\VCRedistInstall.ps1""" -PayloadDirectory """C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x64""" -Architecture x64 -Logfile """C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_265_Microsoft.VisualCpp.Redist.14.log"""; exit $LastExitCode"6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x64\VC_redist.x64.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x64\VC_redist.x64.exe" /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_265_Microsoft.VisualCpp.Redist.14.log7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{1400C90C-7A14-44D6-86C2-3D0769F7E4B6}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{1400C90C-7A14-44D6-86C2-3D0769F7E4B6}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualCpp.Redist.14,version=14.50.35719,chip=x64\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /q /norestart /log C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_265_Microsoft.VisualCpp.Redist.14.log8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{50414958-6BC6-41EC-ABCF-847E787D05AD}\.be\VC_redist.x64.exe"C:\Windows\Temp\{50414958-6BC6-41EC-ABCF-847E787D05AD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{5983C6CE-94BF-4DC9-A85C-FDB1F793B449} {6C818374-FE13-4EE0-932F-9BD49E07F8C7} 75449⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=984 -burn.embedded BurnPipe.{8E18F320-D096-406D-B3C0-31DC2DD3948B} {06724CDA-1A46-48B0-96B3-47721B1189C1} 650410⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=984 -burn.embedded BurnPipe.{8E18F320-D096-406D-B3C0-31DC2DD3948B} {06724CDA-1A46-48B0-96B3-47721B1189C1} 650411⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9F5BDA34-E87C-4FA5-8DAA-C88C0892CE0A} {F3C16067-ED73-42B1-81B3-8C3F7DF94339} 1017212⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Debugger.JustInTime,version=18.5.11709.182\VsJustInTimeDebuggerRegistrationHelper.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Debugger.JustInTime,version=18.5.11709.182\VsJustInTimeDebuggerRegistrationHelper.exe" /register 214c62c1 /packages "Microsoft.VisualStudio.Component.CoreEditor,Microsoft.VisualStudio.Component.Roslyn.Compiler,Microsoft.Component.MSBuild,Microsoft.VisualStudio.Component.Roslyn.LanguageServices,Microsoft.VisualStudio.Component.TextTemplating,Microsoft.VisualStudio.Component.NuGet,Microsoft.VisualStudio.Component.DiagnosticTools,Microsoft.VisualStudio.Component.IntelliCode,Component.VisualStudio.GitHub.Copilot,Component.Microsoft.NET.AppModernization,ComponentGroup.Microsoft.NET.AppModernization,Microsoft.VisualStudio.Component.Debugger.JustInTime,Microsoft.VisualStudio.Component.VC.CoreIde,Microsoft.VisualStudio.Component.VC.Tools.x86.x64,Microsoft.VisualStudio.Component.Graphics.Tools,Microsoft.VisualStudio.Component.VC.DiagnosticTools,Microsoft.VisualStudio.Component.Windows11SDK.26100,Microsoft.VisualStudio.Component.VC.ATL,Microsoft.VisualStudio.Component.VC.Redist.14.Latest,Microsoft.VisualStudio.ComponentGroup.NativeDesktop.Core,Microsoft.VisualStudio.Component.Windows11Sdk.WindowsPerformanceToolkit,Microsoft.VisualStudio.Component.CppBuildInsights,Microsoft.VisualStudio.ComponentGroup.WebToolsExtensions.CMake,Microsoft.VisualStudio.Component.VC.CMake.Project,Microsoft.VisualStudio.Component.VC.TestAdapterForBoostTest,Microsoft.VisualStudio.Component.VC.TestAdapterForGoogleTest,Microsoft.VisualStudio.Component.VC.ASAN,Microsoft.VisualStudio.Component.Vcpkg" /log "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_346_Microsoft.VisualStudio.Debugger.JustInTime.log"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Time Discovery
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Graphics.EnableTools,version=18.5.11709.182\EnableGraphicsTools.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Microsoft.VisualStudio.Graphics.EnableTools,version=18.5.11709.182\EnableGraphicsTools.exe" /log "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_360_Microsoft.VisualStudio.Graphics.EnableTools.log" /vsfolder "C:\Program Files\Microsoft Visual Studio\18\Community" /Cab6⤵
- Executes dropped EXE
-
C:\Windows\system32\dism.exe"C:\Windows\system32\dism.exe" /Online /Add-Capability /CapabilityName:Tools.Graphics.DirectX~~~~0.0.1.0 /Quiet /NoRestart /LogPath:"C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_360_Microsoft.VisualStudio.Graphics.EnableTools_dism.log"7⤵
-
C:\Users\Admin\AppData\Local\Temp\67B991D8-3784-42A2-B360-C6C7FB7648BB\dismhost.exeC:\Users\Admin\AppData\Local\Temp\67B991D8-3784-42A2-B360-C6C7FB7648BB\dismhost.exe {0E26E9A6-A361-4293-BB53-D137419695FF}8⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.26100,version=10.0.26100.15,productarch=neutral\winsdkinstaller.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.26100,version=10.0.26100.15,productarch=neutral\winsdkinstaller.exe" SetupExe=winsdksetup.exe LogFile="C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_451_Win11SDK_10.0.26100.log" SetupLogFolder=windowssdk CeipSetting="on" ProgramFilesOrSharedDriveSdkPath="C:\Program Files (x86)\Windows Kits\10" SetupParameters="/features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.26100,version=10.0.26100.15,productarch=neutral\winsdksetup.exe"C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.26100,version=10.0.26100.15,productarch=neutral\winsdksetup.exe" /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart /Ceip on /InstallPath "C:\Program Files (x86)\Windows Kits\10" /Log "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20260510035515_451_Win11SDK_10.0.26100.winsdksetup_1.log"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{C316835C-C9E1-42D3-A7C4-F0312D3A2CD0}\.cr\winsdksetup.exe"C:\Windows\Temp\{C316835C-C9E1-42D3-A7C4-F0312D3A2CD0}\.cr\winsdksetup.exe" -burn.clean.room="C:\ProgramData\Microsoft\VisualStudio\Packages\Win11SDK_10.0.26100,version=10.0.26100.15,productarch=neutral\winsdksetup.exe" -burn.filehandle.attached=728 -burn.filehandle.self=612 /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /quiet /norestart /Ceip on /InstallPath "C:\Program Files (x86)\Windows Kits\10" /Log "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20260510035515_451_Win11SDK_10.0.26100.winsdksetup_1.log"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{E956621A-133F-432D-B78E-AD295BCF478C}\.be\winsdksetup.exe"C:\Windows\Temp\{E956621A-133F-432D-B78E-AD295BCF478C}\.be\winsdksetup.exe" -q -burn.elevated BurnPipe.{3D738CF2-2FB8-4F63-8EBD-261B6C5AAB18} {75D1DFD6-AD6A-4B0B-8B28-FBB51016360B} 62129⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=8044,i,772159604773477312,3526954297283136371,524288 --field-trial-handle=2044,i,9048833228704227140,12641740191731061016,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3320 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\lain\" -an -ai#7zMap15512:80:7zEvent208851⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\lain\build.bat" "1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3C0F17D606BB37D9E60F3D22511D662E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8F1345C3001D8D548165D9452A2FA3892⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6F7E2F6CA37086D18153C6E085104C382⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 24796C65BDE26E49F705BAAA4A10CDFB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 378D90BEFE535B6B2CDB3724998E802C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe"C:\ProgramData\Microsoft\VisualStudio\SetupWMI\MofCompiler.exe" -autorecover "C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof"2⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\mofcomp.exe"C:\Windows\system32\wbem\mofcomp" -autorecover C:\ProgramData\Microsoft\VisualStudio\SetupWMI\Microsoft.VisualStudio.Setup.Management.mof3⤵
- Drops file in System32 directory
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 693496FA143C577BAAA2C65DA4EEFC19 M Global\MSI00002⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 8F3F1461351561CAA291995C137FE3FC2⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EAADE29051123C3F49B2DF4BA19371B5 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\appverif.exe"appverif.exe" /setupstandardproviders3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\appverif.exe"appverif.exe" /setupstandardproviders3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004C81⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --runOnce --installSessionId 99647366-518c-4ab0-8cde-6bb99eca45941⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --installSessionId 99647366-518c-4ab0-8cde-6bb99eca45942⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe"C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_264_Microsoft.VisualCpp.Redist.14.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_264_Microsoft.VisualCpp.Redist.14.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe"C:\ProgramData\Package Cache\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{0E0D8D40-96DD-48B2-AEBC-4E003432734F} {AE6EE9D9-DE96-41E2-B601-9845ADA61221} 73364⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_265_Microsoft.VisualCpp.Redist.14.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_setup_20260510035515_265_Microsoft.VisualCpp.Redist.14.log"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{64F44456-EE23-482C-AA45-EC37A0C0E6C9} {BF02AF5C-1887-4217-AE6E-D9833230C5FE} 82404⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
-
-
C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe"C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe"C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20260510035515_451_Win11SDK_10.0.26100.winsdksetup_1.log" /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /Ceip on /InstallPath "C:\Program Files (x86)\Windows Kits\10"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe"C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c0b93b80-d0a4-47fc-a4d1-21a4008a63ca}\winsdksetup.exe" -burn.filehandle.attached=564 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\windowssdk\dd_setup_20260510035515_451_Win11SDK_10.0.26100.winsdksetup_1.log" /features OptionId.AvrfExternal OptionId.UWPManaged OptionId.WindowsSoftwareLogoToolkit OptionId.SigningTools OptionId.UWPLocalized OptionId.UWPCPP OptionId.DesktopCPPx64 OptionId.DesktopCPPx86 OptionID.DesktopCPPARM64 OptionId.MSIInstallTools /Ceip on /InstallPath "C:\Program Files (x86)\Windows Kits\10"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b7241.rbs
e5b7245.rbs
e5b7249.rbs
e5b724d.rbs
e5b7252.rbs
e5b7257.rbs
e5b725c.rbs
e5b7261.rbs
e5b7266.rbs
e5b726b.rbs
e5b7270.rbs
e5b7275.rbs
e5b727a.rbs
e5b727f.rbs
e5b7284.rbs
e5b7289.rbs
e5b728e.rbs
e5b7293.rbs
e5b7298.rbs
e5b729d.rbs
e5b72a2.rbs
e5b72a3.rbf
e5b72ab.rbs
e5b72b0.rbs
e5b72b5.rbs
e5b72bc.rbs
e5b72c1.rbs
e5b72ce.rbs
e5b72dd.rbs
e5b72e4.rbs
e5b72ea.rbs
e5b72f7.rbs
e5b7306.rbs
e5b730b.rbs
e5b7310.rbs
e5b7315.rbs
e5b731a.rbs
e5b731f.rbs
e5b7324.rbs
e5b7329.rbs
e5b732e.rbs
e5b7333.rbs
e5b7338.rbs
e5b733d.rbs
e5b734f.rbs
e5b7354.rbs
e5b7359.rbs
e5b735e.rbs
e5b7363.rbs
e5b7368.rbs
e5b736d.rbs
e5b7372.rbs
e5b7377.rbs
e5b737c.rbs
e5b7381.rbs
e5b7386.rbs
e5b738b.rbs
e5b7390.rbs
e5b7395.rbs
e5b739a.rbs
e5b739f.rbs
e5b73a4.rbs
e5b73a9.rbs
e5b73ae.rbs
e5b73b3.rbs
e5b73b8.rbs
e5b73bd.rbs
e5b73c2.rbs
e5b73c7.rbs
e5b73cc.rbs
e5b73d1.rbs
e5b73d6.rbs
e5b73db.rbs
e5b73e0.rbs
e5b73e5.rbs
e5b73ea.rbs
e5b73ef.rbs
e5b73f4.rbs
e5b73f9.rbs
e5b73fe.rbs
e5b7403.rbs
e5b7408.rbs
e5b740d.rbs
e5b7412.rbs
e5b7417.rbs
e5b741c.rbs
e5b7421.rbs
e5b7426.rbs
e5b742b.rbs
e5b7430.rbs
e5b7435.rbs
e5b743a.rbs
e5b743f.rbs
e5b7444.rbs
e5b7449.rbs
e5b744e.rbs
e5b7453.rbs
e5b7458.rbs
e5b745d.rbs
e5b7462.rbs
e5b7467.rbs
e5b746c.rbs
e5b7471.rbs
e5b7476.rbs
e5b747b.rbs
e5b7480.rbs
e5b7485.rbs
msdbg2.dll
Windows.xml
msalruntime_x86.dll
System.Runtime.CompilerServices.Unsafe.dll
cat05047a45609f311645eebcac2739fc4c.cat
cat13d68b8a7b6678a368e2d13ff4027521.cat
cat26ea25236f12b23db661acf268a70cfa.cat
cat2a30b5d1115d515c6ddd8cd6b5173835.cat
cat463ad1b0783ebda908fd6c16a4abfe93.cat
cat4ec14c5368b7642563c070cd168960a8.cat
catdcfb1aa345e349091a44e86ce1766566.cat
cate59830bab4961666e8d8c2af1e5fa771.cat
appnotify.h
WindowsApp.lib
WindowsApp.lib
WindowsApp.lib
Windows.AI.Actions.ActionsContract.winmd
Windows.AI.Agents.AgentsContract.winmd
Windows.AI.MachineLearning.MachineLearningContract.winmd
Windows.AI.MachineLearning.Preview.MachineLearningPreviewContract.winmd
Windows.ApplicationModel.Activation.ActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.ActivationCameraSettingsContract.winmd
Windows.ApplicationModel.Activation.ContactActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.WebUISearchActivatedEventsContract.winmd
Windows.ApplicationModel.Activation.WebUISearchActivatedEventsContract.xml
Windows.ApplicationModel.Background.BackgroundAlarmApplicationContract.winmd
Windows.ApplicationModel.Calls.Background.CallsBackgroundContract.winmd
Windows.ApplicationModel.Calls.CallsPhoneContract.winmd
Windows.ApplicationModel.Calls.CallsVoipContract.winmd
Windows.ApplicationModel.Calls.LockScreenCallContract.winmd
Windows.ApplicationModel.CommunicationBlocking.CommunicationBlockingContract.winmd
Windows.ApplicationModel.FullTrustAppContract.winmd
Windows.ApplicationModel.Preview.InkWorkspace.PreviewInkWorkspaceContract.winmd
Windows.ApplicationModel.Preview.Notes.PreviewNotesContract.winmd
Windows.ApplicationModel.Preview.StartupAppsPreviewContract.winmd
Windows.ApplicationModel.Resources.Management.ResourceIndexerContract.winmd
Windows.ApplicationModel.Search.Core.SearchCoreContract.winmd
Windows.ApplicationModel.Search.SearchContract.winmd
Windows.ApplicationModel.SocialInfo.SocialInfoContract.winmd
Windows.ApplicationModel.StartupTaskContract.winmd
Windows.ApplicationModel.Wallet.WalletContract.winmd
Windows.Devices.Custom.CustomDeviceContract.winmd
Windows.Devices.DevicesLowLevelContract.winmd
Windows.Devices.Portable.PortableDeviceContract.winmd
Windows.Devices.Power.PowerGridApiContract.winmd
Windows.Devices.Printers.Extensions.ExtensionsContract.winmd
Windows.Devices.Printers.PrintersContract.winmd
Windows.Devices.Scanners.ScannerDeviceContract.winmd
Windows.Devices.SmartCards.SmartCardBackgroundTriggerContract.winmd
Windows.Devices.SmartCards.SmartCardEmulatorContract.winmd
Windows.Devices.Sms.LegacySmsApiContract.winmd
Windows.Foundation.FoundationContract.winmd
Windows.Foundation.UniversalApiContract.winmd
Windows.Gaming.Input.GamingInputPreviewContract.winmd
Windows.Gaming.Preview.GamesEnumerationContract.winmd
Windows.Gaming.UI.GameChatOverlayContract.winmd
Windows.Gaming.UI.GamingUIProviderContract.winmd
Windows.Gaming.XboxLive.StorageApiContract.winmd
Windows.Globalization.GlobalizationJapanesePhoneticAnalyzerContract.winmd
Windows.Graphics.Printing3D.Printing3DContract.winmd
Windows.Management.Deployment.Preview.DeploymentPreviewContract.winmd
Windows.Management.Deployment.SharedPackageContainerContract.winmd
Windows.Management.Update.WindowsUpdateContract.winmd
Windows.Management.Workplace.WorkplaceSettingsContract.winmd
Windows.Media.AppBroadcasting.AppBroadcastingContract.winmd
Windows.Media.AppRecording.AppRecordingContract.winmd
Windows.Media.Capture.AppBroadcastContract.winmd
Windows.Media.Capture.AppCaptureContract.winmd
Windows.Media.Capture.AppCaptureMetadataContract.winmd
Windows.Media.Capture.CameraCaptureUIContract.winmd
Windows.Media.Capture.GameBarContract.winmd
Windows.Media.Devices.CallControlContract.winmd
Windows.Media.MediaControlContract.winmd
Windows.Media.Playlists.PlaylistsContract.winmd
Windows.Media.Protection.ProtectionRenewalContract.winmd
Windows.Networking.Connectivity.WwanContract.winmd
Windows.Networking.NetworkOperators.LegacyNetworkOperatorsContract.winmd
Windows.Networking.Sockets.ControlChannelTriggerContract.winmd
Windows.Networking.XboxLive.XboxLiveSecureSocketsContract.winmd
Windows.Perception.Automation.Core.PerceptionAutomationCoreContract.winmd
Windows.Security.EnterpriseData.EnterpriseDataContract.winmd
Windows.Security.ExchangeActiveSyncProvisioning.EasContract.winmd
Windows.Security.Isolation.Isolatedwindowsenvironmentcontract.winmd
Windows.Services.Maps.GuidanceContract.winmd
Windows.Services.Maps.LocalSearchContract.winmd
Windows.Services.Store.StoreContract.winmd
Windows.Services.TargetedContent.TargetedContentContract.winmd
Windows.Storage.Provider.CloudFilesContract.winmd
Windows.System.Power.Thermal.PowerThermalApiContract.winmd
Windows.System.Profile.ProfileHardwareTokenContract.winmd
Windows.System.Profile.ProfileRetailInfoContract.winmd
Windows.System.Profile.ProfileSharedModeContract.winmd
Windows.System.Profile.SystemManufacturers.SystemManufacturersContract.winmd
Windows.System.SystemManagementContract.winmd
Windows.System.UserProfile.UserProfileContract.winmd
Windows.System.UserProfile.UserProfileLockScreenContract.winmd
Windows.UI.ApplicationSettings.ApplicationsSettingsContract.winmd
Windows.UI.Core.AnimationMetrics.AnimationMetricsContract.winmd
Windows.UI.Core.CoreWindowDialogsContract.winmd
Windows.UI.Input.Preview.Text.PreviewTextContract.winmd
Windows.UI.Shell.CompanionWindows.CompanionWindowsContract.winmd
Windows.UI.Shell.SecurityAppManagerContract.winmd
Windows.UI.Shell.SecurityAppManagerContract.xml
Windows.UI.Shell.Tasks.AppTaskContract.winmd
Windows.UI.Shell.WindowTabManagerContract.winmd
Windows.UI.UIAutomation.UIAutomationContract.winmd
Windows.UI.UIAutomation.UIAutomationContract.xml
Windows.UI.ViewManagement.ViewManagementViewScalingContract.winmd
Windows.UI.Xaml.Core.Direct.XamlDirectContract.winmd
Windows.UI.Xaml.Hosting.HostingContract.winmd
Windows.Web.Http.Diagnostics.HttpDiagnosticsContract.winmd
windows.system.profile.platformautomaticappsignincontract.winmd
ISVTier5AppSignSDK.cc
Microsoft.Diagnostics.Tracing.EventSource.dll
ServicingCommon.dll
Microsoft.Diagnostics.Tracing.EventSource.dll
ServicingCommon.dll
Microsoft.Diagnostics.Tracing.EventSource.dll
SupportedAPIs.xml
ServicingCommon.dll
msdbg2.dll
CertificateInformation.dat
Resources.en.resx
Microsoft.VisualStudio.CoreUtility.dll
Microsoft.VisualStudio.Text.Data.dll
Microsoft.VisualStudio.Text.Logic.dll
ItemCollapsed.png
ItemExpanded.png
msalruntime.dll
md-vb.zip
netstandard.dll
System.Text.Encodings.Web.dll
System.Text.Json.dll
Microsoft.TeamFoundation.TestManagement.ClientPackageUI.dll
EndTask.exe.config
COPYING.LIB
LICENSE
ct_log_list.cnf
Microsoft.Identity.Client.NativeInterop.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.VisualStudio.Validation.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
Microsoft.VisualStudio.TestWindow.Interfaces.resources.dll
Microsoft.VisualStudio.TestWindow.Internal.resources.dll
DumpMinitool.x86.exe.config
System.Buffers.dll
System.Numerics.Vectors.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
testhost.net47.arm64.exe.config
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.TestPlatform.CommunicationUtilities.resources.dll
Microsoft.TestPlatform.CoreUtilities.resources.dll
Microsoft.VisualStudio.TestPlatform.Common.resources.dll
Microsoft.VisualStudio.TestPlatform.ObjectModel.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
Microsoft.VisualStudio.TestWindow.RemoteUtilities.resources.dll
EULA.rtf
Microsoft.CodeAnalysis.CSharp.ExpressionEvaluator.ResultProvider.dll
Microsoft.CodeAnalysis.ExpressionEvaluator.FunctionResolver.dll
Microsoft.CodeAnalysis.ExpressionEvaluator.ResultProvider.dll
Microsoft.CodeAnalysis.VisualBasic.ExpressionEvaluator.ResultProvider.dll
ThirdPartyNotices.rtf
Microsoft.IO.Redist.dll
MessagePack.Annotations.dll
Microsoft.CodeAnalysis.InteractiveHost.dll
tbbmalloc.dll
chevronDown.svg
chevronRight.svg
DiagnosticsHub.TypeScript.Swimlanes.ScriptResources.resx
diagnosticsHub.js
knockout-3.4.0.js
AnalyzeSparkle.svg
askCopilot.svg
copilotInsight.svg
samplingDisabled.svg
samplingEnabled.svg
search.svg
dismiss.svg
FileIOTool.ScriptResources.resx
congrats_tutorial.png
Welcome.Python.Run.StopDebugging.png
Welcome.Python.Run.png
codeDirectionArrow.svg
hotItem.svg
hotPath.svg
hotPathDisabled.svg
i_chartzoom_reset.svg
i_chartzoom_reset_disabled.svg
information_blue.svg
Microsoft.Bcl.AsyncInterfaces.dll
System.Management.dll
Microsoft.VisualStudio.Copilot.ChunkIndexing.MarkdownChunkSource.servicehub.service.json
Microsoft.VisualStudio.Copilot.CopilotCliResponder.servicehub.service.json
Microsoft.VisualStudio.Copilot.McpResourceService.servicehub.service.json
Microsoft.VisualStudio.Copilot.McpServerAssetsService.servicehub.service.json
Microsoft.VisualStudio.Copilot.McpToolAggregator.servicehub.service.json
System.Diagnostics.PerformanceCounter.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
e_sqlite3.a
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Copilot.png
Microsoft.TeamFoundation.WorkItemTracking.ControlsCore.dll
dbgcore.dll
dbghelp.dll
Microsoft.SmartML.IntelliCode.dll
Microsoft.Extensions.FileSystemGlobbing.dll
NOTICE.txt
System.CodeDom.dll
System.Composition.AttributedModel.dll
System.Composition.Convention.dll
System.Composition.Hosting.dll
System.Composition.Runtime.dll
System.Composition.TypedParts.dll
System.Security.Cryptography.ProtectedData.dll
ImageContentTask.xml
MeshContentTask.xml
ShaderGraphContentTask.xml
Brighten.dgsl
lambert.dgsl
dsdadd.bmp
dsdadd.dds
dsddot.bmp
dsdmath.bmp
dsdmul.bmp
dsdmuladd.bmp
ImageContentTask.props
ImageContentTask.targets
MeshContentTask.props
MeshContentTask.targets
ShaderGraphContentTask.props
ShaderGraphContentTask.targets
rabbitmq.json
secrets.keyVault.nuget.json
Microsoft.VisualStudio.Utilities.Internal.dll
Microsoft.CodeCoverage.Core.dll
Microsoft.CodeCoverage.Instrumentation.Core.dll
Microsoft.DiaSymReader.Native.amd64.dll
Mono.Cecil.Pdb.dll
Mono.Cecil.Rocks.dll
Mono.Cecil.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
System.ValueTuple.dll
testhost.net47.arm64.exe.config
System.Text.Encodings.Web.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Validation.dll
System.Management.dll
Prospective.WebCSharp.tt
Azure.Identity.dll
Microsoft.DiaSymReader.dll
Microsoft.VisualStudio.CodeAnalysis.dll
Microsoft.VisualStudio.Debugger.Metadata.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.vil.dll
Microsoft.VisualStudio.vil.host.dll
Microsoft.VisualStudio.Debugger.Runtime.Desktop.dll
Microsoft.VisualStudio.Debugger.Runtime.NetCoreApp.dll
Microsoft.VisualStudio.Debugger.Runtime.NetStandard.dll
vspmsg.dll
JavaScript.vssettings
Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
System.Buffers.dll
System.Memory.dll
System.Net.Http.Formatting.dll
System.Numerics.Vectors.dll
System.Security.AccessControl.dll
MemoryAnalyzer.Extensions.dll
Microsoft.DiaSymReader.PortablePdb.dll
Microsoft.Diagnostics.FastSerialization.dll
Microsoft.Diagnostics.MemoryGraph.dll
Microsoft.Diagnostics.Utilities.dll
Microsoft.VisualStudio.Debugger.Interop.10.0.dll
Microsoft.VisualStudio.Debugger.Interop.11.0.dll
Microsoft.VisualStudio.Debugger.Interop.12.0.dll
Microsoft.VisualStudio.Debugger.Interop.14.0.dll
Microsoft.VisualStudio.Debugger.Interop.15.0.dll
Microsoft.VisualStudio.Debugger.InteropA.dll
System.Collections.Immutable.dll
System.Reflection.Metadata.dll
System.ValueTuple.dll
iisresolver.dll
msvcp140.dll
vcruntime140.dll
vsdebugeng.manimpl.45.dll
Microsoft.Win32.Registry.dll
msvcp140.dll
msvsmon.html
Microsoft.TeamFoundation.TestManagement.Client.dll
Microsoft.TeamFoundation.TestManagement.Common.dll
Newtonsoft.Json.dll
Microsoft.Bcl.HashCode.dll
System.Threading.Tasks.Dataflow.dll
System.Diagnostics.PerformanceCounter.dll
Microsoft.XslDebugger.dll
concrt140.dll
msdia140.dll
vcruntime140_1.dll
vsdebugeng.impl.resources.dll
dbgshim.dll
msvcdis140.dll
msvcp140_1.dll
msvcp140_atomic_wait.dll
natvis.xsd
symsrv.dll
vsn.wpfexp.exe.config.template
VsGraphicsResources.dll
MCppEE.dll
ServiceHub.RoslynCodeAnalysisService.exe.config
ServiceHub.IdentityHost.exe.config
Microsoft.VisualStudio.Telemetry.dll
vcruntime140.dll
Microsoft.Build.CommonTypes.xsd
Microsoft.Build.Core.xsd
Microsoft.CodeAnalysis.CSharp.Scripting.dll
Microsoft.CodeAnalysis.CSharp.dll
Microsoft.CodeAnalysis.Scripting.dll
Microsoft.CodeAnalysis.dll
System.Collections.Immutable.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
Microsoft.CodeAnalysis.CSharp.resources.dll
Microsoft.CodeAnalysis.resources.dll
System.Reflection.MetadataLoadContext.dll
System.Text.Json.dll
System.Threading.Tasks.Dataflow.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTrackerA4UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
FileTracker32UI.dll
FileTracker64UI.dll
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.Bcl.HashCode.dll
System.IO.Pipelines.dll
System.Text.Encodings.Web.dll
FileTracker32.dll
FileTracker64.dll
FileTrackerA4.dll
Debugger_General.xaml
liblinux.resources.dll
Microsoft.CodeAnalysis.props
fxcop.xml
vspmsgui.dll
msdia140.dll
Microsoft.VCToolsVersion.default.txt
VsGraphicsHelper.dll
Microsoft.VisualStudio.Telemetry.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
vctip.exe.config
Microsoft.Diagnostics.Tracing.EventSource.dll
xdcmake.exe.config
complex.xml
functional.xml
exe_initialize_mta.lib
iso_stdio_wide_specifiers.lib
legacy_stdio_definitions.lib
legacy_stdio_wide_specifiers.lib
oldnames.lib
legacy_stdio_float_rounding.obj
exe_initialize_mta.lib
iso_stdio_wide_specifiers.lib
legacy_stdio_definitions.lib
legacy_stdio_wide_specifiers.lib
legacy_x86_flt_exceptions.lib
oldnames.lib
legacy_stdio_float_rounding.obj
JScript.js
StyleSheet.scss
DotNetConfig471.xsd
LICENSE.txt
.version
Microsoft.DiaSymReader.Native.amd64.dll
mscordaccore_amd64_amd64_10.0.726.21808.dll
msquic.dll
D3DCompiler_47_cor3.dll
Microsoft.WindowsDesktop.App.runtimeconfig.json
System.Diagnostics.EventLog.Messages.dll
vcruntime140_cor3.dll
mscordaccore_amd64_amd64_8.0.2626.16921.dll
payload.vsix
VCRedistInstall.ps1
4e2dea081242e821596b58b31bc22cca.cab
598442d9f84639d200d4f3af477da95c.cab
winsdksetup.exe
state.groups.json.temp
state.groups.json.temp
state.groups.json.temp
state.groups.json.temp
state.groups.json.temp
state.groups.json.temp
state.json
state.packages.json
vs_setup_bootstrapper_202605100353592006.json
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00004c
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe584810.TMP
044b974c2b366b2c_0
the-real-index
index.txt
index.txt~RFe597248.TMP
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
20260510025427_448e8c58a387468d807b6ed13764638e.trn
20260510025448_1db9f6a92d044c5ea5c1f596b263d8a2.trn
20260510025518_20c82784f4c54a338f8608cb7f7a03f4.trn
20260510025618_ac343757c0d0434cb109683a9e222c21.trn
20260510025722_91a2ebb556ca40e7880910952756180c.trn
.updateUri
channels.json
channelManifest.json
state.json
channelManifest.json
ShippedFlights[1].cache
RemoteSettings_Installer[1].cache
dyntelconfig[1].cache
DisabledFlights[1].cache
4wrovanv.f5l
__PSScriptPolicyTest_nh4nag0m.qny.ps1
Microsoft.Bcl.AsyncInterfaces.dll
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.Extensions.Configuration.Abstractions.dll
Microsoft.Extensions.Configuration.Binder.dll
Microsoft.Extensions.Configuration.dll
Microsoft.Extensions.DependencyInjection.Abstractions.dll
Microsoft.Extensions.DependencyInjection.dll
Microsoft.Extensions.Diagnostics.Abstractions.dll
Microsoft.Extensions.Logging.Abstractions.dll
Microsoft.Extensions.Logging.Configuration.dll
Microsoft.Extensions.Logging.dll
Microsoft.Extensions.Options.ConfigurationExtensions.dll
Microsoft.Extensions.Options.dll
Microsoft.Extensions.Primitives.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Diagnostics.DiagnosticSource.dll
System.IO.FileSystem.AccessControl.dll
System.Security.Cryptography.ProtectedData.dll
System.Security.Principal.Windows.dll
System.Threading.Tasks.Extensions.dll
msalruntime_arm64.dll
msalruntime.dll
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
dd_setup_20260510035515_360_Microsoft.VisualStudio.Graphics.EnableTools_dism.log
cab1.cab
Microsoft.Build.vsix
payload.vsix
cab1.cab
Microsoft.Build.UnGAC.exe
Microsoft.CodeAnalysis.Compilers.x64.vsix
ExpressionEvaluatorPackage.vsix
Roslyn.VisualStudio.Setup.vsix
Microsoft.CodeCoverage.Console.X64.vsix
Microsoft.CredentialProvider.vsix
Microsoft.DataAI.NuGetRecommender.vsix
Microsoft.Developer.IdentityServiceGS.vsix
payload.vsix
payload.vsix
Microsoft.DiagnosticsHub.BenchmarkDotNet.vsix
Microsoft.DiagnosticsHub.BenchmarkDotNet.x64.vsix
Microsoft.DiagnosticsHub.Collection.x64.vsix
payload.vsix
cabx64_1.cab
Microsoft.DiagnosticsHub.CpuSampling.vsix
Microsoft.DiagnosticsHub.CpuSampling.x64.vsix
Microsoft.DiagnosticsHub.DatabaseTool.vsix
Microsoft.DiagnosticsHub.DatabaseTool.x64.vsix
Microsoft.DiagnosticsHub.DotNetAsync.vsix
Microsoft.DiagnosticsHub.DotNetAsync.x64.vsix
Microsoft.DiagnosticsHub.DotNetCountersTool.vsix
Microsoft.DiagnosticsHub.DotNetCountersTool.x64.vsix
Microsoft.DiagnosticsHub.DotNetObjectAlloc.vsix
Microsoft.DiagnosticsHub.DotNetObjectAlloc.x64.vsix
Microsoft.DiagnosticsHub.EventsViewerTool.vsix
Microsoft.DiagnosticsHub.EventsViewerTool.x64.vsix
Microsoft.DiagnosticsHub.FileIOTool.vsix
Microsoft.DiagnosticsHub.FileIOTool.x64.vsix
Microsoft.DiagnosticsHub.Instrumentation.vsix
Microsoft.DiagnosticsHub.Instrumentation.x64.vsix
Microsoft.DiagnosticsHub.Runtime.vsix
payload.vsix
payload.vsix
Microsoft.DiagnosticsHub.Runtime.Targeted.x64.vsix
Microsoft.DiagnosticsHub.Tools.vsix
Microsoft.DiagnosticsHub.UserMarks.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.Modernization.AppCAT.vsix
Microsoft.Modernization.UpgradeAgent.vsix
Microsoft.Modernization.UpgradeAssistant.vsix
aspnetcore-runtime-x64.zip
windowsdesktop-runtime-x64.zip
aspnetcore-runtime-x64.zip
windowsdesktop-runtime-x64.zip
Microsoft.NuGet.Build.Tasks.Setup.vsix
Microsoft.ServiceHub.Managed.vsix
Microsoft.ServiceHub.Node.vsix
Microsoft.ServiceHub.amd64.vsix
Microsoft.VC.14.50.18.0.ASAN.Headers.base.vsix
Microsoft.VC.14.50.18.0.ASAN.X86.OneCore.base.vsix
Microsoft.VC.14.50.18.0.ATL.Headers.base.vsix
Microsoft.VC.14.50.18.0.ATL.Source.base.vsix
Microsoft.VC.14.50.18.0.ATL.X64.base.vsix
Microsoft.VC.14.50.18.0.ATL.X86.base.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx64.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx64.Targetx64.base.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx64.Targetx86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx64.Targetx86.base.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx86.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx86.Targetx64.base.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx86.Targetx86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.CA.Ext.Hostx86.Targetx86.base.vsix
Microsoft.VC.14.50.18.0.CA.Rulesets.base.vsix
Microsoft.VC.14.50.18.0.CRT.Headers.Resources.enu.vsix
Microsoft.VC.14.50.18.0.CRT.Headers.Resources.base.enu.vsix
Microsoft.VC.14.50.18.0.CRT.Headers.base.vsix
Microsoft.VC.14.50.18.0.CRT.Redist.X64.base.vsix
Microsoft.VC.14.50.18.0.CRT.Redist.X86.base.vsix
Microsoft.VC.14.50.18.0.CRT.Redist.x64.OneCore.Desktop.base.vsix
Microsoft.VC.14.50.18.0.CRT.Redist.x86.OneCore.Desktop.base.vsix
Microsoft.VC.14.50.18.0.CRT.Source.base.vsix
Microsoft.VC.14.50.18.0.CRT.x64.Desktop.base.vsix
Microsoft.VC.14.50.18.0.CRT.x64.Store.base.vsix
Microsoft.VC.14.50.18.0.CRT.x86.OneCore.Desktop.base.vsix
Microsoft.VC.14.50.18.0.CRT.x86.Store.base.vsix
Microsoft.VC.14.50.18.0.PGO.Headers.base.vsix
Microsoft.VC.14.50.18.0.PGO.X64.base.vsix
Microsoft.VC.14.50.18.0.PGO.X86.base.vsix
Microsoft.VC.14.50.18.0.Prem.HostX64.TargetX64.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Prem.HostX64.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Prem.HostX86.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Prem.Hostx86.Targetx64.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Premium.Tools.HostX64.TargetX64.base.vsix
Microsoft.VC.14.50.18.0.Premium.Tools.HostX64.TargetX86.base.vsix
Microsoft.VC.14.50.18.0.Premium.Tools.HostX86.TargetX64.base.vsix
Microsoft.VC.14.50.18.0.Premium.Tools.HostX86.TargetX86.base.vsix
Microsoft.VC.14.50.18.0.Props.vsix
Microsoft.VC.14.50.18.0.Props.ARM64.vsix
Microsoft.VC.14.50.18.0.Props.ATLMFC.vsix
Microsoft.VC.14.50.18.0.Props.x64.vsix
Microsoft.VC.14.50.18.0.Props.x86.vsix
Microsoft.VC.14.50.18.0.Servicing.vsix
Microsoft.VC.14.50.18.0.Servicing.ATL.vsix
Microsoft.VC.14.50.18.0.Servicing.CAExtensions.vsix
Microsoft.VC.14.50.18.0.Servicing.CARulesets.vsix
Microsoft.VC.14.50.18.0.Servicing.Compilers.vsix
Microsoft.VC.14.50.18.0.Servicing.CrtHeaders.vsix
Microsoft.VC.14.50.18.0.Tools.Core.Props.vsix
Microsoft.VC.14.50.18.0.Tools.HostX64.TargetX64.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Tools.HostX64.TargetX64.base.vsix
Microsoft.VC.14.50.18.0.Tools.HostX64.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Tools.HostX64.TargetX86.base.vsix
Microsoft.VC.14.50.18.0.Tools.HostX86.TargetX64.base.vsix
Microsoft.VC.14.50.18.0.Tools.HostX86.TargetX86.Res.base.enu.vsix
Microsoft.VC.14.50.18.0.Tools.HostX86.TargetX86.base.vsix
Microsoft.VC.14.50.18.0.Tools.Hostx86.Targetx64.Res.base.enu.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualCpp.ASAN.X86.vsix
Microsoft.VisualCpp.ASAN.X86.OneCore.vsix
Microsoft.VisualCpp.ATL.Headers.vsix
Microsoft.VisualCpp.ATL.Source.vsix
Microsoft.VisualCpp.ATL.X64.vsix
Microsoft.VisualCpp.ATL.X86.vsix
Microsoft.VisualCpp.CA.Ext.Hostx64.Targetx64.vsix
Microsoft.VisualCpp.CA.Ext.Hostx64.Targetx86.vsix
Microsoft.VisualCpp.CA.Ext.Hostx86.Targetx64.vsix
Microsoft.VisualCpp.CA.Ext.Hostx86.Targetx86.vsix
cab1.cab
Microsoft.VisualCpp.CRT.Headers.vsix
Microsoft.VisualCpp.CRT.Redist.Resources.enu.vsix
Microsoft.VisualCpp.CRT.Redist.X64.vsix
Microsoft.VisualCpp.CRT.Redist.X86.vsix
Microsoft.VisualCpp.CRT.Redist.x64.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.Redist.x86.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.Source.vsix
Microsoft.VisualCpp.CRT.x64.Desktop.vsix
Microsoft.VisualCpp.CRT.x64.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.x64.Store.vsix
Microsoft.VisualCpp.CRT.x86.Desktop.vsix
Microsoft.VisualCpp.CRT.x86.OneCore.Desktop.vsix
Microsoft.VisualCpp.CRT.x86.Store.vsix
payload.vsix
Microsoft.VisualCpp.DIA.SDK.vsix
Microsoft.VisualCpp.PGO.Headers.vsix
Microsoft.VisualCpp.PGO.X64.vsix
Microsoft.VisualCpp.PGO.X86.vsix
Microsoft.VisualCpp.Premium.Tools.HostX64.TargetX64.vsix
Microsoft.VisualCpp.Premium.Tools.HostX64.TargetX86.vsix
Microsoft.VisualCpp.Premium.Tools.HostX86.TargetX64.vsix
Microsoft.VisualCpp.Premium.Tools.HostX86.TargetX86.vsix
VC_redist.x86.exe
VC_redist.x64.exe
cab1.cab
cab1.cab
Microsoft.VisualCpp.Servicing.DIASDK.vsix
Microsoft.VisualCpp.Servicing.Redist.vsix
Microsoft.VisualCpp.Tools.Common.Utils.vsix
Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix
payload.vsix
Microsoft.VisualCpp.Tools.Core.Resources.enu.vsix
Microsoft.VisualCpp.Tools.Core.x86.vsix
Microsoft.VisualCpp.Tools.HostX64.TargetX64.vsix
Microsoft.VisualCpp.Tools.HostX64.TargetX86.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX64.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX86.vsix
Microsoft.VisualCpp.Tools.HostX86.TargetX86.Res.enu.vsix
Microsoft.VisualCpp.Tools.Hostx86.Targetx64.Res.enu.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Cache.Service.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Connected.Auto.vsix
payload.vsix
Microsoft.VisualStudio.ConnectedServices.Core.vsix
Microsoft.VisualStudio.Copilot.Contracts.vsix
Microsoft.VisualStudio.Copilot.Testing.UI.vsix
Microsoft.VisualStudio.CoreDotNet.vsix
payload.vsix
UserProfiles.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.BrokeredServices.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
VsJustInTimeDebuggerRegistrationHelper.exe
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
VisualStudioEditorsSetup.vsix
Microsoft.VisualStudio.ErrorList.vsix
Microsoft.VisualStudio.Extensibility.Container.vsix
Microsoft.VisualStudio.ExtensionManager.vsix
Microsoft.VisualStudio.ExtensionManager.vsix
cab1.cab
cab1.cab
Microsoft.VisualStudio.Finalizer.vsix
cab1.cab
payload.vsix
Microsoft.VisualStudio.GraphProvider.Auto.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
EnableGraphicsTools.exe
cab1.cab
cab1.cab
payload.vsix
payload.vsix
Microsoft.VisualStudio.Identity.vsix
payload.vsix
VSInitializer.exe
payload.vsix
Microsoft.VisualStudio.IntelliCode.CSharp.vsix
Microsoft.VisualStudio.VsInteractiveWindow.vsix
Microsoft.VisualStudio.LanguageServer.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.LiveShare.VSCore.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.MefHosting.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
cab1.cab
payload.vsix
cab1.cab
Microsoft.VisualStudio.MinShell.x64.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.NgenRunner.vsix
NuGet.Tools.vsix
payload.vsix
Microsoft.VisualStudio.OpenFolder.vsix
Microsoft.VisualStudio.OpenTelemetry.ClientExtensions.netfx.vsix
Microsoft.VisualStudio.OpenTelemetry.Collector.netfx.vsix
Microsoft.VisualStudio.OpenTelemetry.Core.netfx.vsix
Microsoft.VisualStudio.OpenTelemetry.netfx.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Platform.CallHierarchy.vsix
Microsoft.VisualStudio.Platform.Editor.vsix
Microsoft.VisualStudio.Platform.Markdown.vsix
Microsoft.VisualStudio.Platform.NavigateTo.vsix
Microsoft.VisualStudio.Platform.Terminal.vsix
Microsoft.VisualStudio.Platform.Terminal.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.ProjectServices.vsix
Microsoft.VisualStudio.ProjectSystem.Vsix
Microsoft.VisualStudio.ProjectSystem.Full.vsix
Microsoft.VisualStudio.ProjectSystem.Query.Vsix
Microsoft.VisualStudio.ScriptedHost.vsix
Microsoft.VisualStudio.ScriptedHost.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.TeamExplorer.vsix
Microsoft.VisualStudio.TeamExplorer.MinGit.vsix
payload.vsix
cab1.cab
Microsoft.VisualStudio.TestTools.DynamicCodeCoverage.vsix
Microsoft.VisualStudio.TestWindow.Profiler.Setup.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.TestTools.TestPlatform.V2.CLI.vsix
payload.vsix
Microsoft.VisualStudio.TextMateGrammars.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.UIInternal.vsix
Microsoft.VisualStudio.UIInternal.Guide.vsix
Microsoft.VisualStudio.VC.CMake.x64.vsix
payload.vsix
Microsoft.VisualStudio.VC.CMake.Project.x64.vsix
Microsoft.VisualStudio.VC.Copilot.Setup.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.VC.Ide.LanguageService.Dependencies.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
BoostUnitTestAdapter.vsix
Packaging.TAfGT.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.VsWebProtocolSelector.Msi.msi
cab1.cab
Microsoft.VisualStudio.WPF.Internal.x64.vsix
Microsoft.VisualStudio.Web.Azure.Common.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.WebToolsExtensions.vsix
Microsoft.VisualStudio.WebToolsExtensions.vsix
Microsoft.VisualStudio.WebToolsExtensions.Json.vsix
Microsoft.VisualStudio.WebToolsExtensions.MSBuild.vsix
Microsoft.VisualStudio.WhatsNew.vsix
Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix
Microsoft.WebTools.Languages.Shared.vsix
Microsoft.WebTools.Shared.vsix
SqlCommon.vsix
SQLCommon.amd64.vsix
payload.vsix
payload.vsix
payload.vsix
SQLitePCLRaw.x64.vsix
03fbc2dfe9d3e7bb2389c7ed18c6ad3e.cab
05047a45609f311645eebcac2739fc4c.cab
05254f60ea43b4e3959b17cdb03268c0.cab
07a57cdb41ba28cced14005f087267be.cab
08e9468089f54c8455f59fd9bb48fcec.cab
126c039acc6f1c0a9426a128efb713e7.cab
12a529d45b148a2d28290a8a7535b37b.cab
13bf5f9b75a9d1c9f44ba5d34a14227f.cab
13d68b8a7b6678a368e2d13ff4027521.cab
15369c02f0856bfd3d570cd8a8107b55.cab
1623efce9d1a46396798f44a7bc769e9.cab
16ab2ea2187acffa6435e334796c8c89.cab
19248fabbb2098a7b88c4a2786066bcc.cab
1de82860db02f762c5f65a73daa31f3e.cab
1f32e9acf0bb1e6a5f485cd8670cd8e1.cab
20e79882c0bf37840a94a4ce06bc571e.cab
220daf459e79c5d26366654b1b482e87.cab
262fa3187c00a1f695e0c3eeb7ecf423.cab
2630bae9681db6a9f6722366f47d055c.cab
263104e5ce3a72f68151a93d88a3f22f.cab
26ea25236f12b23db661acf268a70cfa.cab
2a30b5d1115d515c6ddd8cd6b5173835.cab
2dd914bb5abd9365f932d15eede09c52.cab
2e876dd22fa5e6785f137e3422dd50ec.cab
306e26e920fd32cb02bf538b4e799a0d.cab
3e2f7be479e3679d700ce0782e4cc318.cab
4035a83dc8e73244d15d1196d55059c3.cab
40d92f424eff54b03db4c51669f9a8d6.cab
43d52fdb99b86048e15fbd34f5b99cb5.cab
43fd989a0684600a8c4dda7a6373eb59.cab
44472e2321abba45e828de25827264a3.cab
463ad1b0783ebda908fd6c16a4abfe93.cab
47133212c2f5ccf49392d7762293a075.cab
4a4c678668584fc994ead5b99ccf7f03.cab
4ad4df991deb0eaa1f79f896b959d580.cab
4c59234340aaf3a96ec480c1aad8d179.cab
4dc69cc131b3f4fdde53e76d759509dc.cab
4ec14c5368b7642563c070cd168960a8.cab
4fe4c8b88812f5339018c0eef95acdb9.cab
50ce7925226cb6ab8e0fe9ad9fd58433.cab
53174a8154da07099db041b9caffeaee.cab
5509e4710313421be8d5e7cfbfde4d30.cab
559dbc3a49a69c6adf60b1c87b4df71b.cab
563138901adf40a699df4654138ac397.cab
56a114848fda9a7e47bad4b3fc4be9a6.cab
576cff9c50e8085ab8d9c28ee12bac3e.cab
58314d0646d7e1a25e97c902166c3155.cab
590d28783ff280b8b0016c3492433241.cab
5a22e5cde814b041749fb271547f4dd5.cab
5c9ecffb06ed5f4fe5fb7db86bf7328b.cab
5cf1d61a223a02ff2f52fe05f058d52e.cab
5f6cfec263cd265cf3b0d97fd78ddf05.cab
61d57a7a82309cd161a854a6f4619e52.cab
66c7c64126fbf84f47ccec556d149b12.cab
67c9fd1fab36154e6e7e429610cd67c8.cab
67fb2af3d2219b403e419535a547c019.cab
685f3d4691f444bc382762d603a99afc.cab
68a5a2b14625f935761325cddfadca11.cab
68de71e3e2fb9941ee5b7c77500c0508.cab
69661e20556b3ca9456b946c2c881ddd.cab
6b12414fdb1b4978419abcd383206c09.cab
6b5a91701fdb98ac8bc4af6e238e0390.cab
6e86d5003787b5a44d77f0142b20f2ff.cab
6ee7bbee8435130a869cf971694fd9e2.cab
703316c9de0a32acf316d03b1cffc559.cab
73b80f421d7f3df5a71bd772f56bf3ae.cab
766c0ffd568bbb31bf7fb6793383e24a.cab
7afc7b670accd8e3cc94cfffd516f5cb.cab
7c3667a45d36470bf3cb648878a6ac2e.cab
8016f7584c8fbeff0b032c65f4173e78.cab
8038f3cc95dc4b7d0346cb2ab7e044ff.cab
8125ee239710f33ea485965f76fae646.cab
818d2d3634f0efb6e64d7e7c8ca5f98b.cab
838060235bcd28bf40ef7532c50ee032.cab
89d9bbd87f7a5560bafa520a4ebfdf17.cab
8ce0662e0e014576121e526f53d8f6b5.cab
8da73ae89e24f0b5cdf1787799c2a65f.cab
8daf1f236e631041cdaa802ddb9ccc3d.cab
8e4755178e6b5bcba8d3538c3630b7a5.cab
8fe3c1ca244ece932599eb0b61855d8f.cab
90e1202895672ce81992e71be30528cc.cab
93a74a1d34a22ae9d2e1ccc5208ad21a.cab
94521fd1a9c57258998d60ce60dc43c3.cab
948a611cd2aca64b1e5113ffb7b95d5f.cab
96076045170fe5db6d5dcf14b6f6688e.cab
9a7145bc3b132e5da6d44c0ab4a1af70.cab
9ba47e440ec2fbe9a3d32a53bf0f68dc.cab
a17683486ace64c3f9a1cacb81ee0260.cab
a1e2a83aa8a71c48c742eeaff6e71928.cab
a330840cf08ad4d210703c9acd1bf2b8.cab
a35cd6c9233b6ba3da66eecaa9190436.cab
a68c0988d16ee124783efd98074dcbf9.cab
a76e4219ecb0f1c0006a6fe080c54ad9.cab
aa9c58552bdb82dae4ed48ece081cfe3.cab
ac4ddfcf1101c483559a5f6e36f1ef2d.cab
b0656253ef2f688d2982eafa2e73f621.cab
b1a824e2952532fe8fd0145f5d148d25.cab
b1a8ecf890b4ffddd05e8c9422f55db7.cab
b2f03f34ff83ec013b9e45c7cd8e8a73.cab
b4eea6c909a31ab051e6f9b6218beec8.cab
b5f177b84c0ec473cbd69557634b27cd.cab
b80b7321357f7c9f281536f9440dfe68.cab
b82881a61b7477bd4eb5de2cd5037fe2.cab
b913ca15956d14df2d4b1f11ae07885b.cab
be06eca425b0c3c2f4de61cbfe9bc7a7.cab
beb5360d2daaa3167dea7ad16c28f996.cab
c0aa6d435b0851bf34365aadabd0c20f.cab
c1be9e93e88be3f6207f5cc074775d81.cab
c2aabf6ea5c1d348ec22f3aeb92f8656.cab
c4d38a2c963178a1a3469ca3d913768e.cab
cd9128b760c06a010e1621af6528432e.cab
cdea5502a35d09ddfbcda12e3a391dc0.cab
d117bb4bc77abadc7c603552e122e513.cab
d1de88680a8e53fe75e01e94dc0ed767.cab
d3e405ab232f8aca8c5b6a48a913d6b0.cab
d67259e233ce975d91c3b02d483becad.cab
d95da93904819b1f7e68adb98b49a9c7.cab
dcfb1aa345e349091a44e86ce1766566.cab
de111c3d435b0785b31b28c386ee691f.cab
e10768bb6e9d0ea730280336b697da66.cab
e10f8811d44b50885777f56f8272f66b.cab
e24dd258b3bbfa69c0842948fe0dd670.cab
e3bfdbe21d5f48f62e6347294e6e8492.cab
e3d1b35aecfccda1b4af6fe5988ac4be.cab
e59830bab4961666e8d8c2af1e5fa771.cab
e5c4b31ff9997ac5603f4f28cd7df602.cab
e87de81a902e0c8cde9e1355c3ff5f3f.cab
e89e3dcbb016928c7e426238337d69eb.cab
e98fa5eb5fee6ce17a7a69d585870b7c.cab
ec0637c03f99046936d32d51e13a392a.cab
ec9ab4bbb809719605d27da343b909e8.cab
ec9d39539c27e8cf5ad39bffce00c34e.cab
eca0aa33de85194cd50ed6e0aae0156f.cab
ed4d1c6b9811d81e3cebc553ae604f0d.cab
ed5aa2f399092df3084cce671f072cac.cab
ef4472fd7552490fd759075186ed2ec8.cab
f105a73f98cfc88c7b64d8f7b39a474c.cab
f2e05dfd38ed343d3de77209cf3ecdae.cab
f4661eda3692e166927c14c96164150a.cab
f7b25543b47329ef932ad391c72c4ab7.cab
f9b24c8280986c0683fbceca5326d806.cab
f9ff50431335056fb4fbac05b8268204.cab
fe38b2fd0d440e3c6740b626f51a22fc.cab
fef2cfedd6135e0ed85290b83f3682c3.cab
ff8dd5a961e46b5d05906ac4b7a5ba37.cab
931721e121ef91707ddcb6cac354d95c.cab
WinSdkInstaller.exe
config_devenv.vsix
microsoft.visualstudio.remotecontrol_16.3.52_netfx.vsix
microsoft.visualstudio.utilities.internal_16.3.90_netfx.vsix
newtonsoft.json_13.0.3_netfx.vsix
SQLSysClrTypes.msi
system.buffers_4.6.1_netfx.vsix
system.memory_4.6.3_netfx.vsix
system.numerics.vectors_4.6.1_netfx.vsix
system.runtime.compilerservices.unsafe_6.1.2_netfx.vsix
zusomv1p.json
peb2kuca.json
cn5oy315.json
Unconfirmed 500719.crdownload
VisualStudioSetup.exe:Zone.Identifier
lain.rar:Zone.Identifier
link.write.1.tlog
link.write.1.tlog
build.bat
DiskDefragPro.exe
MSI3CCA.tmp
MSID8EC.tmp
ngen.log
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.Resources.dll
Microsoft.SqlServer.Types.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsResources.dll
VsGraphicsHelper.dll
appverif.exe
thm.wxl
thm.xml
wixstdba.dll
VC_redist.x64.exe
BootstrapperCore.dll
Microsoft.Bootstrapper.dll
Microsoft.Diagnostics.Tracing.EventSource.dll
mbahost.dll
wixstdba.dll
logo.png
VC_redist.x86.exe
BootstrapperCore.config
Microsoft.VisualStudio.CodeCoverage.Shim.dll
Microsoft.VisualStudio.PerformanceTools.Detours.dll
stdole.dll
Microsoft.SqlServer.Types.dll
memory/840-30170-0x000001FBDBC30000-0x000001FBDBD50000-memory.dmp
memory/1520-2598-0x0000020A2DB60000-0x0000020A2DB82000-memory.dmp
memory/1520-2660-0x0000020A29D00000-0x0000020A29D08000-memory.dmp
memory/1520-2601-0x0000020A2DD10000-0x0000020A2DD2E000-memory.dmp
memory/1520-2602-0x0000020A2DC50000-0x0000020A2DC6C000-memory.dmp
memory/1520-2603-0x0000020A2DEB0000-0x0000020A2DFAC000-memory.dmp
memory/1520-2596-0x0000020A2B590000-0x0000020A2B5A2000-memory.dmp
memory/1520-2595-0x0000020A2DC80000-0x0000020A2DD08000-memory.dmp
memory/1520-2599-0x0000020A2DD60000-0x0000020A2DDB0000-memory.dmp
memory/1520-2591-0x0000020A2DB90000-0x0000020A2DBE2000-memory.dmp
memory/1520-2587-0x0000020A2B5E0000-0x0000020A2B5E8000-memory.dmp
memory/1520-2597-0x0000020A2DBF0000-0x0000020A2DC4E000-memory.dmp
memory/1520-2583-0x0000020A2B510000-0x0000020A2B548000-memory.dmp
memory/1520-2584-0x0000020A2B450000-0x0000020A2B45E000-memory.dmp
memory/1520-2582-0x0000020A2B4C0000-0x0000020A2B502000-memory.dmp
memory/1520-2581-0x0000020A2B030000-0x0000020A2B03C000-memory.dmp
memory/1520-2579-0x0000020A2B320000-0x0000020A2B3DA000-memory.dmp
memory/1520-2613-0x0000020A2DB30000-0x0000020A2DB42000-memory.dmp
memory/1520-2578-0x0000020A2B220000-0x0000020A2B31C000-memory.dmp
memory/1520-2577-0x0000020A2B090000-0x0000020A2B11A000-memory.dmp
memory/1520-2576-0x0000020A2AAF0000-0x0000020A2AAFE000-memory.dmp
memory/1520-2572-0x0000020A11BE0000-0x0000020A11BE8000-memory.dmp
memory/1520-2653-0x0000020A29E20000-0x0000020A29F56000-memory.dmp
memory/1520-2573-0x0000020A11BD0000-0x0000020A11BDC000-memory.dmp
memory/1520-2575-0x0000020A2A780000-0x0000020A2A788000-memory.dmp
memory/1520-2690-0x0000020A29FD0000-0x0000020A29FE2000-memory.dmp
memory/1520-2840-0x0000020A2F730000-0x0000020A2F73A000-memory.dmp
memory/1520-2656-0x0000020A2B070000-0x0000020A2B082000-memory.dmp
memory/1520-2844-0x0000020A2F970000-0x0000020A2F998000-memory.dmp
memory/1520-2655-0x0000020A103B0000-0x0000020A103B9000-memory.dmp
memory/1520-2568-0x0000020A2A5B0000-0x0000020A2A5CA000-memory.dmp
memory/1520-2849-0x0000020A2FB20000-0x0000020A2FB38000-memory.dmp
memory/1520-2654-0x0000020A10360000-0x0000020A1036C000-memory.dmp
memory/1520-2600-0x0000020A2B550000-0x0000020A2B55A000-memory.dmp
memory/1520-2661-0x0000020A29D10000-0x0000020A29D18000-memory.dmp
memory/1520-2684-0x0000020A2B570000-0x0000020A2B578000-memory.dmp
memory/1520-2688-0x0000020A29F90000-0x0000020A29FA8000-memory.dmp
memory/1520-2916-0x0000020A2FAA0000-0x0000020A2FABF000-memory.dmp
memory/1520-2912-0x0000020A2FDE0000-0x0000020A2FEB4000-memory.dmp
memory/1520-2550-0x0000020A0FC40000-0x0000020A0FF46000-memory.dmp
memory/1520-2551-0x0000020A2A7B0000-0x0000020A2A928000-memory.dmp
memory/1520-2552-0x0000020A2A630000-0x0000020A2A6CA000-memory.dmp
memory/1520-2561-0x0000020A2A6D0000-0x0000020A2A76E000-memory.dmp
memory/1520-2562-0x0000020A2A930000-0x0000020A2A9E2000-memory.dmp
memory/1520-2563-0x0000020A11C50000-0x0000020A11C8C000-memory.dmp
memory/1520-2564-0x0000020A11C10000-0x0000020A11C40000-memory.dmp
memory/1520-2565-0x0000020A11C90000-0x0000020A11CB2000-memory.dmp
memory/1520-2689-0x0000020A29F80000-0x0000020A29F8E000-memory.dmp
memory/1520-2567-0x0000020A11BC0000-0x0000020A11BCE000-memory.dmp
memory/1520-2569-0x0000020A2AB20000-0x0000020A2AC24000-memory.dmp
memory/1520-2571-0x0000020A2A5F0000-0x0000020A2A618000-memory.dmp
memory/1520-2574-0x0000020A2A770000-0x0000020A2A780000-memory.dmp
memory/1520-2570-0x0000020A2A5D0000-0x0000020A2A5E4000-memory.dmp
memory/1520-2851-0x0000020A2FC40000-0x0000020A2FCF4000-memory.dmp
memory/1520-2846-0x0000020A2FAD0000-0x0000020A2FAD8000-memory.dmp
memory/1520-2850-0x0000020A2FAE0000-0x0000020A2FAEA000-memory.dmp
memory/1520-2847-0x0000020A2FAF0000-0x0000020A2FAFA000-memory.dmp
memory/1520-2848-0x0000020A2FB40000-0x0000020A2FB7E000-memory.dmp
memory/1568-2972-0x000001D54F5A0000-0x000001D54F5A9000-memory.dmp
memory/1568-2971-0x000001D54F580000-0x000001D54F58C000-memory.dmp
memory/1736-2956-0x0000000004F40000-0x0000000005001000-memory.dmp
memory/1736-2955-0x00000000056E0000-0x0000000005CE2000-memory.dmp
memory/1748-1379-0x000002660BAD0000-0x000002660BBF0000-memory.dmp
memory/2184-3021-0x0000000002AB0000-0x00000000030B2000-memory.dmp
memory/3608-472-0x000002519CAD0000-0x000002519CB2D000-memory.dmp
memory/4012-1958-0x00000000070E0000-0x0000000007102000-memory.dmp
memory/4012-1962-0x0000000008550000-0x00000000085E2000-memory.dmp
memory/4012-2750-0x0000000005DE0000-0x0000000005DF9000-memory.dmp
memory/4012-1917-0x0000000000E10000-0x0000000000E64000-memory.dmp
memory/4012-2006-0x0000000006110000-0x0000000006712000-memory.dmp
memory/4012-2005-0x0000000005DE0000-0x0000000005DF9000-memory.dmp
memory/4012-2004-0x000000000C4F0000-0x000000000C512000-memory.dmp
memory/4012-2003-0x000000000B760000-0x000000000B76C000-memory.dmp
memory/4012-1921-0x0000000005B30000-0x0000000005CA8000-memory.dmp
memory/4012-1961-0x00000000082F0000-0x00000000083AA000-memory.dmp
memory/4012-1974-0x000000000B770000-0x000000000B782000-memory.dmp
memory/4012-1973-0x000000000C480000-0x000000000C4D0000-memory.dmp
memory/4012-1937-0x0000000005EF0000-0x0000000005F42000-memory.dmp
memory/4012-1971-0x000000000C570000-0x000000000C578000-memory.dmp
memory/4012-1969-0x000000000B620000-0x000000000B658000-memory.dmp
memory/4012-1970-0x0000000008B20000-0x0000000008B2E000-memory.dmp
memory/4012-1968-0x0000000008B10000-0x0000000008B18000-memory.dmp
memory/4012-1967-0x0000000008AE0000-0x0000000008AE8000-memory.dmp
memory/4012-2751-0x0000000006110000-0x0000000006712000-memory.dmp
memory/4012-1964-0x0000000008BA0000-0x0000000009146000-memory.dmp
memory/4012-1933-0x0000000005DD0000-0x0000000005DDA000-memory.dmp
memory/4012-1960-0x0000000007910000-0x0000000007976000-memory.dmp
memory/4012-1925-0x0000000005E50000-0x0000000005EEA000-memory.dmp
memory/4012-1929-0x0000000006000000-0x0000000006104000-memory.dmp
memory/4012-1959-0x0000000007120000-0x0000000007477000-memory.dmp
memory/4012-2594-0x000000000C990000-0x000000000CA30000-memory.dmp
memory/4012-2752-0x000000000C990000-0x000000000CA30000-memory.dmp
memory/4012-1943-0x0000000006A00000-0x0000000006A14000-memory.dmp
memory/4012-1944-0x0000000006A50000-0x0000000006A78000-memory.dmp
memory/4012-1946-0x0000000006EE0000-0x0000000006EF0000-memory.dmp
memory/4012-1945-0x0000000006A40000-0x0000000006A48000-memory.dmp
memory/4012-1941-0x0000000006AC0000-0x0000000006B72000-memory.dmp
memory/4120-1989-0x0000000001560000-0x0000000001B62000-memory.dmp
memory/4120-2829-0x0000000001560000-0x0000000001B62000-memory.dmp
memory/4588-2945-0x0000000002D00000-0x0000000003302000-memory.dmp
memory/4812-3493-0x00000257C5B60000-0x00000257C5B6C000-memory.dmp
memory/4864-2892-0x00000000027F0000-0x0000000002DF2000-memory.dmp
memory/4988-2648-0x00000212C8270000-0x00000212C8280000-memory.dmp
memory/5080-2857-0x000001E0E37C0000-0x000001E0E37C8000-memory.dmp
memory/5080-2967-0x000001E0C8FE0000-0x000001E0C8FEC000-memory.dmp
memory/5080-2845-0x000001E0E35F0000-0x000001E0E362C000-memory.dmp
memory/5080-2856-0x000001E0E37B0000-0x000001E0E37B8000-memory.dmp
memory/5080-2861-0x000001E0E3840000-0x000001E0E385E000-memory.dmp
memory/5080-2869-0x000001E0E3860000-0x000001E0E386A000-memory.dmp
memory/5080-2870-0x000001E0E3DA0000-0x000001E0E3DA8000-memory.dmp
memory/5080-2970-0x000001E0E3630000-0x000001E0E364F000-memory.dmp
memory/5080-2921-0x000001E0C9250000-0x000001E0C9262000-memory.dmp
memory/5080-2969-0x000001E0E3290000-0x000001E0E3299000-memory.dmp
memory/5080-2922-0x000001E0E3290000-0x000001E0E3299000-memory.dmp
memory/5080-2923-0x000001E0E3630000-0x000001E0E364F000-memory.dmp
memory/5080-2920-0x000001E0C8FE0000-0x000001E0C8FEC000-memory.dmp
memory/5124-1385-0x00000291476D0000-0x00000291477F0000-memory.dmp
memory/5148-3033-0x0000000005410000-0x00000000054D1000-memory.dmp
memory/5148-3032-0x0000000005DB0000-0x00000000063B2000-memory.dmp
memory/5292-4567-0x0000020A949F0000-0x0000020A949FC000-memory.dmp
memory/5292-4568-0x0000020AAEF80000-0x0000020AAEF89000-memory.dmp
memory/5292-4569-0x0000020AAF080000-0x0000020AAF092000-memory.dmp
memory/5292-3792-0x0000020A949F0000-0x0000020A949FC000-memory.dmp
memory/5416-3191-0x0000018507030000-0x0000018507039000-memory.dmp
memory/5416-3189-0x0000018506F50000-0x0000018506F5C000-memory.dmp
memory/5416-3192-0x0000018521380000-0x000001852139F000-memory.dmp
memory/5416-3190-0x0000018521360000-0x0000018521372000-memory.dmp
memory/5644-2910-0x0000000005DA0000-0x00000000063A2000-memory.dmp
memory/5644-2907-0x0000000006C90000-0x0000000006CDC000-memory.dmp
memory/5644-2893-0x0000000002C80000-0x0000000002CB6000-memory.dmp
memory/5644-2894-0x0000000005770000-0x0000000005D9A000-memory.dmp
memory/5644-2897-0x00000000065B0000-0x0000000006616000-memory.dmp
memory/5644-2902-0x00000000067D0000-0x0000000006B27000-memory.dmp
memory/5644-2906-0x0000000006C70000-0x0000000006C8E000-memory.dmp
memory/5644-2911-0x0000000005480000-0x0000000005541000-memory.dmp
memory/5764-2632-0x0000023DE3C20000-0x0000023DE3C2E000-memory.dmp
memory/5892-3106-0x0000017B5EF50000-0x0000017B5EF5C000-memory.dmp
memory/5892-3034-0x0000017B5EAF0000-0x0000017B5EB22000-memory.dmp
memory/5892-3108-0x0000017B60790000-0x0000017B60799000-memory.dmp
memory/5892-3107-0x0000017B60740000-0x0000017B60752000-memory.dmp
memory/5924-554-0x000001F7FBD90000-0x000001F7FBEB0000-memory.dmp
memory/6276-6055-0x00000000033E0000-0x00000000039E2000-memory.dmp
memory/6372-6036-0x0000024EFD5B0000-0x0000024EFD5BC000-memory.dmp
memory/6576-34822-0x0000000001060000-0x0000000001662000-memory.dmp
memory/6604-34789-0x00000000053A0000-0x00000000059A2000-memory.dmp
memory/6604-34791-0x0000000004C00000-0x0000000004CC1000-memory.dmp
memory/7124-5673-0x000002802BD00000-0x000002802BD1A000-memory.dmp
memory/7372-5986-0x0000000002FC0000-0x00000000035C2000-memory.dmp
memory/7580-35088-0x0000000001670000-0x0000000001C72000-memory.dmp
memory/7580-35087-0x0000000000CF0000-0x0000000000D67000-memory.dmp
memory/7704-35051-0x0000000001080000-0x0000000001682000-memory.dmp
memory/7908-34823-0x0000000001260000-0x0000000001862000-memory.dmp
memory/7908-35094-0x0000000001260000-0x0000000001862000-memory.dmp
memory/8136-35054-0x0000000000CF0000-0x0000000000D67000-memory.dmp
memory/8136-35055-0x0000000000D70000-0x0000000001372000-memory.dmp
memory/8212-34824-0x00000000014C0000-0x0000000001AC2000-memory.dmp
memory/8212-35090-0x00000000014C0000-0x0000000001AC2000-memory.dmp
memory/8996-35077-0x0000000000CF0000-0x0000000000D67000-memory.dmp
memory/8996-35078-0x0000000001700000-0x0000000001D02000-memory.dmp
memory/9872-30578-0x00000000032B0000-0x00000000038B2000-memory.dmp