Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
ProcoreExtractsSetup.exe

Overview

General Information

Sample name:ProcoreExtractsSetup.exe
Analysis ID:1529376
MD5:01168c885557c38b6c067614371bb5bf
SHA1:ad7563bc3e9a0123d7d197b41fe60d588971ffe3
SHA256:9934c1be5b0c04809ee7ba63c62f0602028dec10766da99c2d89199b63f982e6
Infos:

Detection

Score:39
Range:0 - 100
Whitelisted:false
Confidence:20%

Compliance

Score:48
Range:0 - 100

Signatures

Reads the Security eventlog
Reads the System eventlog
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
Queries disk information (often used to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • ProcoreExtractsSetup.exe (PID: 6312 cmdline: "C:\Users\user\Desktop\ProcoreExtractsSetup.exe" MD5: 01168C885557C38B6C067614371BB5BF)
    • Installer.exe (PID: 6532 cmdline: "C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe" MD5: E73E328086CD27F5DABE17802ACF2AF8)
      • Procore ExtractsService.exe (PID: 6048 cmdline: "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" install MD5: 0DDB141358F21523C480BE734334B61B)
        • conhost.exe (PID: 416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Procore ExtractsService.exe (PID: 1748 cmdline: "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" start MD5: 0DDB141358F21523C480BE734334B61B)
        • conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Procore.Ditto.exe (PID: 3716 cmdline: "C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe" install MD5: CF0914DE88C49370CF951FFEEA446102)
  • svchost.exe (PID: 2720 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • Procore ExtractsService.exe (PID: 4324 cmdline: "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" -displayname "Procore Extracts Updater Service" -servicename "ProcoreExtractsUpdaterSvc" MD5: 0DDB141358F21523C480BE734334B61B)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
    C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Service.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
        C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dllJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
          C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exeJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
            Click to see the 3 entries

            Sigma Signatures

            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2720, ProcessName: svchost.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            Compliance

            barindex
            Uses 32bit PE files
            Source: ProcoreExtractsSetup.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            PE / OLE file has a valid certificate
            Source: ProcoreExtractsSetup.exeStatic PE information: certificate valid
            Uses secure TLS version for HTTPS connections
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49734 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49841 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49843 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:50016 version: TLS 1.2
            Contains modern PE file flags such as dynamic base (ASLR) or NX
            Source: ProcoreExtractsSetup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Binary contains paths to debug symbols
            Source: Binary string: lib/net45/Procore.Api.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdblHum` source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c1lib/net45/AWSSDK.S3.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: qlib/net45/Serilog.Sinks.File.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Uninstaller\bin\Release\Uninstaller.pdb4 source: ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.Linq.pdbSHA256$ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Development\Simple Injector\SimpleInjector\src\SimpleInjector\obj\Release\net45\SimpleInjector.pdbSHA256 source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Options/Options/src/obj/Release/netstandard2.0/Microsoft.Extensions.Options.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.DITTO.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: ilib/net45/Procore.DB.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.Logging/obj/Release/net462/LaunchDarkly.Logging.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Oop/obj/Release/net461/Nito.AsyncEx.Oop.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.Wpf.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A73000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly/release_net462/Polly.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000E1E9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: ,_clib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ,_clib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Setup\bin\Release\Setup.pdb; source: ProcoreExtractsSetup.exe, 00000000.00000002.3598097698.0000000000540000.00000002.00000001.01000000.00000003.sdmp, ProcoreExtractsSetup.exe, 00000000.00000000.1734862924.0000000000540000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qTC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Oop/obj/Release/net461/Nito.AsyncEx.Oop.pdbSHA256k source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorConvertersWpf\obj\Release\net47\SharpVectors.Converters.Wpf.pdb source: Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BC6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/net471\System.Threading.Overlapped.pdbR7l7 ^7_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/net471\System.Threading.Overlapped.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: llib/net45/Procore.Ditto.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Services\S3\obj\AWSSDK.S3.Net45\Release\net45\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Development\Simple Injector\SimpleInjector\src\SimpleInjector\obj\Release\net45\SimpleInjector.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/net471\System.Xml.XPath.XDocument.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125B3000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Disposables/obj/Release/net461/Nito.Disposables.pdbSHA256N source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: Installer.exe, 00000001.00000002.3816033059.00000000124E7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Microsoft.Data.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.Data.Sqlite.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: @\^q lib/net45/Serilog.Sinks.File.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Tasks/obj/Release/net461/Nito.AsyncEx.Tasks.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/net471\System.Runtime.Serialization.Primitives.pdb.8H8 :8_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/net471\System.Net.Sockets.pdb`-z- l-_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c:\Build\bcde262d57a50c3c\working\Core.Net_4_5\obj\Release\Remotion.Linq.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C901000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Context/obj/Release/net461/Nito.AsyncEx.Context.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdbOGP source: Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/AWSSDK.S3.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA2562 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\Procore.NET\Procore.NET\src\Procore.Api\obj\Release\net462\Procore.Api.pdbSHA256uR source: Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Cancellation/obj/Release/net461/Nito.Cancellation.pdbSHA256g source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.Linq.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q]C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRenderingGdi\obj\Release\net47\SharpVectors.Rendering.Gdi.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000229B5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Updater\bin\Release\Updater.pdbP source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI/src/obj/Release/net461/Microsoft.Extensions.DependencyInjection.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/net471\System.Net.Sockets.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorModel\obj\Release\net47\SharpVectors.Model.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Serilog/obj/Release/net46/Serilog.pdb source: Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.EventSource/obj/Release/net462/LaunchDarkly.EventSource.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.DB.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\AWSSDK.Core.pdb\ source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022C7D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qVC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Context/obj/Release/net461/Nito.AsyncEx.Context.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdblHumt source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\Microsoft.Expression.Interactions\Win32\Release\Microsoft.Expression.Interactions.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qPolly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.InternalSdk/obj/Release/net462/LaunchDarkly.InternalSdk.pdbSHA256{ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001259E000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/net471\System.Security.SecureString.pdb/(I( ;(_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012524000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Serilog.Sinks.File.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Sqlite.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat\bin\Release\Bobcat.pdbl source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib/net45/Serilog.Sinks.File.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.DotNet.PlatformAbstractions\net45\Microsoft.DotNet.PlatformAbstractions.pdbSHA256. source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\Procore.NET\Procore.NET\src\Procore.Api\obj\Release\net462\Procore.Api.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Serilog/obj/Release/net46/Serilog.pdbSHA256 source: Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.Logging/obj/Release/net462/LaunchDarkly.Logging.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Abstractions/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Binder/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Binder.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000124E7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Interop.WaitHandles/obj/Release/net461/Nito.AsyncEx.Interop.WaitHandles.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.DotNet.PlatformAbstractions\net45\Microsoft.DotNet.PlatformAbstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Mvvm.Core/obj/Release/net461/Nito.Mvvm.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/net471\System.Security.SecureString.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012524000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net471\System.IO.Compression.pdb^W source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/POLLY.CORE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.DB\obj\Release\net471\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Options/Options/src/obj/Release/netstandard2.0/Microsoft.Extensions.Options.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Sqlite.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Interactive.Async.pdbSHA256C source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/net471\System.Diagnostics.Tracing.pdb(MBM 4M_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.DB\obj\Release\net471\Procore.DB.pdbSHA256% source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdbSHA256{ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.WinForms.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net471\System.Security.Cryptography.Algorithms.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.TimeProvider/Release/net462/Microsoft.Bcl.TimeProvider.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Binder/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Binder.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Primitives/src/obj/Release/netstandard2.0/Microsoft.Extensions.Primitives.pdbSHA256T source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Mvvm.Core/obj/Release/net461/Nito.Mvvm.Core.pdbSHA256/ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Uninstaller\bin\Release\Uninstaller.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.Wpf.pdbe source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A73000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Disposables/obj/Release/net461/Nito.Disposables.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: .pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/future/Nito.Mvvm.Async/obj/Release/net461/Nito.Mvvm.Async.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdbSHA256;@ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdbSHA256_58 source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qVC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.pdbX source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib\net45\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat\bin\Release\Bobcat.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Abstractions/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Abstractions.pdbSHA256g@ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdblHum(j source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\bugsnag-dotnet\src\Bugsnag\obj\Release\net45\Bugsnag.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Services\S3\obj\AWSSDK.S3.Net45\Release\net45\AWSSDK.S3.pdbSHA256 source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\serilog-sinks-file\src\Serilog.Sinks.File\obj\Release\net45\Serilog.Sinks.File.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/net471\System.Globalization.Extensions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net471\System.IO.Compression.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /private/tmp/releaser-project/src/LaunchDarkly.ClientSdk/obj/Release/netstandard2.0/LaunchDarkly.ClientSdk.pdbSHA256'= source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly/release_net462/Polly.pdbSHA256P source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: *lib/net45/AWSSDK.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCss\obj\Release\net47\SharpVectors.Css.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/net471\System.Globalization.Extensions.pdbv1 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.Extensions.DependencyModel\net451\Microsoft.Extensions.DependencyModel.pdbSHA256n source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qPC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c:\Build\bcde262d57a50c3c\working\Core.Net_4_5\obj\Release\Remotion.Linq.pdbx source: Installer.exe, 00000001.00000002.3838061955.000000001C901000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI/src/obj/Release/net461/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Setup\bin\Release\Setup.pdb source: ProcoreExtractsSetup.exe, 00000000.00000002.3598097698.0000000000540000.00000002.00000001.01000000.00000003.sdmp, ProcoreExtractsSetup.exe, 00000000.00000000.1734862924.0000000000540000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.InternalSdk/obj/Release/net462/LaunchDarkly.InternalSdk.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Tasks/obj/Release/net461/Nito.AsyncEx.Tasks.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qUC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.EventSource/obj/Release/net462/LaunchDarkly.EventSource.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Relational/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Relational.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q!/LIB/NET45/SERILOG.SINKS.FILE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q!/lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCore\obj\Release\net47\SharpVectors.Core.pdb source: Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRuntimeWpf\obj\Release\net47\SharpVectors.Runtime.Wpf.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Humanizer.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Installer\bin\Release\Installer.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: lib\net45\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/net471\System.Diagnostics.StackTrace.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/net471\System.Diagnostics.Tracing.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.Ditto\obj\Release\Procore.Ditto.pdb< source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: @\^q lib/net45/Serilog.Sinks.File.pdblHumDy source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Q]hlib/net45/Procore.Api.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly.Core/release_net462/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Memory/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Memory.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.API.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qXC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: 2~elib/net45/Polly.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Microsoft.Data.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.Data.Sqlite.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Design/obj/Release/net461/Microsoft.EntityFrameworkCore.Design.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.Ditto\obj\Release\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdblHumD] source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Memory/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Memory.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Service\bin\Release\Service.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.TimeProvider/Release/net462/Microsoft.Bcl.TimeProvider.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.pdb source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/net471\System.Data.Common.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000009725000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022C7D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Core\obj\AWSSDK.Core.Net45\Release\net45\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.CommonSdk/obj/Release/net462/LaunchDarkly.CommonSdk.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Cancellation/obj/Release/net461/Nito.Cancellation.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Design/obj/Release/net461/Microsoft.EntityFrameworkCore.Design.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/net471\System.Runtime.Serialization.Primitives.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.Extensions.DependencyModel\net451\Microsoft.Extensions.DependencyModel.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Primitives/src/obj/Release/netstandard2.0/Microsoft.Extensions.Primitives.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Interop.WaitHandles/obj/Release/net461/Nito.AsyncEx.Interop.WaitHandles.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\bugsnag-dotnet\src\Bugsnag\obj\Release\net45\Bugsnag.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\net471\System.Net.Http.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/AWSSDK.CORE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Humanizer.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCss\obj\Release\net47\SharpVectors.Css.pdb~ source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Relational/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Relational.pdbSHA2566 source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qUC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/future/Nito.Mvvm.Async/obj/Release/net461/Nito.Mvvm.Async.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRenderingWpf\obj\Release\net47\SharpVectors.Rendering.Wpf.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /private/tmp/releaser-project/src/LaunchDarkly.ClientSdk/obj/Release/netstandard2.0/LaunchDarkly.ClientSdk.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.CommonSdk/obj/Release/net462/LaunchDarkly.CommonSdk.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\serilog-sinks-file\src\Serilog.Sinks.File\obj\Release\net45\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Updater\bin\Release\Updater.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Core\obj\AWSSDK.Core.Net45\Release\net45\AWSSDK.Core.pdbSHA256o source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/POLLY.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.pdbSHA256} source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Interactive.Async.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorDom\obj\Release\net47\SharpVectors.Dom.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly.Core/release_net462/Polly.Core.pdbSHA256 source: Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmp
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Bobcat\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\Jump to behavior

            Networking

            barindex
            Yara detected Generic Downloader
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Service.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dll, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe, type: DROPPED
            Source: Yara matchFile source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe, type: DROPPED
            Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3eBugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:01:31.6130775ZHost: sessions.bugsnag.comContent-Length: 423Expect: 100-continueConnection: Close
            Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3eBugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:01:37.0536863ZHost: sessions.bugsnag.comContent-Length: 423Expect: 100-continueConnection: Close
            Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3eBugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:02:37.6169102ZHost: sessions.bugsnag.comContent-Length: 423Expect: 100-continueConnection: Close
            Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3eBugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:02:37.9298881ZHost: sessions.bugsnag.comContent-Length: 423Expect: 100-continueConnection: Close
            Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: a7aa9e13b7225d9c99432a4d24614565Bugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:03:39.5921676ZHost: sessions.bugsnag.comContent-Length: 421Expect: 100-continueConnection: Close
            Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: sessions.bugsnag.com
            Source: unknownHTTP traffic detected: POST / HTTP/1.1Content-Type: application/jsonBugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3eBugsnag-Payload-Version: 1.0Bugsnag-Sent-At: 2024-10-08T21:01:31.6130775ZHost: sessions.bugsnag.comContent-Length: 423Expect: 100-continueConnection: Close
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://.css
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://.jpg
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://169.254.169.254
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://169.254.170.2
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://169.254.170.2aUnable
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertCSRSA4096RootG5.crt0E
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000002.3600986979.0000000001930000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA2.crt0
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertCSRSA4096RootG5.crl0
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000002.3600986979.0000000001930000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0F
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0K
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA2.crl0=
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.html
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000002.3600986979.0000000001930000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000002.3600986979.0000000001930000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0I
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0K
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s.symcb.com/universal-root.crl0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s.symcd.com06
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s3.amazonaws.com/doc/2006-03-01/
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sharpvectors.codeplex.com/runtime/
            Source: Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BC6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sharpvectors.codeplex.com/svgc/
            Source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sqlite.org/rescode.html
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000002.3600986979.0000000001930000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/language-subtag-registry
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc2045.txt
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.ietf.org/rfc/rfc3066.txt
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/rfc/bcp/bcp47.txt
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.xmlspy.com)
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/binaryformatter
            Source: Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/dotnet-warnings/
            Source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://clientstream.launchdarkly.comEhttps://clientsdk.launchdarkly.com?https://mobile.launchdarkly
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125DC000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.000000000513E000.00000004.08000000.00040000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0.
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.html
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://ecrion-test.procoretech.com/pdf/create
            Source: Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://ecrion.procoretech.com/pdf/create
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/App-vNext/Polly
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/App-vNext/Polly0
            Source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Humanizr/Humanizer
            Source: Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Humanizr/Humanizer2
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/JamesNK/Newtonsoft.Json
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/AsyncEx
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/AsyncEx5
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/AsyncExG
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Cancellation
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Deque
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Deque2
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Disposables
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/StephenCleary/Mvvm
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/EntityFrameworkCore
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/EntityFrameworkCore.
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/EntityFrameworkCore/tree/01da710cdeff0431fc60379580aa63f335fbc165
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/aspnet/Extensions/tree/9bc79b2f25a3724376d7af19617c33749a30ea3a
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/bugsnag/bugsnag-net
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/core-setup/tree/caa7b7e2bad98e56a687fb5cbaf60825500800f7
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/core-setup/tree/caa7b7e2bad98e56a687fb5cbaf60825500800f78
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/reactive
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/reactive0
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/reactivey
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/runtime
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/runtime&
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/runtime8
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/dotnet/runtimeH
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/launchdarkly/dotnet-eventsource
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/launchdarkly/dotnet-sdk-common
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/launchdarkly/dotnet-sdk-common?
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/launchdarkly/dotnet-sdk-internal
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/launchdarkly/dotnet-sdk-internalR
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mono/linker/issues/1416.
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/procore/Procore.NET
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/serilog/serilog-sinks-file
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/serilog/serilog-sinks-fileC
            Source: Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/serilog/serilog/pull/819.
            Source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ip-ranges.amazonaws.com/ip-ranges.json
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://notify.bugsnag.com8https://sessions.bugsnag.com
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://notify.bugsnag.com9https://sessions.bugsnag.com
            Source: Installer.exe, 00000001.00000002.3816033059.00000000127F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://procore-ditto.s3.amazonaws.com/RELEASES
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/App-vNext/Polly/a2559b1ab7bf9c1e12c71183ce2dfa937bc9c7a6/
            Source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/aws/aws-sdk-net/4166a61afde54a8bbe723fbb936afa39716f97a0/
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/procore/Procore.NET/3394502880c4bcecca16039ac5fa16a9992342c7/
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/procore/ditto/d46178350f469016b7d8342b9e0a0683eeca7004/
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/serilog/serilog-sinks-file/7eb21bd4d35d0b8b7d13e6a15851c9903ea9a46
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s3-fips.dualstack.
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s3-fips.dualstack.us-east-1.
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s3-fips.us-east-1.
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s3.dualstack.
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://s3.dualstack.us-east-1.
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/asmld
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/coll1.
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/collections
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/depr3.
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/depr3.%
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/depr3.-
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diaal
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diadt
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diadt:
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diagnostics
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/dialm
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diasc
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diasc3
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diasr
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diasr4
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diatl
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diatlD
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diaut
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/diaut8
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/locked
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/one-constructor
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/ovrrd.
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/ovrrd.;Container.Collection.Register#Container.Options9AllowOverridingReg
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/scoped
            Source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://simpleinjector.org/scoped.
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sketchapp.com
            Source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000126B1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125C7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000292F000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012605000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001262E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012642000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.launchdarkly.com/0
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/json
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.newtonsoft.com/jsonschema
            Source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Amazon.Extensions.S3.Encryption
            Source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.procore.com/legal/privacy
            Source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.procore.com/legal/terms-of-service
            Source: unknownNetwork traffic detected: HTTP traffic on port 49841 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
            Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49841
            Source: unknownNetwork traffic detected: HTTP traffic on port 50016 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50016
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
            Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49734 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49738 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49841 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:49843 version: TLS 1.2
            Source: unknownHTTPS traffic detected: 35.190.88.7:443 -> 192.168.2.4:50016 version: TLS 1.2

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Reads the Security eventlog
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ProcoreExtractsUpdaterSvc
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security\ProcoreExtractsUpdaterSvc
            Reads the System eventlog
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeKey opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System
            Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
            Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe 80744AF72D0D40A3BE6B1D51D7FECB81EDA52B7D40198507B4B98DBF2A04D3AD
            Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exe 628F5A5ED91E7A119C1EB843EE0BF51564F068197EB20F991569D1DE574771CE
            Source: Joe Sandbox ViewDropped File: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exe 752C4FB21A0D4BF84DE33AC08A708DCE2CC328A4EEB150D006C313D73AEF14A6
            Source: ProcoreExtractsSetup.exeStatic PE information: Resource name: DATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUpdater.exe0 vs ProcoreExtractsSetup.exe
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUpdater.exe0 vs ProcoreExtractsSetup.exe
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameUninstaller.exe8 vs ProcoreExtractsSetup.exe
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameService.exe> vs ProcoreExtractsSetup.exe
            Source: ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameInstaller.exe4 vs ProcoreExtractsSetup.exe
            Source: ProcoreExtractsSetup.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: classification engineClassification label: sus39.troj.evad.winEXE@13/201@1/2
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore TechnologiesJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Procore ExtractsService.exe.logJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMutant created: \BaseNamedObjects\Global\netfxeventlog.1.0
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:416:120:WilError_03
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeFile created: C:\Users\user\AppData\Local\Temp\BobcatJump to behavior
            Source: ProcoreExtractsSetup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT COUNT(*) FROM "sqlite_master" WHERE "type" = 'table' AND "rootpage" IS NOT NULL;
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT ProcessId, ExecutablePath, CommandLine FROM Win32_Process;Management Object Cast Failed
            Source: Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
            Source: unknownProcess created: C:\Users\user\Desktop\ProcoreExtractsSetup.exe "C:\Users\user\Desktop\ProcoreExtractsSetup.exe"
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe "C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe"
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" install
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" start
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" -displayname "Procore Extracts Updater Service" -servicename "ProcoreExtractsUpdaterSvc"
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe" install
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe "C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe"Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" installJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" startJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe" installJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: version.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dwrite.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: msvcp140_clr0400.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dwmapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: d3d9.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: d3d10warp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: windowscodecs.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: winsta.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dataexchange.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: d3d11.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dcomp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dxgi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: textshaping.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: dxcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: winmm.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: textinputframework.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: coreuicomponents.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: wintypes.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: msctfui.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: uiautomationcore.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: d3dcompiler_47.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: edputil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: windows.staterepositoryps.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: appresolver.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: bcp47langs.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: slc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: sppc.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: version.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasapi32.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasman.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rtutils.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mswsock.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winhttp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: iphlpapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc6.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dnsapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winnsi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasadhlp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: fwpuclnt.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: schannel.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mskeyprotect.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ntasn1.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncrypt.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncryptsslp.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mscoree.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: windows.storage.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: wldp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: profapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptsp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rsaenh.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: cryptbase.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasapi32.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasman.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rtutils.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winhttp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dhcpcsvc.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: winnsi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: fwpuclnt.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: sspicli.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: schannel.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: mskeyprotect.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ntasn1.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncrypt.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: ncryptsslp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeSection loaded: gpapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: mscoree.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: apphelp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: kernel.appcore.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: version.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: vcruntime140_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ucrtbase_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: uxtheme.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: cryptsp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: rsaenh.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: cryptbase.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: dwrite.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: msvcp140_clr0400.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: windows.storage.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: wldp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: profapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: wbemcomn.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: amsi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: userenv.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: rasapi32.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: rasman.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: rtutils.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: mswsock.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: winhttp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ondemandconnroutehelper.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: iphlpapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: dhcpcsvc.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: dnsapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: winnsi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: rasadhlp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: fwpuclnt.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: secur32.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: sspicli.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: schannel.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: mskeyprotect.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ntasn1.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ncrypt.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: ncryptsslp.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: msasn1.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeSection loaded: gpapi.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: ProcoreExtractsSetup.exeStatic PE information: certificate valid
            Source: ProcoreExtractsSetup.exeStatic file information: File size 15481400 > 1048576
            Source: ProcoreExtractsSetup.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xe7c800
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: ProcoreExtractsSetup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: ProcoreExtractsSetup.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: lib/net45/Procore.Api.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdblHum` source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c1lib/net45/AWSSDK.S3.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: qlib/net45/Serilog.Sinks.File.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb62P2 B2_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Uninstaller\bin\Release\Uninstaller.pdb4 source: ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.Linq.pdbSHA256$ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Development\Simple Injector\SimpleInjector\src\SimpleInjector\obj\Release\net45\SimpleInjector.pdbSHA256 source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Options/Options/src/obj/Release/netstandard2.0/Microsoft.Extensions.Options.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.DITTO.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: ilib/net45/Procore.DB.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.Logging/obj/Release/net462/LaunchDarkly.Logging.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Oop/obj/Release/net461/Nito.AsyncEx.Oop.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.Wpf.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A73000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly/release_net462/Polly.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000E1E9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: ,_clib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ,_clib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Setup\bin\Release\Setup.pdb; source: ProcoreExtractsSetup.exe, 00000000.00000002.3598097698.0000000000540000.00000002.00000001.01000000.00000003.sdmp, ProcoreExtractsSetup.exe, 00000000.00000000.1734862924.0000000000540000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\net46\System.Diagnostics.DiagnosticSource.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qTC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Oop/obj/Release/net461/Nito.AsyncEx.Oop.pdbSHA256k source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorConvertersWpf\obj\Release\net47\SharpVectors.Converters.Wpf.pdb source: Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BC6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/net471\System.Threading.Overlapped.pdbR7l7 ^7_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Threading.Overlapped/net471\System.Threading.Overlapped.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: llib/net45/Procore.Ditto.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Services\S3\obj\AWSSDK.S3.Net45\Release\net45\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Development\Simple Injector\SimpleInjector\src\SimpleInjector\obj\Release\net45\SimpleInjector.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Xml.XPath.XDocument/net471\System.Xml.XPath.XDocument.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125B3000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Disposables/obj/Release/net461/Nito.Disposables.pdbSHA256N source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.00000000029E4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdbBSJB source: Installer.exe, 00000001.00000002.3816033059.00000000124E7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Microsoft.Data.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.Data.Sqlite.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: @\^q lib/net45/Serilog.Sinks.File.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Tasks/obj/Release/net461/Nito.AsyncEx.Tasks.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/net471\System.Runtime.Serialization.Primitives.pdb.8H8 :8_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/net471\System.Net.Sockets.pdb`-z- l-_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c:\Build\bcde262d57a50c3c\working\Core.Net_4_5\obj\Release\Remotion.Linq.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C901000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Context/obj/Release/net461/Nito.AsyncEx.Context.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdbOGP source: Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/AWSSDK.S3.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdbSHA2562 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\Procore.NET\Procore.NET\src\Procore.Api\obj\Release\net462\Procore.Api.pdbSHA256uR source: Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Cancellation/obj/Release/net461/Nito.Cancellation.pdbSHA256g source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.Linq.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q]C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRenderingGdi\obj\Release\net47\SharpVectors.Rendering.Gdi.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000229B5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Updater\bin\Release\Updater.pdbP source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI/src/obj/Release/net461/Microsoft.Extensions.DependencyInjection.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Net.Sockets/net471\System.Net.Sockets.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorModel\obj\Release\net47\SharpVectors.Model.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Serilog/obj/Release/net46/Serilog.pdb source: Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.EventSource/obj/Release/net462/LaunchDarkly.EventSource.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.DB.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\AWSSDK.Core.pdb\ source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Collections.Immutable/net461-Release/System.Collections.Immutable.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022C7D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qVC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Context/obj/Release/net461/Nito.AsyncEx.Context.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdblHumt source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\Microsoft.Expression.Interactions\Win32\Release\Microsoft.Expression.Interactions.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qPolly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.InternalSdk/obj/Release/net462/LaunchDarkly.InternalSdk.pdbSHA256{ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: e:\ExpressionRTM\Sparkle\SDK\BlendWPFSDK\Build\Intermediate\Release\Libraries\System.Windows.Interactivity\Win32\Release\System.Windows.Interactivity.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001259E000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/net471\System.Security.SecureString.pdb/(I( ;(_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012524000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Serilog.Sinks.File.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Sqlite.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat\bin\Release\Bobcat.pdbl source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib/net45/Serilog.Sinks.File.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.DotNet.PlatformAbstractions\net45\Microsoft.DotNet.PlatformAbstractions.pdbSHA256. source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdbSHA2567 source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\Procore.NET\Procore.NET\src\Procore.Api\obj\Release\net462\Procore.Api.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.DependencyInjection.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Serilog/obj/Release/net46/Serilog.pdbSHA256 source: Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.Logging/obj/Release/net462/LaunchDarkly.Logging.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Abstractions/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Binder/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Binder.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000124E7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Interop.WaitHandles/obj/Release/net461/Nito.AsyncEx.Interop.WaitHandles.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.DotNet.PlatformAbstractions\net45\Microsoft.DotNet.PlatformAbstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Mvvm.Core/obj/Release/net461/Nito.Mvvm.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Security.SecureString/net471\System.Security.SecureString.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012524000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net471\System.IO.Compression.pdb^W source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/POLLY.CORE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.DB\obj\Release\net471\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Options/Options/src/obj/Release/netstandard2.0/Microsoft.Extensions.Options.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Sqlite.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Interactive.Async.pdbSHA256C source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/net471\System.Diagnostics.Tracing.pdb(MBM 4M_CorDllMainmscoree.dll source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.DB\obj\Release\net471\Procore.DB.pdbSHA256% source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdbSHA256{ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.WinForms.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net471\System.Security.Cryptography.Algorithms.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.TimeProvider/Release/net462/Microsoft.Bcl.TimeProvider.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config.Binder/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.Binder.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Primitives/src/obj/Release/netstandard2.0/Microsoft.Extensions.Primitives.pdbSHA256T source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Mvvm.Core/obj/Release/net461/Nito.Mvvm.Core.pdbSHA256/ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Uninstaller\bin\Release\Uninstaller.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1745884336.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net45\Microsoft.Web.WebView2.Wpf.pdbe source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A73000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Disposables/obj/Release/net461/Nito.Disposables.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: .pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/future/Nito.Mvvm.Async/obj/Release/net461/Nito.Mvvm.Async.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Collections.Deque/obj/Release/net461/Nito.Collections.Deque.pdbSHA256;@ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdbSHA256_58 source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qVC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.pdbX source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q lib\net45\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat\bin\Release\Bobcat.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Abstractions/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Abstractions.pdbSHA256g@ source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdblHum(j source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\bugsnag-dotnet\src\Bugsnag\obj\Release\net45\Bugsnag.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Services\S3\obj\AWSSDK.S3.Net45\Release\net45\AWSSDK.S3.pdbSHA256 source: Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\serilog-sinks-file\src\Serilog.Sinks.File\obj\Release\net45\Serilog.Sinks.File.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/net471\System.Globalization.Extensions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net471\System.IO.Compression.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /private/tmp/releaser-project/src/LaunchDarkly.ClientSdk/obj/Release/netstandard2.0/LaunchDarkly.ClientSdk.pdbSHA256'= source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly/release_net462/Polly.pdbSHA256P source: Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /lib/net45/Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: *lib/net45/AWSSDK.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.DB.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Polly.Core.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCss\obj\Release\net47\SharpVectors.Css.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Globalization.Extensions/net471\System.Globalization.Extensions.pdbv1 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.Extensions.DependencyModel\net451\Microsoft.Extensions.DependencyModel.pdbSHA256n source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qPC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Reactive.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: c:\Build\bcde262d57a50c3c\working\Core.Net_4_5\obj\Release\Remotion.Linq.pdbx source: Installer.exe, 00000001.00000002.3838061955.000000001C901000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000223E1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/DependencyInjection/DI/src/obj/Release/net461/Microsoft.Extensions.DependencyInjection.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Setup\bin\Release\Setup.pdb source: ProcoreExtractsSetup.exe, 00000000.00000002.3598097698.0000000000540000.00000002.00000001.01000000.00000003.sdmp, ProcoreExtractsSetup.exe, 00000000.00000000.1734862924.0000000000540000.00000002.00000001.01000000.00000003.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.InternalSdk/obj/Release/net462/LaunchDarkly.InternalSdk.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Tasks/obj/Release/net461/Nito.AsyncEx.Tasks.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qUC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.EventSource/obj/Release/net462/LaunchDarkly.EventSource.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Procore.DB.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Relational/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Relational.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q!/LIB/NET45/SERILOG.SINKS.FILE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdb4Hum, source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^q!/lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCore\obj\Release\net47\SharpVectors.Core.pdb source: Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Coordination/obj/Release/net461/Nito.AsyncEx.Coordination.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRuntimeWpf\obj\Release\net47\SharpVectors.Runtime.Wpf.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Humanizer.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Installer\bin\Release\Installer.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1737558192.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp
            Source: Binary string: lib\net45\AWSSDK.S3.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/net461-Release/Microsoft.Bcl.AsyncInterfaces.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.StackTrace/net471\System.Diagnostics.StackTrace.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Diagnostics.Tracing/net471\System.Diagnostics.Tracing.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.Ditto\obj\Release\Procore.Ditto.pdb< source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Ditto.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: @\^q lib/net45/Serilog.Sinks.File.pdblHumDy source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Q]hlib/net45/Procore.Api.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly.Core/release_net462/Polly.Core.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Memory/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Memory.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/PROCORE.API.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qXC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.Core.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.Abstractions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: 2~elib/net45/Polly.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Microsoft.Data.Sqlite.Core/obj/Release/netstandard2.0/Microsoft.Data.Sqlite.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Design/obj/Release/net461/Microsoft.EntityFrameworkCore.Design.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\ditto\ditto\src\Procore.Ditto\obj\Release\Procore.Ditto.pdb source: Installer.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Encodings.Web/net461-Release/System.Text.Encodings.Web.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.Core.pdblHumD] source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Polly.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Caching/Memory/src/obj/Release/netstandard2.0/Microsoft.Extensions.Caching.Memory.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Service\bin\Release\Service.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1744253101.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Microsoft.Bcl.TimeProvider/Release/net462/Microsoft.Bcl.TimeProvider.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.pdb source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Data.Common/net471\System.Data.Common.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000009725000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022C7D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Core\obj\AWSSDK.Core.Net45\Release\net45\AWSSDK.Core.pdb source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.CommonSdk/obj/Release/net462/LaunchDarkly.CommonSdk.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.Cancellation/obj/Release/net461/Nito.Cancellation.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Design/obj/Release/net461/Microsoft.EntityFrameworkCore.Design.pdbSHA256 source: Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.Runtime.Serialization.Primitives/net471\System.Runtime.Serialization.Primitives.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\2870\s\core-setup\Bin\obj\win-x64.Release\Microsoft.Extensions.DependencyModel\net451\Microsoft.Extensions.DependencyModel.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Primitives/src/obj/Release/netstandard2.0/Microsoft.Extensions.Primitives.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Nito.AsyncEx.Interop.WaitHandles/obj/Release/net461/Nito.AsyncEx.Interop.WaitHandles.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdblHum source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\bugsnag-dotnet\src\Bugsnag\obj\Release\net45\Bugsnag.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: E:\A\_work\1795\s\corefx\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\net471\System.Net.Http.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012481000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Procore.Api.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/AWSSDK.CORE.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: Humanizer.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Configuration/Config/src/obj/Release/netstandard2.0/Microsoft.Extensions.Configuration.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorCss\obj\Release\net47\SharpVectors.Css.pdb~ source: Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000225D9000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore.Relational/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.Relational.pdbSHA2566 source: Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: $^qUC:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.pdb source: Installer.exe, 00000001.00000002.3816033059.00000000128AB000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/Logging/Logging.Abstractions/src/obj/Release/netstandard2.0/Microsoft.Extensions.Logging.Abstractions.pdbSHA256 source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/future/Nito.Mvvm.Async/obj/Release/net461/Nito.Mvvm.Async.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorRenderingWpf\obj\Release\net47\SharpVectors.Rendering.Wpf.pdb source: Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /private/tmp/releaser-project/src/LaunchDarkly.ClientSdk/obj/Release/netstandard2.0/LaunchDarkly.ClientSdk.pdb source: Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/AWSSDK.S3.pdbPK source: ProcoreExtractsSetup.exe, 00000000.00000003.1742911929.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /tmp/project-releaser/project/src/LaunchDarkly.CommonSdk/obj/Release/net462/LaunchDarkly.CommonSdk.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/System.Text.Json/net461-Release/System.Text.Json.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\commandline\src\CommandLine\obj\Release\net461\CommandLine.pdb source: Installer.exe, 00000001.00000002.3652221269.0000000008AB6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.000000000437C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib\net45\Polly.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\projects\serilog-sinks-file\src\Serilog.Sinks.File\obj\Release\net45\Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\a\bobcat\bobcat\src\Bobcat.Updater\bin\Release\Updater.pdb source: ProcoreExtractsSetup.exe, 00000000.00000003.1747313892.000000000192C000.00000004.00000020.00020000.00000000.sdmp, ProcoreExtractsSetup.exe, 00000000.00000003.1747187814.000000000191F000.00000004.00000020.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: C:\codebuild\tmp\output\src1425384090\src\aws-sdk-net\sdk\src\Core\obj\AWSSDK.Core.Net45\Release\net45\AWSSDK.Core.pdbSHA256o source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /LIB/NET45/POLLY.PDB source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/src/EFCore/obj/Release/netstandard2.0/Microsoft.EntityFrameworkCore.pdbSHA256} source: Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: lib/net45/Serilog.Sinks.File.pdb source: Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: System.Interactive.Async.pdb source: Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022D6D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022CD1000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: D:\Visual Studio\Workspaces\SharpVectors\Source\SharpVectorDom\obj\Release\net47\SharpVectors.Dom.pdb source: Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp
            Source: Binary string: /_/artifacts/obj/Polly.Core/release_net462/Polly.Core.pdbSHA256 source: Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmp
            Source: ProcoreExtractsSetup.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: ProcoreExtractsSetup.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: ProcoreExtractsSetup.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: ProcoreExtractsSetup.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: ProcoreExtractsSetup.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: Procore.Api.dll.1.drStatic PE information: 0xBD472A22 [Mon Aug 18 03:21:06 2070 UTC]
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Model.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bugsnag.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Relational.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ComponentModel.Annotations.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Runtime.Serialization.Primitives.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\af\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-Hans\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\lv\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ro\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.Cryptography.Algorithms.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pl\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\tr\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sk\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Buffers.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.Tracing.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Windows.Interactivity.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Oop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\bg\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\de\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SimpleInjector.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hu\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\it-IT\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Css.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-CA\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.StackTrace.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-GB\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\cs\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Dom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x64\e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-CN\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-AU\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Collections.Deque.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-CA\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Primitives.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x64\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.EventSource.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\he\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x86\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\el\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ku\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sv\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Tasks.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\is-IS\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sr-Latn\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ar\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\is\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Numerics.Vectors.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es-MX\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.ClientSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Encodings.Web.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Abstractions.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeFile created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Xml.XPath.XDocument.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\th-TH\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\CommandLine.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Coordination.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Remotion.Linq.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Binder.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hy\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.InternalSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ja-JP\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uz-Cyrl-UZ\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Async.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ru\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ms-MY\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.CommonSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.DotNet.PlatformAbstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-FR\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-Hant\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Globalization.Extensions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\mt\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Context.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-arm64\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeFile created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Service.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.Linq.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Converters.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uk\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uz-Latn-UZ\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Sockets.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.AsyncInterfaces.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pt\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Overlapped.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeFile created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\id\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x86\e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\it\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ko-KR\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fi-FI\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.TimeProvider.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Gdi.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-US\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ValueTuple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\de-DE\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Interactive.Async.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\th-TH\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hr\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Collections.Immutable.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.SecureString.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nb-NO\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Sqlite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nb\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Humanizer.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_v2.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Memory.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Disposables.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sl\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyModel.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\az\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Memory.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es-ES\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.WinForms.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fa\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.DiagnosticSource.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Cancellation.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Design.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Data.Sqlite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Runtime.Wpf.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeFile created: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.IO.Compression.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-BE\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.Logging.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Expression.Interactions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pt-BR\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\da\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Data.Common.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\vi\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Options.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ja\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nl\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sr\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.provider.e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\bn-BD\Humanizer.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Interop.WaitHandles.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ko-KR\Procore.Ditto.resources.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Tasks.Extensions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_green.dllJump to dropped file
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ProcoreExtractsUpdaterSvcJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: C10000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: 27E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: 47E0000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: 8780000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: 9780000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: D230000 memory reserve | memory write watchJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: E230000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 1090000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 2AB0000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 29F0000 memory reserve | memory write watchJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 1530000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 3000000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 2D50000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 19E0000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 2080000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeMemory allocated: 4080000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeMemory allocated: 1D05C420000 memory reserve | memory write watch
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeMemory allocated: 1D075DB0000 memory reserve | memory write watch
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeWindow / User API: threadDelayed 358Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeWindow / User API: threadDelayed 610Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeWindow / User API: threadDelayed 525
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Runtime.CompilerServices.Unsafe.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Model.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bugsnag.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Relational.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ComponentModel.Annotations.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.Cryptography.Algorithms.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Buffers.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.Tracing.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Oop.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Windows.Interactivity.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SimpleInjector.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Css.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.StackTrace.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Dom.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x64\e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Collections.Deque.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.EventSource.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x64\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x86\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Tasks.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Numerics.Vectors.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.ClientSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Encodings.Web.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Xml.XPath.XDocument.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\CommandLine.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Coordination.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Binder.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Remotion.Linq.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.InternalSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Async.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Http.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.CommonSdk.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.DotNet.PlatformAbstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Globalization.Extensions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Context.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-arm64\native\WebView2Loader.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.Linq.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Converters.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Sockets.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Overlapped.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x86\e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.TimeProvider.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Gdi.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ValueTuple.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Newtonsoft.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Interactive.Async.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Collections.Immutable.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.SecureString.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Sqlite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Memory.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_v2.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Humanizer.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyModel.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Memory.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Json.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.WinForms.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Cancellation.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.DiagnosticSource.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.Abstractions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Design.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Data.Sqlite.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Runtime.Wpf.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.IO.Compression.dllJump to dropped file
            Source: C:\Users\user\Desktop\ProcoreExtractsSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.Logging.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Expression.Interactions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Data.Common.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Options.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.provider.e_sqlite3.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Tasks.Extensions.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeDropped PE file which has not been started: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_green.dllJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe TID: 2688Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe TID: 2688Thread sleep time: -120000s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe TID: 5228Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe TID: 5228Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe TID: 2688Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Windows\System32\svchost.exe TID: 332Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\System32\svchost.exe TID: 332Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 5720Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 4432Thread sleep count: 245 > 30Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 5720Thread sleep time: -60000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6236Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 4348Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 5956Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6512Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6512Thread sleep time: -60000s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6500Thread sleep count: 165 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6500Thread sleep count: 92 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6692Thread sleep time: -2767011611056431s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6660Thread sleep time: -30000s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6216Thread sleep time: -2767011611056431s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6216Thread sleep time: -60000s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 3896Thread sleep count: 525 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 3760Thread sleep time: -1844674407370954s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 7000Thread sleep count: 320 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 3760Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe TID: 6216Thread sleep time: -60000s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 5104Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 3512Thread sleep count: 187 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 4812Thread sleep count: 109 > 30
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 3428Thread sleep time: -2767011611056431s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 3720Thread sleep time: -30000s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 3696Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe TID: 5104Thread sleep time: -60000s >= -30000s
            Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT manufacturer, model FROM Win32_ComputerSystem
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT manufacturer, model FROM Win32_ComputerSystem
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 60000Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeThread delayed: delay time: 60000Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 60000Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 60000
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 60000
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeThread delayed: delay time: 60000
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 922337203685477
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeThread delayed: delay time: 60000
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Local\Temp\Bobcat\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\AppData\Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeFile opened: C:\Users\user\Jump to behavior
            Source: Installer.exe, 00000001.00000002.3737208970.000000000EC04000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
            Source: Installer.exe, 00000001.00000002.3642268791.0000000005B20000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
            Source: Installer.exe, 00000001.00000002.3598576489.00000000009C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess information queried: ProcessInformation
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeProcess token adjusted: Debug
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeProcess token adjusted: Debug
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeMemory allocated: page read and write | page guardJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" installJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" startJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeProcess created: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe "C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe" installJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\procore_ditto_installation.gif VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\procore_ditto_installation.gif VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.dll VolumeInformationJump to behavior
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\PresentationCore.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bugsnag.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-GB\Procore.Ditto.resources.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\CommandLine.dll VolumeInformation
            Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exeQueries volume information: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dll VolumeInformation
            Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
            Windows Management Instrumentation            		2
            Windows Service            		2
            Windows Service            		12
            Masquerading            		OS Credential Dumping1
            Query Registry            		Remote ServicesData from Local System1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault AccountsScheduled Task/Job1
            DLL Side-Loading            		11
            Process Injection            		1
            Disable or Modify Tools            		LSASS Memory21
            Security Software Discovery            		Remote Desktop ProtocolData from Removable Media2
            Non-Application Layer Protocol            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		51
            Virtualization/Sandbox Evasion            		Security Account Manager1
            Process Discovery            		SMB/Windows Admin SharesData from Network Shared Drive3
            Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
            Process Injection            		NTDS51
            Virtualization/Sandbox Evasion            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Timestomp            		LSA Secrets1
            Application Window Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            DLL Side-Loading            		Cached Domain Credentials2
            File and Directory Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync32
            System Information Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1529376 Sample: ProcoreExtractsSetup.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 39 50 sessions.bugsnag.com 2->50 56 Yara detected Generic Downloader 2->56 9 ProcoreExtractsSetup.exe 12 2->9         started        12 Procore ExtractsService.exe 2->12         started        15 svchost.exe 1 1 2->15         started        signatures3 process4 dnsIp5 40 C:\Users\user\AppData\Local\...\Updater.exe, PE32 9->40 dropped 42 C:\Users\user\AppData\...\Uninstaller.exe, PE32 9->42 dropped 44 C:\Users\user\AppData\Local\...\Service.exe, PE32 9->44 dropped 46 C:\Users\user\AppData\Local\...\Installer.exe, PE32 9->46 dropped 18 Installer.exe 25 261 9->18         started        58 Reads the Security eventlog 12->58 60 Reads the System eventlog 12->60 54 127.0.0.1 unknown unknown 15->54 48 C:\ProgramData\Microsoft48etwork\...\qmgr.jfm, COM 15->48 dropped file6 signatures7 process8 dnsIp9 52 sessions.bugsnag.com 35.190.88.7, 443, 49734, 49738 GOOGLEUS United States 18->52 32 C:\Program Files (x86)\...\Bobcat.dll, PE32 18->32 dropped 34 C:\...\Procore ExtractsUpdater.exe, PE32 18->34 dropped 36 C:\...\Procore ExtractsUninstaller.exe, PE32 18->36 dropped 38 163 other files (1 malicious) 18->38 dropped 22 Procore ExtractsService.exe 14 4 18->22         started        24 Procore ExtractsService.exe 3 18->24         started        26 Procore.Ditto.exe 18->26         started        file10 process11 process12 28 conhost.exe 22->28         started        30 conhost.exe 24->30         started       

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            ProcoreExtractsSetup.exe0%ReversingLabs

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exe0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exe0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bugsnag.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\CommandLine.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Humanizer.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.ClientSdk.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.CommonSdk.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.EventSource.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.InternalSdk.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.Logging.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.AsyncInterfaces.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.TimeProvider.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Data.Sqlite.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.DotNet.PlatformAbstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Abstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Design.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Relational.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Sqlite.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Expression.Interactions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Abstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Memory.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Abstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Binder.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.Abstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyModel.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.Abstractions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Options.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Primitives.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.WinForms.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Wpf.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Newtonsoft.Json.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Context.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Coordination.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Interop.WaitHandles.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Oop.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Tasks.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Cancellation.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Collections.Deque.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Disposables.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Async.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Remotion.Linq.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_green.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_v2.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.provider.e_sqlite3.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Converters.Wpf.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Core.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Css.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Dom.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Model.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Gdi.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Wpf.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Runtime.Wpf.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SimpleInjector.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Buffers.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Collections.Immutable.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ComponentModel.Annotations.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Data.Common.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.DiagnosticSource.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.StackTrace.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.Tracing.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Globalization.Extensions.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.IO.Compression.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Interactive.Async.dll3%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Memory.dll0%ReversingLabs
            C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Http.dll0%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://www.newtonsoft.com/jsonschema0%URL Reputationsafe
            http://ocsp.sectigo.com00%URL Reputationsafe
            https://sectigo.com/CPS00%URL Reputationsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            sessions.bugsnag.com
            		35.190.88.7
            		truefalse
              		unknown

              Contacted URLs

              NameMaliciousAntivirus DetectionReputation
              https://sessions.bugsnag.com/false
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://github.com/launchdarkly/dotnet-eventsourceInstaller.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                  		unknown
                  https://simpleinjector.org/asmldInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                    		unknown
                    https://github.com/serilog/serilog-sinks-fileInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                      		unknown
                      https://simpleinjector.org/diasc3Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                        		unknown
                        https://raw.githubusercontent.com/App-vNext/Polly/a2559b1ab7bf9c1e12c71183ce2dfa937bc9c7a6/Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                          		unknown
                          http://s3.amazonaws.com/doc/2006-03-01/Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                            		unknown
                            https://github.com/StephenCleary/AsyncExInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                              		unknown
                              https://github.com/dotnet/core-setup/tree/caa7b7e2bad98e56a687fb5cbaf60825500800f7Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                		unknown
                                https://github.com/aspnet/EntityFrameworkCore/tree/01da710cdeff0431fc60379580aa63f335fbc165Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DE2A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://169.254.170.2aUnableInstaller.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://github.com/App-vNext/Polly0Installer.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://www.ietf.org/rfc/rfc2045.txtInstaller.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://github.com/bugsnag/bugsnag-netInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.000000000281C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://sqlite.org/rescode.htmlInstaller.exe, 00000001.00000002.3692246533.000000000D281000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D2E6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://github.com/dotnet/reactive0Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://procore-ditto.s3.amazonaws.com/RELEASESInstaller.exe, 00000001.00000002.3816033059.00000000127F8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://clientstream.launchdarkly.comEhttps://clientsdk.launchdarkly.com?https://mobile.launchdarklyInstaller.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://raw.githubusercontent.com/aws/aws-sdk-net/4166a61afde54a8bbe723fbb936afa39716f97a0/Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://s3.dualstack.Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      http://sharpvectors.codeplex.com/svgc/Installer.exe, 00000001.00000002.3895373159.000000002253D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.00000000224F6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BC6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        http://sharpvectors.codeplex.com/runtime/Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://github.com/launchdarkly/dotnet-sdk-internalInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://ip-ranges.amazonaws.com/ip-ranges.jsonInstaller.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-jsonInstaller.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://github.com/serilog/serilog-sinks-fileCInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  http://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/net-dg-config-creds.htmlInstaller.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://raw.githubusercontent.com/procore/Procore.NET/3394502880c4bcecca16039ac5fa16a9992342c7/Installer.exe, 00000001.00000002.3838061955.000000001C2FD000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C368000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://s3-fips.dualstack.Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4fInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://github.com/dotnet/reactiveyInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://github.com/launchdarkly/dotnet-sdk-commonInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://github.com/StephenCleary/Deque2Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://www.rfc-editor.org/rfc/bcp/bcp47.txtInstaller.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://simpleinjector.org/depr3.%Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://simpleinjector.org/depr3.-Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://www.newtonsoft.com/jsonschemaInstaller.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      • URL Reputation: safe
                                                                                      		unknown
                                                                                      https://simpleinjector.org/ovrrd.;Container.Collection.Register#Container.Options9AllowOverridingRegInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.xmlspy.com)Installer.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://raw.githubusercontent.com/procore/ditto/d46178350f469016b7d8342b9e0a0683eeca7004/Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://ecrion-test.procoretech.com/pdf/createInstaller.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://github.com/dotnet/core-setup/tree/caa7b7e2bad98e56a687fb5cbaf60825500800f78Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129E3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://html4/loose.dtdInstaller.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://simpleinjector.org/diagnosticsInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://github.com/aspnet/Extensions/tree/9bc79b2f25a3724376d7af19617c33749a30ea3aInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129CE000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129BA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129A5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000129F7000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A34000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A20000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012A0B000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://www.procore.com/legal/terms-of-serviceInstaller.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://github.com/aspnet/EntityFrameworkCoreInstaller.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f8Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012576000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D30E000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012953000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022E16000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022DD3000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://s3-fips.dualstack.us-east-1.Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://github.com/dotnet/runtime8Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://simpleinjector.org/diascInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://169.254.170.2Installer.exe, 00000001.00000002.3746366273.000000000F903000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://ocsp.sectigo.com0Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://github.com/Humanizr/HumanizerInstaller.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012619000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001269C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000125F0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://simpleinjector.org/coll1.Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://www.nuget.org/packages/Amazon.Extensions.S3.EncryptionInstaller.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://ecrion.procoretech.com/pdf/createInstaller.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://simpleinjector.org/ovrrd.Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://github.com/Humanizr/Humanizer2Installer.exe, 00000001.00000002.3692246533.000000000D231000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://www.newtonsoft.com/jsonInstaller.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://github.com/launchdarkly/dotnet-sdk-internalRInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://.cssInstaller.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbfInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://simpleinjector.org/diasrInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.procore.com/legal/privacyInstaller.exe, 00000001.00000002.3838061955.000000001C609000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000009266000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3640931373.00000000050A0000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://github.com/dotnet/runtimeInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012539000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://sketchapp.comInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://simpleinjector.org/diaut8Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://aka.ms/dotnet-warnings/Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://simpleinjector.org/diaalInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://aka.ms/binaryformatterInstaller.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://github.com/StephenCleary/DequeInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://github.com/App-vNext/PollyInstaller.exe, 00000001.00000002.3838061955.000000001C16C000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008B56000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001C0E2000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003BE2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://github.com/dotnet/runtimeHInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://www.launchdarkly.com/0Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://notify.bugsnag.com9https://sessions.bugsnag.comInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000000.1748223787.00000000002A2000.00000002.00000001.01000000.00000004.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000F2D6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3746366273.000000000ED31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000037E8000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D3A9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://.jpgInstaller.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://github.com/serilog/serilog/pull/819.Installer.exe, 00000001.00000002.3895373159.00000000224CE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://github.com/StephenCleary/AsyncEx5Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://github.com/dotnet/reactiveInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D8D9000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3988989251.00000000243A1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://github.com/JamesNK/Newtonsoft.JsonInstaller.exe, 00000001.00000002.3838061955.000000001BD31000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BFE4000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008BF6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://s3-fips.us-east-1.Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.ietf.org/rfc/rfc3066.txtInstaller.exe, 00000001.00000002.3895373159.0000000022657000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://s3.dualstack.us-east-1.Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://sectigo.com/CPS0Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003ECF000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.00000000096D1000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3692246533.000000000D659000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://www.iana.org/assignments/language-subtag-registryInstaller.exe, 00000001.00000002.3895373159.0000000022887000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://simpleinjector.org/diadtInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://github.com/aspnet/EntityFrameworkCore.Installer.exe, 00000001.00000002.3838061955.000000001BB81000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3838061955.000000001BA41000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://github.com/StephenCleary/MvvmInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://docs.aws.amazon.com/general/latest/gr/aws_sdk_cryptography.htmlInstaller.exe, 00000001.00000002.3652221269.0000000008F82000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.0000000003C26000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3652221269.0000000008781000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://github.com/mono/linker/issues/1416.Installer.exe, 00000001.00000002.3692246533.000000000DB55000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.0000000012549000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://simpleinjector.org/depr3.Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                https://github.com/StephenCleary/AsyncExGInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  https://github.com/StephenCleary/DisposablesInstaller.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://simpleinjector.org/diadt:Installer.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://simpleinjector.org/lockedInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://simpleinjector.org/one-constructorInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		unknown
                                                                                                                                                                                                          https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8Installer.exe, 00000001.00000002.3602456338.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.00000000124AA000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3816033059.000000001258A000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022EB0000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022F09000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3615748853.00000000043E5000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3602456338.0000000002A0D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		unknown
                                                                                                                                                                                                            https://simpleinjector.org/collectionsInstaller.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		unknown
                                                                                                                                                                                                              https://simpleinjector.org/diautInstaller.exe, 00000001.00000002.3895373159.0000000022B99000.00000004.00000800.00020000.00000000.sdmp, Installer.exe, 00000001.00000002.3895373159.0000000022A48000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		unknown

                                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                35.190.88.7
                                                                                                                                                                                                                		sessions.bugsnag.comUnited States
                                                                                                                                                                                                                		15169GOOGLEUSfalse

                                                                                                                                                                                                                Private

                                                                                                                                                                                                                IP
                                                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                                                General Information

                                                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                                Analysis ID:1529376
                                                                                                                                                                                                                Start date and time:2024-10-08 23:00:32 +02:00
                                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                Overall analysis duration:0h 8m 55s
                                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                                                                                Number of analysed new started processes analysed:13
                                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                                Sample name:ProcoreExtractsSetup.exe
                                                                                                                                                                                                                Detection:SUS
                                                                                                                                                                                                                Classification:sus39.troj.evad.winEXE@13/201@1/2
                                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                                                                Warnings

                                                                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 184.28.90.27
                                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                • VT rate limit hit for: ProcoreExtractsSetup.exe

                                                                                                                                                                                                                Simulations

                                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                                ⊘No simulations

                                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                                IPs

                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                3b5074b1b5d032e5620f69f9f700ff0efBcMVl6ns6.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                rpQF1aDIK4.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                test.ps1Get hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                path.ps1Get hashmaliciousDcRatBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                playmod24.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                shipment details.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                XDA_CDS v6.8.54_SE.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                Y1ZqkGzvKm.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                Y1ZqkGzvKm.exeGet hashmaliciousVIP KeyloggerBrowse
                                                                                                                                                                                                                • 35.190.88.7
                                                                                                                                                                                                                E_receipt.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 35.190.88.7

                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exehttps://procore-drive.s3.amazonaws.com/ProcoreDriveSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exehttps://procore-drive.s3.amazonaws.com/ProcoreDriveSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exehttps://procore-drive.s3.amazonaws.com/ProcoreDriveSetup.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\CONFIG

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):190
                                                                                                                                                                                                                      Entropy (8bit):4.784438217195675
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:3HVzjMKn9NyKGMt6sLR9Eo7WtQLHgJylyHf9XTK9IVn9XGaLih/IkhEKHL:3HtjMKn9GmLR9EoRcX/9XTK2GAeIkhE+
                                                                                                                                                                                                                      MD5:C0F953C1E6630672A18FD01DCF79FC6B
                                                                                                                                                                                                                      SHA1:5DB9FE931017EC442F203A97DAD9F9645ECFA424
                                                                                                                                                                                                                      SHA-256:D5AA8C4B50DBF0FE39CBA5495DEBE40C34ADFC31CA244BA638FD499B3A7659F6
                                                                                                                                                                                                                      SHA-512:E3245162B590DC224B81A953D231F8A49A9480D2669FEE22643E1C1F538A1DFFCC1344C8A220022B85CA2519A9CBBAA90F0740F287061981A3FF390BC2A6CC9D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Preview:{.. "releasesFileSourceLocation": "https://procore-ditto.s3.amazonaws.com/RELEASES",.. "product": "Procore Extracts",.. "company": "Procore Technologies",.. "appName": "Procore.Ditto"..}

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2441264
                                                                                                                                                                                                                      Entropy (8bit):5.884379569865019
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:2rvQ1Mm1BLqNz7PXedmmybXf2h8gJmH1Wa2BQ+dZxGYnfC1iX:rFq5DLoHQ+dZxGeX
                                                                                                                                                                                                                      MD5:0DDB141358F21523C480BE734334B61B
                                                                                                                                                                                                                      SHA1:39436C3E35557F259B233C00FB73F6069E27B7EE
                                                                                                                                                                                                                      SHA-256:80744AF72D0D40A3BE6B1D51D7FECB81EDA52B7D40198507B4B98DBF2A04D3AD
                                                                                                                                                                                                                      SHA-512:2EFD861741A80A805F4F3B19EE6CC8D448DEACF7F703E566E4EE269ABBAA53C2AC5FC2A44508B98D1D6E28CADDEE1E8E9E915C3D5BFA823E383CD14E12947A5C
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe, Author: Joe Security
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..d..................%..........4%.. ........@.. ........................%.....4-&...@..................................4%.S....@%.............. %.0 ...`%.....44%.............................................. ............... ..H............text.....%.. ....%................. ..`.rsrc........@%.......%.............@..@.reloc.......`%.......%.............@..B.................4%.....H...........|............................................................0..H.......(d... ....(.....(....,....r...po....,.s....(....&+.s....(....&..(e.....*........@@......R.,..(...+,.......*.*.....(....*.0..c.......~....-...(....~....o....r...p(....~....o....o....o.....+..o....o....o....(.....o....-....,..o.....*.......7.!X......J~....,.~....o....*.:.(......(....*..0..P..................(..........s.........~.....!...(....s....r...ps.....o....s....o....&*.0..t.......sw...%.o

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1961520
                                                                                                                                                                                                                      Entropy (8bit):5.847733337748195
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:60Z+/z0mjEGOYkJuVOwrUo0kUPSosFD5L2zml0/Q4iGWoxU4j:5mAXxwIo0pOLYmEQ4iGb
                                                                                                                                                                                                                      MD5:53D0D21CA5DE8B18483377F44709EB47
                                                                                                                                                                                                                      SHA1:69E83960B27273627060ECEBB3C0889FF5C2C284
                                                                                                                                                                                                                      SHA-256:628F5A5ED91E7A119C1EB843EE0BF51564F068197EB20F991569D1DE574771CE
                                                                                                                                                                                                                      SHA-512:8E285618FCAC6E8BBF01621F0703A68B99818A1BFA6106A262C11BE8A57CBB6790A3E1560AD49F61C240440594C9BB509CB1CF8C3A55BD46C429A5C45FB93D94
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUninstaller.exe, Author: Joe Security
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y..d............................^.... ........@.. .......................@...........@.....................................O.......................0 ... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H........a..................`............................................0../....... ....(....s.....(.............s....o....&..&..*.........++..+....0..C........r...p(....,%.u....%-.r...ps....zo....s....(....&*(....s....(....&*..(....o....(....~....o....,.(....*..:(v...,.*(....*..0..!.......(....(....&...rI..p.s....z.(....*....................s....%ro..po....%(....o....o....*....(....*..{....*"..}....*....~....*...(....*..{....*"..}....*.....(....*.0..t..............%.sM....%

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2543672
                                                                                                                                                                                                                      Entropy (8bit):5.894906011979179
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:cszGmCek56vCOTxb0m0Ec5EeQBy7ErrJAQ+0aGU8VR:zK56vDTKmxe3IrWQ+0aG
                                                                                                                                                                                                                      MD5:A78AA05082048DC88CA3BA1E223E8753
                                                                                                                                                                                                                      SHA1:0173D94EF734A3A0098DB4C6DFA2793CCCABDD2B
                                                                                                                                                                                                                      SHA-256:752C4FB21A0D4BF84DE33AC08A708DCE2CC328A4EEB150D006C313D73AEF14A6
                                                                                                                                                                                                                      SHA-512:BD43CC7011BA8060A512825DCB23B03B141C6D0E400EEE1E3259A93DBE4A89963D2EDF5901A9D8995DA811F05827F8953F2AF5411742CA0DB78888F5FFD6A371
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsUpdater.exe, Author: Joe Security
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..d..................&.........~.&.. ........@.. ....................... '.....0.'...@.................................(.&.S.....&...............&.8 ....'.......&.............................................. ............... ..H............text.....&.. ....&................. ..`.rsrc.........&.......&.............@..@.reloc........'.......&.............@..B................`.&.....H...................#...8j...............................................0...........(......o=...}......o>...}......o?...}......o@...}......oA...}......(....(....}......o8...}......oB...}......oC...}......(....(....}....*.....{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*^.(.....(....(....(....*..{....*F.(....o....o....*..F.(....~M...(....*..^.(.....(....(....(....*..(.....(....o....o....~V...(....*....(....~W....(....~R...(....(....*..:.{....(......*.b.(.....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2053744
                                                                                                                                                                                                                      Entropy (8bit):5.272310392574559
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:SQTld46I7zatEN35PTrUhNGcy4e0KmqP01u7iXsfVADxsxD9lJ/iQHGcSmEHQlso:SQTlddYTrL9lUQrGQlsWS1Qv/wDw
                                                                                                                                                                                                                      MD5:EBCACD587926D7108C019B33895AC80E
                                                                                                                                                                                                                      SHA1:9BF03B8F32BB39A4A7E37E896BD9D3B898AC1212
                                                                                                                                                                                                                      SHA-256:2AD0B52579EB29F22D76CD7C10E1C0234D9C8808EE8D3906589EE02596CB8778
                                                                                                                                                                                                                      SHA-512:60CCC3E48ED0C57768F4B579F5DF93E44DF817C2BAB24A3BA34F0B0571ECE9B321387405D0D06EA5988BFAF28C9394E902CE4770B6673573D9B6AC733560F4A3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x............" ..0..............<... ...@....... ................................ ...`.................................F<..O....@...............(..p....`......<;..T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................z<......H.......d................0.......:........................................(Z...*..-.r...pr...ps[...z.-.ri..pr{..ps[...z..o\...(....*2.s]...(....*..-.r...pr...ps[...z.(....(^...r...pr...po_...*..-.r...pr...ps[...z.-.ri..pr...ps[...z..o\...(....*2.s]...(....*....0..{........-.r...pr...ps[...z.......... .#Eg}...... ....}...... ...}...... vT2.}......+.....(......@X....i.@Y1.....i.Y...ij.jZ(....*..0...........@........(`.........(a..... .......8/.....8.(a.......(....+%....(.....@

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.Core.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):334324
                                                                                                                                                                                                                      Entropy (8bit):5.328165634751576
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:qQS6B3nj/Qnn1pVAJXP4xaxJiS7GICml9QPQRVkLx3:qzwjcrIlBEh
                                                                                                                                                                                                                      MD5:BF3FBBFBD100B032FC6F29ED4A30B5FA
                                                                                                                                                                                                                      SHA1:A67AB1B79801276133883B8ADAE88D7295E79EE7
                                                                                                                                                                                                                      SHA-256:FDA0E38A346B08D7F7A69AEBA6EAE394E4F6263B2B912CCF6CD5D28353EAD696
                                                                                                                                                                                                                      SHA-512:B3B2B8CA50A1A9D21E799D250A4B0D70C9E45803EBEFC5304E5E7BD7D9F66909F607F70D9B2B7B061A8A09878FD3FC13CB0046CEB9E2B2599832DE96510012EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|.......#Pdb.........d..#~...e..@2..#Strings............#US.........#GUID.......T...#Blob...o.u.ErIG...O............W..?........X...R.......c.......+...........................&...........`.......L...........z...............................>...o...............................c.......{...........H.......t.......................'.....9.....v.............................0.....q.............................'.....k.....}.......................'.....j.....|.............................X.....j.............................d.....v.............................o.............................$.....e.....w.......................1.....o...................................Y.....k.............................J.....\.............................B.....T.............................6.....H.........................................Q.....a.............................1.....C.....x...................................0.....@.....t...................................X.....h.........

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):884336
                                                                                                                                                                                                                      Entropy (8bit):5.859995571051871
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:LLPMbZK5lp6sW0fEK+4/D70B3QlcLnmDvYMFgvYfYAiMKKVMKB4MSeYKAU2NT3Sm:HPnim8KxSeYGPR7J8SaIy8EL
                                                                                                                                                                                                                      MD5:A206A610871875D82A7D2BC44093F7E5
                                                                                                                                                                                                                      SHA1:A7E52978EB54DBB57BC86C35A7812E1E170105AE
                                                                                                                                                                                                                      SHA-256:8FCB26F6E748F87AE36539BB8ECDEDA3505F698ADBD22AA71545FEB156A1085C
                                                                                                                                                                                                                      SHA-512:E243DF73DC27DFA6E68DE13E9ADE46C9C842D21265856EDD4505A0BC44F7826569CA7D7AB2DEA87B0E1908BA94C188EDC7B41C8496A1A82862AB75114EEAD6CC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..D...........b... ........... ....................................`..................................a..O....................P..p............`..T............................................ ............... ..H............text...$B... ...D.................. ..`.rsrc................F..............@..@.reloc...............N..............@..B.................a......H........T..@...................<`........................................{P...*:.(Q.....}P...*..0..)........u'.........,.(R....{P....{P...oS...*.*.*v >.". )UU.Z(R....{P...oT...X*..0..:........r...p......%..{P......%q)....)...-.&.+...)...oU....(V...*...0.................(....r3..p(W.....(X...-..(Y...(....sZ...rk..po[.....-.*.s......o....,9.o......o\...o]...,%.o........(^...,..o........(_...(....*.~....*6.(..........*.(....*..(....*.~....*.......*.~....*.......*.~....*.......*

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\AWSSDK.S3.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):386684
                                                                                                                                                                                                                      Entropy (8bit):5.507597276703473
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:27bwGoCpRe33jjPRXOh2L2kKg+LX92J33H4saOq6jMR+2/:2/GHnj1XOh2SkKg+LIa16jMR+4
                                                                                                                                                                                                                      MD5:1A0C825FBB3F5CB24FDD981B45FDB293
                                                                                                                                                                                                                      SHA1:7E51B19C8DB203013A1E051D9037178824C61F98
                                                                                                                                                                                                                      SHA-256:EA8453F0781807C56809FD0BB0FB24DC8B6A1CC189AC460CE272BB9D3988BDC1
                                                                                                                                                                                                                      SHA-512:F4D5CE751ED39EF83862D0E3918D4668C1AB5114114F87E519954D3FA1C77BDE5D5A8D3E6545C395C4150D91D44819B51A3EC525618F018F367ADFEAF6649E17
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|.......#Pdb............#~..........#Strings............#US.........#GUID...t.......#Blob.....B.`.K...,....*.......W...........m...o.......|...?...............j...%...............~...n.......U...........L...........................................|.......I...........0.......k.....z.............................5.....E.....w.............................+.....a.....s.............................>.....P.............................,.....@...................................%.....b.....t.............................N.....`.............................4.....F.....~.......................".....6.....m...................................".....6.....w....................... .....2.....n...................................U.....g.............................;.....M.............................&.....8.....y.............................*.....o.................................../.....A.............................".....4.....k.....}.............................@.....R.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2150024
                                                                                                                                                                                                                      Entropy (8bit):5.883390742904972
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:Lm4JpX/Uu0SupwI7p2LWPBA29wKzKd+EXnJfFsuUQ+0GOPYj4C8e:Gp7p2SPB/99YiQ+0Gae
                                                                                                                                                                                                                      MD5:7C95CD0DF4F6F4D9BA9187ED3DDEF1F7
                                                                                                                                                                                                                      SHA1:0A85DE3B7FA94F7F5509EED69B5FCFF65C281BA3
                                                                                                                                                                                                                      SHA-256:ACB85754E01F2F7FF543B903159A02E1D8C5D1813EE3EA81D9A243F593B95E03
                                                                                                                                                                                                                      SHA-512:354709EA709A707545493E5E124C388225F8030ED35BD59FD00761A25EA0FD488598E682B2EC860DFC4A429D56FF8D098FC7C5F28031D94571EB9F4CF75DB733
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bobcat.dll, Author: Joe Security
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..d...........!...... ........... .. ........@.. ........................!......a!...@.................................D. .W..... ............... ..@.... ...... .............................................. ............... ..H............text..... .. .... ................. ..`.rsrc......... ....... .............@..@.reloc........ ....... .............@..B.................. .....H.......,@...d.............X............................................~....*..~....*..~....*.~r...p.....r]..p.....r...p.....*:.(~...(z.....*..~.........~.........~.........~.........(....*..0..B........%-.&~..........%-.&~..........%-.&~..........%-.&~.........(....*...0..........(.....(...+(...+.(d....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+~....%-.&~..........s....%.....(...+&*...s]........sY.......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Bugsnag.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):71168
                                                                                                                                                                                                                      Entropy (8bit):5.898950452077557
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:eqH6k89aSokaoWBL0HQZmW8pNCyFoj/FBX:N6hMj0wk5NFiDX
                                                                                                                                                                                                                      MD5:C7E9D42AAE9A0E8C4AAEA5BD9800DDC0
                                                                                                                                                                                                                      SHA1:94B72226536F72E9E68E97D89EC524E4FA994C83
                                                                                                                                                                                                                      SHA-256:A150DEFFFDA5FCB8018CF3033B08D7A9F03523F81C96BA51BCF9EBE958E896B8
                                                                                                                                                                                                                      SHA-512:A3ED53E13F98EE37C91DD6903522F870A944229859378C510732C943AA3BBC29616CB938CE685DAB7B45EE744947CFED3807BDB3BB845DD48FFE55245F0A9BC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%t..........." ..0..............*... ...@....... ....................................`.................................8*..O....@.......................`......`)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................l*......H........|......................(........................................(....*"..( ...*B.(#...%-.&~!...*J.("....s#...}....*N.(".....s$...}....*6.{.....(....*..0..^........-.r...ps%...z..o&...2.r...ps'...z...o(....+..o).....%.X..3...(*.......o....-....,..o......*.*........+.%P......:.{......o+...*6.{.....o,...*2.{....o-...*6.{.....o....*:.{......o/...*2.{....o0...*6.{.....o1...*:.{......o2...*j.{......(3.....(*...o+...*2.{....o4...*..{......(3...o,...,..{......(3...o1.....(*

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\CommandLine.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):217088
                                                                                                                                                                                                                      Entropy (8bit):6.194600778796897
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Lo5LAk8+YfkQRqP9RhBh1uirTB+3Lr/guqCwtipIllWf1/IFacB:Lo5Mk8XfkQRqP9RhduirT+OXllCwk
                                                                                                                                                                                                                      MD5:D788B7DEDB2E07AB596569360FCD3154
                                                                                                                                                                                                                      SHA1:3FEE00542701EA636C8A4DB60E96856CFE4DEB39
                                                                                                                                                                                                                      SHA-256:26AF31165DBF6AF3864609DF7834A06404E6CFBD8905BA202E0A0BB921326D57
                                                                                                                                                                                                                      SHA-512:1E83C8E64A63046D1C0A620C088CCBA5E7205539B249DC814B59A0360BD06DADD66D6D1E4B0B494C574D311FCA1103011691453D910CF32B6092DD8F492DC8D2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n............." ..0..F..........be... ........... ....................................`..................................e..O...................................0d..T............................................ ............... ..H............text...hE... ...F.................. ..`.rsrc................H..............@..@.reloc...............N..............@..B................Be......H........=...&...................c........................................{....*..{/...*V.(0.....}......}/...*...0..;........u......,/(1....{.....{....o2...,.(3....{/....{/...o4...*.*. a.(. )UU.Z(1....{....o5...X )UU.Z(3....{/...o6...X*.0...........r...p......%..{...........!.....!...-.q!........!...-.&.+...!...o7....%..{/.........."....."...-.q"........"...-.&.+..."...o7....(8...*..{9...*..{:...*V.(0.....}9.....}:...*...0..;........u#.....,/(1....{9....{9...o2...,.(3....{:..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Humanizer.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):308840
                                                                                                                                                                                                                      Entropy (8bit):6.45239473803924
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:tXULlyavR3au9F97QjF9f/QnsdcDePXgmT0jH5Sj:6XwWDef2Sj
                                                                                                                                                                                                                      MD5:C687CBDEA0138936FC4B88B3086207CC
                                                                                                                                                                                                                      SHA1:93C188E269C21893DE07642AF022318ECAE31BAD
                                                                                                                                                                                                                      SHA-256:2C522CD285DE2E3A02520F91203F548E454B980821F10DF90E801BD7D3F5C43E
                                                                                                                                                                                                                      SHA-512:2692EE13267F1801D283B03DAA46CFA61E72E308CE441036F87E6A8492999113B5C82D89173E2E9E0DC64B0867592B24B031CE4E8652ECE4D3F281189C547F11
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u............." ..0.................. ........... ....................................`.................................D...O.......................h ..............p............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H..........H................F............................................(....*..(....*V!...7....s.........*...0............-.r...ps....zr...ps.......i.I......+b....o....,H.......rY..p.o....o............rY..p.o....o....rY..p.(..........o.....+......o.......X....i2..(...+.*..0............i.I......8..................o!...o"...,)......r]..p.o....o#.......(.........8^.................o!...o"...,)......rg..p.o....o#.......(.........8..................o!...o"...,)......rm..p.o...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Images\empty_state_company_project.svg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19169
                                                                                                                                                                                                                      Entropy (8bit):4.906857276576713
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:iGt2PN4Z7DgcNvCVB8KfgLGXvE9eiOe1oXB2:P2P2dgGvOB8KyeiR19
                                                                                                                                                                                                                      MD5:65115D4B7AF12A91CC277BE73A9A1175
                                                                                                                                                                                                                      SHA1:A8CEDD562B7D9DABB45247FC0AD58FE85EC6BCCE
                                                                                                                                                                                                                      SHA-256:5BF02BEBA5810BF622EC42912C088A9379A2140A9073B717D3FC88BB6C0C9220
                                                                                                                                                                                                                      SHA-512:D8C88CEA524FCA076D3AE2AD27F39C636A731742688B79CDEDA1B86C05C8D60082A3F3FD3C282D8979E75BE5FC872C467A882F1B439829F38E6C2C8A7D69CAA5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>..<svg width="273px" height="264px" viewBox="0 0 273 264" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. Generator: Sketch 53.2 (72643) - https://sketchapp.com -->.. <title>Group 5</title>.. <desc>Created with Sketch.</desc>.. <g id="Page-1" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">.. <g id="Artboard" transform="translate(-12.000000, -9.000000)">.. <g id="Group-5">.. <rect id="Rectangle" x="0" y="0" width="290" height="290"></rect>.. <g id="icon-40-chevronRight-primary-Copy-27" transform="translate(171.000000, 60.000000)"></g>.. <g id="icon-40-chevronRight-primary-Copy-28" transform="translate(255.000000, 60.000000)"></g>.. <rect id="Rectangle-11-Copy-2-7" fill="#F2F2F2" fill-rule="nonzero" x="53.86" y="251.74" width="192.56" height="20.38"></rect>.. <path d="M184.52,158.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.ClientSdk.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):118952
                                                                                                                                                                                                                      Entropy (8bit):6.178333547899186
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:qrPLayvRI7btKJevwBNWL/N28vW/e3RbRO5yzgXRKiPiqW8iyt3U6EouRHiDS:qrjaqJSLw8bqIqRCTt6EnRHz
                                                                                                                                                                                                                      MD5:584D9ED5056FD46EC2D7BBF4DC073D4D
                                                                                                                                                                                                                      SHA1:0234ED8C1EE1E9CB46D3789FDE5204A5F9B32D7E
                                                                                                                                                                                                                      SHA-256:D1696B90073065A8C60D6A4F6C288AC08F278B23386BAF3E7C99C09B96FD73E7
                                                                                                                                                                                                                      SHA-512:CCA6EAA2D817E3CE7C351D04CB8741CDA3491212E8883EA879E30D0C6E238DA65CEC68AEB9797E5CBF4840FDFB06F7EC1D42F04B1A0A54F4BE83E3A9EDE9B63C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............f.... ........... ....................... ......e.....`.....................................O.......................................T............................................ ............... ..H............text...l.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................F.......H............(............................................................(....*..(....*.0..4.......s ..............s!......o"....o#...($....o%...o&...*.s....*.s....*2s.....(....*.~r...*Bs....('...(....*Z(....~....o.....o....*.s....*.s....*.s....*.s....*.s(...*.s....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*2.( ...o&...*~.()...,.r...pr...ps*...z.s$...*..s%...*....0...........(+.....{....}......{...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.CommonSdk.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):71848
                                                                                                                                                                                                                      Entropy (8bit):6.08074986870582
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:2CVDGQaOaDO5692pC9qP4d01aAYTsQJGITubBV2nw5UoGxvRczoIPqPiRBEpad:3DGQlBCR01aAliubBew5Mv6PoiDIad
                                                                                                                                                                                                                      MD5:1DE57968907977817999A215ACD52C24
                                                                                                                                                                                                                      SHA1:A841D74EE2B8CF41D967C6571B9E9DEE7DC4B83E
                                                                                                                                                                                                                      SHA-256:F1F57DCED131D7B71E6C12CB98429E6C51C7F422A90B97B43208EA90C4C3F2BE
                                                                                                                                                                                                                      SHA-512:16992B3A7D9389ABE9B8454A813FB1AE21A574D173C78D7D9781198C70F493F12F561C003C7487F38408C6A501B42A88F23504F4B7264937D1783C8EB8B796B7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....E..........." ..0.................. ... ....... .......................`.......J....`.................................F...O.... ..L....................@......L...T............................................ ............... ..H............text........ ...................... ..`.rsrc...L.... ......................@..@.reloc.......@......................@..B................z.......H........v................................................................(....*..(....*..{....*..{....*..{....*..{....*z..}......}......}.......}....*z.{.....{.....{.....{....s....*~r...p.......s......{....(.....*~r...p.......s......{....(.....*~r=..p.......s......{....(.....*~rc..p.......s......{....(.....*...0..B........-...o....*.(!.....( .....,..r...p......%...%...%...o....*..o....*r.(....r...p( ...}.....(!...*"..}....*"..}....*"..}....*"..}....*^.{....-..{..........*.**

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.EventSource.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.175550116199847
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:tDvR6EMvYsSNOJNsvfLbplw6xPeBYVvJuGxxoEzPiRPt9OL:BRJsSN8NofLbxxPe6xPxx97ixtgL
                                                                                                                                                                                                                      MD5:E4C82CB44B1C87274AD98F3AECC867F4
                                                                                                                                                                                                                      SHA1:2CE24D6A2F7DAA62B89BE8A92594CC2770211070
                                                                                                                                                                                                                      SHA-256:C6603B916224F399BCAFD129C41EA1BE9ED9571C32CFA7C2BAAE45589B8D469D
                                                                                                                                                                                                                      SHA-512:79914DADCB4A27F45DD4DF987995419D2BBA1E22BC5FECACF28B947A486E0E85F46BCE5568060F9E0CDC76AB20D47450D5B41A77B23DB7E0FB3878409CB1649B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t............." ..0.................. ........... ...............................[....`.................................f...O.......H...........................h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H........O..$`..............@...........................................0..G.........(....}.......}.......}.......}.......}......|......(...+..|....(....*..0..[.......s.......} ....{ ...~!...%-.&~".....#...s$...%.!.... ....(%...o...+%...'...s(... ....o)...&*..~i...%-.&~h.........s*...%.i... ....o+...&*..{....*..{....*..{....*:.{.....{....Y*....I...}......}......}......}......}....*>..{.....X}....*....0..r........{.....{....3....%.}.....}............*.{....:.....{....,{.{....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.InternalSdk.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):71336
                                                                                                                                                                                                                      Entropy (8bit):6.1218091306648414
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:K6zII2YxMtrmp7DIMzXPjl/Tse/xYvPEKiDY:Jhp7DIWPjl/JpYvPEK9
                                                                                                                                                                                                                      MD5:AC7E6C515B751A3ACE42975C834535BF
                                                                                                                                                                                                                      SHA1:5C9040C16E68423CE7DAC5A6786F3C466BE4F568
                                                                                                                                                                                                                      SHA-256:4E4173CDF8EB3AE490C89D44A0C6E52A54026E1DEC53869CDBEFE2C8C514042F
                                                                                                                                                                                                                      SHA-512:158EDA52EDFDDCB0A1B47BA2F339F69F232F5B9A4819EC79B42D5CD567BF73F14BF81E8170B982B1980045781D72887973B0034E6731B66E81786F3957430A30
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6..........." ..0.................. ... ....... .......................`......r.....`.....................................O.... ..p....................@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc...p.... ......................@..@.reloc.......@......................@..B........................H........m..,...................0.........................................(....*..(....*..(....*..(....o.........(....(....t....o....*Z.(....o....o....o....**....(....*..(......}......%-.&.......s....}......}....*....0..........s ......}!.....}"....-.*.o#.....,...-.*.{....r...p.{".........o$.......+5s%........}&........}'....{........(...s)...o*.....X....i2.*".(+...&*...0..D.......s....%.}i...%.}k...%.}l...%.}m...%s,...}j...%......s-...(....&{j...*..{....*"..}....*..s....*r.(

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\LaunchDarkly.Logging.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21672
                                                                                                                                                                                                                      Entropy (8bit):6.188838524939299
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Gm0dskmREkqckOI/Bfq9aKDuQLwlNKGvC20Xw11+q+aI1fVKaQzWId28ZpHzGov9:d0dsk2LkOI5fq9aKDuQLwlNKGvC2N1Qw
                                                                                                                                                                                                                      MD5:6C78F1F76DD0BCF3E281565A0691546C
                                                                                                                                                                                                                      SHA1:52082186EE2962DCDB0C91C1A94E54FFDCF723ED
                                                                                                                                                                                                                      SHA-256:A49B7C6151C4A6742C74C2377F8A8C0F32B102DAE3D9696DDF18F361B61061B7
                                                                                                                                                                                                                      SHA-512:6D22554027912854977A90C4712AB60D8F04F136F675607A7FFF6AB5260D2A8C8A08269915E0E72EA4626E3C7B391848F5FA48E54572AAF0A7E59E0B225C2FCA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C............." ..0.............JL... ...`....... ...............................Z....`..................................K..O....`...............8...............K..T............................................ ............... ..H............text...P,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B................*L......H........*.......................J.......................................0..M........E........................+.r...p*r...p*r...p*r!..p*r-..p*........o....o....*"..s....*"..(....*V.(......}......}....*b.{.....o.....{....s;...*6.{.....sF...*.0..+........{..........(.....{....s........,..(......*..................0..O........{..........(.....{....~....%-.&~......O...s....%.....(...+s........,..(......*.........:C.......0..K.......sP......}......}.....{..........(.....{.......Q.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.AsyncInterfaces.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22144
                                                                                                                                                                                                                      Entropy (8bit):6.434408185018128
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:O/9b512C4dABe070VJI0Ftdalemxxf34wqsWeb/WjR/uPHRN7Y5slu6o:O/f1IDjV9UPPpWRMkT
                                                                                                                                                                                                                      MD5:48EFE61D6CA3054309907B532D576D2A
                                                                                                                                                                                                                      SHA1:F36403AABB16540C93FB35245EC0B4E435628AAE
                                                                                                                                                                                                                      SHA-256:295AF2142D9214F3FD84EAFE4778DCA119BE7E0229F14B6BA8D5269C2F1E2E78
                                                                                                                                                                                                                      SHA-512:778E7C4675D8FDE9E083230213D2EFA19AA6924FE892ED74FA1EA2EC16743BB14B99B51856E75EAEF632D57BE7F36DD1BC7CE39A7C2B0435B2F3211BB19836A3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Q..........." ..0..&...........E... ...`....... ....................................`.................................[E..O....`...............2...$..........hD..T............................................ ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............0..............@..B.................E......H.......4&.......................C........................................(....*..(....*.0....................(....}.....*6.|.....(...+*:.|......(...+*:.|......(...+*2.|....(....*..{....%-.&.|....s.....(....%-.&.{....*"..(....*>..}......}....*..0...........{....o........{....(....*Z..}......}......}....*N.{......{....s ...*N.{.....{.....s ...*v.{.....{....o!....{....s"...*..(....*"..s....*.0.....................s#...*&...s#...*..{$...*"..}$...*.0..F.........{%....Xh}%.....}&.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Bcl.TimeProvider.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32528
                                                                                                                                                                                                                      Entropy (8bit):6.411321329730272
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:zUF+k8MVW3TJbdc9rbsWN/iGAYi9zraBey:zA+kOG9PsW1iGQzRy
                                                                                                                                                                                                                      MD5:37E25D107CE1385DF1474780CBFA4636
                                                                                                                                                                                                                      SHA1:E453619646D1963764DD1A7700276224BDF88765
                                                                                                                                                                                                                      SHA-256:693242B67DA91AF78DDA4B91D6020E0B8CDA08D4C9102177A12522009EF9B940
                                                                                                                                                                                                                      SHA-512:3C3A4A90D8B565B2CBC129F731663FB92BC0B969A3DC21AC97352995D5466B2671D1870AEC1DA4176AC889ECC770BDA36D26B81384F04358B693B65F43AB2578
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../Qh..........." ..0..L...........j... ........... ..............................a.....`.................................Aj..O....................V...)..........Ti..T............................................ ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B................uj......H........-...5...........b..(....h........................................(....*^.(.......:...%...}....*:.(......}....*:.(......}....*:.(......}....*:.(......}....*.~....*..(....*.(....*...0..d........o......o......-.(!...s....z..o.......(....-..*..(......(....X..~....6..~....2.~....+.~.......s ...*.(!...*.~"...*.(#...*....0../........o.......j0.("...s....z..Yl#......cA.l[Zjs$...*:...o....(....*f.-.r...ps%...z.....sG...*.0../.......sK........~&......('........~(......('......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Data.Sqlite.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):135248
                                                                                                                                                                                                                      Entropy (8bit):6.065591732143012
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:VpqIR26LE2UosXP8Kp5nWNgZhEmLVWf5CFRWY/52:5q2SPB+NM7wf5MH/A
                                                                                                                                                                                                                      MD5:603033DB1596E175D0C613FCFEAD9498
                                                                                                                                                                                                                      SHA1:496FA1A4E1F6CE18440C2D41B1A653B1A36DAFA6
                                                                                                                                                                                                                      SHA-256:BF26C8BCBBFFEFC348117486066B2EC82007104762E4B1F87395688EF2A528A0
                                                                                                                                                                                                                      SHA-512:5C3BD097C7838285AB756C564246A456073AFF1B063F5B8B367852E6DEA1C03D9DBE0AA42B0D7C84C1081FE71B1E4F7D3B64226B01D3ED23A7EC1C8BBFFB75E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............." ..0.............b.... ........... .......................@............@.....................................O.......................P$... ......$...T............................................ ............... ..H............text...p.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................B.......H............O..........d...@.............................................o!..., .o"...,..o#....d...($...(%...*.*.*Z.(&...o'...-..*.((...*2.()...%-.&.*".(*...&*.0..#........o.......o+....o,.......,..o......*.................6..(.........*...0..#........o.......o+....o-.......,..o......*..................0..D........~S...%-.&~R.........s....%.S...s/...}.....s0...}.......}.....(1...*.0..K........~T...%-.&~R.........s....%.T...s/...}.....s0...}.......}.....(1.....o+...*n..(.....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.DotNet.PlatformAbstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24536
                                                                                                                                                                                                                      Entropy (8bit):6.360181177533763
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Cpi9B69YdrMfJAKNIf8u1s68fevZyexiW2hwWyaQHRN7cl4aR9g:CpkyfJdg8udyexCUL57
                                                                                                                                                                                                                      MD5:E0A5223B8782F59D3236EC8287A8E0EC
                                                                                                                                                                                                                      SHA1:C10765FDA272B8C5780D59973AA79E60E5712D90
                                                                                                                                                                                                                      SHA-256:38FE3DA438D814E4D0CEE948422C2AB23AF68B5266DE748FB6A821C5EC6B4436
                                                                                                                                                                                                                      SHA-512:014748F3864503F22AA8820E9CA9D40BFDA63C553AE616FD19FAFF4C503D3DB4CB108014B981C5E7BE65D8F42A9245AD5A2A172AA4A1421C9AF9BF874342318A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..0...........N... ...`....... ..............................[.....`..................................N..O....`..(............<...#...........M..T............................................ ............... ..H............text........ ...0.................. ..`.rsrc...(....`.......2..............@..@.reloc...............:..............@..B.................N......H.......T(...$...................M.......................................~....*..0..*.......(....r...po....t....%-.&(....o......(....*.(.........*2.|....(....*"..}....*f..{.....b.{....X.ja}....*...0...........-..+..o.......(....*....0...........-..+..o.......(....*....0................-..+...o.......(....*2 ....js....*.~....*.~....*.~....*.~....*N(....-.r7..p*r?..p*.~....(....%-.&(....(....(....(....*BrG..p(....(....*....0..n.......(.......YE............*...:...+H(....*(....(

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Abstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20560
                                                                                                                                                                                                                      Entropy (8bit):6.458957242071081
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:8X2XZHFu4hgIwmHLCaPD4IzWvBdW4QHRN7SL1l9DG4:A2DZnj1b258c
                                                                                                                                                                                                                      MD5:D9669F840B78D2C2374C4E3D179FF435
                                                                                                                                                                                                                      SHA1:5A44EE49E308E5E409207FD3B760068F4F3447FC
                                                                                                                                                                                                                      SHA-256:1DF269442DD4D7873AB2E69395D4C8C774164E6F3F75093D27FFB5F14E406191
                                                                                                                                                                                                                      SHA-512:DEFAB2DBB67EDA709E557F207EE444D1BF5F6307CC978809D9423BA896933029D703B9B4A4C08315021EF07F34197AB59C9EA86B24E39ADC47EB23152C027C24
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....)..........." ..0.."...........A... ...`....... ..............................X.....@.................................HA..O....`..t............,..P$..........P@..T............................................ ............... ..H............text....!... ...".................. ..`.rsrc...t....`.......$..............@..@.reloc...............*..............@..B................|A......H.......P#..............(>.......?........................................(....*..(....*..(....*..(....*..{....*..{....*&...(....*V.(......}......}....*&...(....*&...(....*&...(....*V.(......}......}....*..{....*..{....*:.(......}....*..{....*..(....*..(.....r...p(....&..}......}....*..{....*R.r...p(....&..}....*..{....*"..}....*..(....*v......-..r'..p(....&.s....z.*...(...+&.o....-..r'..p(....&.(....s....z.*.0..:..........-..s.....+..o....o....-..(....s......,..r'..p(....&.z

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Design.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):244296
                                                                                                                                                                                                                      Entropy (8bit):6.07589444153843
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:botDgOaW8k31aO+28lJXE++41IcHe0B/b8Nt7kyMT308Gln1LjqRo5YiSKkrqkdH:b0xpiXEPqIaRbqtpMZRo5YiSKkur5M4q
                                                                                                                                                                                                                      MD5:9373ED4CEEA7B431A4F8FEAE9990DCB2
                                                                                                                                                                                                                      SHA1:31D88913F511C974EC870B24AF9A0C4CF0567A6A
                                                                                                                                                                                                                      SHA-256:F431F2154A9D7E9C82C09CD553A5FFDA7B13BED98502B85B4EED452808DA12BE
                                                                                                                                                                                                                      SHA-512:A6EEFCFAC8F894D0150506CDB3456F71721B90C7820F91C13B4FE4616ED9FD7D68B2EFE2FC0E9DF0D06474F0E11C0195619077B3251DCDCF6930EF6EEF77C50E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+............" ..0.................. ........... ..............................YC....`.................................0...O.......$...............H$..........L...T............................................ ............... ..H............text........ ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B................d.......H........n..|............v..@3...........................................{)...*..{*...*V.(+.....}).....}*...*...0..;........u......,/(,....{)....{)...o-...,.(.....{*....{*...o/...*.*. .u.. )UU.Z(,....{)...o0...X )UU.Z(.....{*...o1...X*.0...........r...p......%..{)....................-.q.............-.&.+.......o2....%..{*....................-.q.............-.&.+.......o2....(3...*..{4...*..{5...*V.(+.....}4.....}5...*...0..;........u......,/(,....{4....{4...o-...,.(.....{5..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Relational.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):788856
                                                                                                                                                                                                                      Entropy (8bit):5.938990077143089
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:nb0ri2d+BrKIZVH8opuwicd+T8WRAZ59QSga:bVE+JK4VHpuwiRjRAZQSga
                                                                                                                                                                                                                      MD5:D2D08585DB215FBFABFB423D3744FF0D
                                                                                                                                                                                                                      SHA1:9146812317ECF5AEBEAB28B7AE24E9C1CE43F188
                                                                                                                                                                                                                      SHA-256:E6A543FD7E684F892B778F853B41F503488D94D593FD4391497F81FD490636FD
                                                                                                                                                                                                                      SHA-512:FBD63F3B4F99325C357F8521A74089B59D65431D0DAC2355AE7158AD7F8309D911F51609B02684CB44345B15E9F5D8B16577323CDCD54F3F6A0649E3467487D3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'..........." ..0.................. ........... .......................@............@.................................\...O.......T...............x#... ......h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...T...........................@..@.reloc....... ......................@..B........................H....... ...................\............................................{H...*..{I...*V.(J.....}H.....}I...*...0..;........u:.....,/(K....{H....{H...oL...,.(M....{I....{I...oN...*.*. -:.p )UU.Z(K....{H...oO...X )UU.Z(M....{I...oP...X*.0...........r...p......%..{H....................-.q.............-.&.+.......oQ....%..{I..........=.....=...-.q=........=...-.&.+...=...oQ....(R...*..{S...*..{T...*V.(J.....}S.....}T...*...0..;........u>.....,/(K....{S....{S...oL...,.(M....{T..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.Sqlite.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):125304
                                                                                                                                                                                                                      Entropy (8bit):6.198187737390266
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:nDI2eqJDT+mudQv1VKXktNxks5/Ard4XFtX9kqffMNuQc4pjYgx2fJW:n02xDimudQv1V7tNT5IuXFtXTfLi5U0
                                                                                                                                                                                                                      MD5:7D8AD55A6D80FB00586A944D1B972E52
                                                                                                                                                                                                                      SHA1:7AAFCCE152C3C0E2DDD48879D145DF3B8519ABAC
                                                                                                                                                                                                                      SHA-256:A8BEE31425353A0A20E94D553F0635D384DF9D358BA2EF74E6FD49900037C0DB
                                                                                                                                                                                                                      SHA-512:6C62DDBDD6243BB62E44DBECEAFCC9DDD4A104EF51EC761B97CFFA793701DF9102072560A64FCFE36BB3F0F0770300662162181DB2BB69401123D18CCE4AD0D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2d............" ..0.................. ........... ....................... ......h.....@.....................................O.......................x#..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......|...h%..............P...4.........................................(2...*..(2...*2.(3...%-.&.*....0..1........(4.....o5..., .o6...,..o7....U...(8...(9...*.*.*2.(4...o:...*..(......$.-..(....*.U...(8.........%...o;...*.*...0..G........(.......(....-5......(8...(9...-#......(8...(9...-.......(8...(9...*.*..0...........(............(8...(9...:..........(8...(9...-}......(8...(9...-k......(8...(9...-Y......(8...(9...-G......(8...(9...-5......(8...(9...-#......(8...(9...-..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.EntityFrameworkCore.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1496656
                                                                                                                                                                                                                      Entropy (8bit):5.953943511482834
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:Fcs562VuA4/uVrJZVdZdLqz+28sknN7UMsQrnGchNMZknZnxbyyux:FpJuAq2rJZVXN7sQfIZknZn13ux
                                                                                                                                                                                                                      MD5:62FA2CA5EE344D7AAB5FD14BCCB23E07
                                                                                                                                                                                                                      SHA1:178C3774205C13675ECB62B126DAC2FAF86AADFC
                                                                                                                                                                                                                      SHA-256:2448A7E0C2C06109FDCAB0B007BEE7037D756B2232B3DF0A84A5BCED2BD21927
                                                                                                                                                                                                                      SHA-512:A4766CCE46E140FF2EEE4687757D5CF465A5E76CE9889E62F3954FB11180FC81864592E665F04D5F6A86EC35093B7E29E04BEF986AAF3CC3B8D9BEF74C9B2725
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?............" ..0.................. ........... ....................... ......;.....@.....................................O.......8...............P$..............T............................................ ............... ..H............text...4.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B........................H........................Z...h..d.........................................{h...*..{i...*V.(j.....}h.....}i...*...0..;........u......,/(k....{h....{h...ol...,.(m....{i....{i...on...*.*. >.F. )UU.Z(k....{h...oo...X )UU.Z(m....{i...op...X*.0...........r...p......%..{h....................-.q.............-.&.+.......oq....%..{i..........o.....o...-.qo........o...-.&.+...o...oq....(r...*..{s...*..{t...*V.(j.....}s.....}t...*...0..;........u......,/(k....{s....{s...ol...,.(m....{t..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Expression.Interactions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):91648
                                                                                                                                                                                                                      Entropy (8bit):5.836675531273972
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:Srf5GttgxHXEuRmG5rtkGY4CEmWAxXSSYhhS98ca2Wvsd65FJDlGWwkEy:a5GttWHXEUx5r65LxXshk8JDIWP
                                                                                                                                                                                                                      MD5:6A3B9E46C41E42E7B8E1479468D892AF
                                                                                                                                                                                                                      SHA1:E31C05AE685E51D07808B1DD24CECED9D299ED81
                                                                                                                                                                                                                      SHA-256:F3B14DEFBD05493B8573016B08B86E5B5D53B486B0457FD75F67BF8BFF04BE38
                                                                                                                                                                                                                      SHA-512:D6416204875CE732EDAC51E36F267C9CCA52F60BA79CD981B388988E435BD1CCE87F972A9E90BE4FD9A7FD25CB316293F938F45FB645F25A4F62B980A37236B7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...eu.K...........!.....\...........z... ........@.. ....................................@..................................y..K....................................x............................................... ............... ..H............text...$Z... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B.................z......H...........L...........x...1...P ........................................z...y.k.....bdd I..`..).PsR@... .aL...%:...y.....XDgM.X}..~)2.v-..4..........EAZZ...,..[..H...o5*C.o...5/I.m.!2...#.:.(......}....*:.(......}....*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*"..(....*"..(....*..*..{....,..{.....o....*.{....o....*2.~....(....*6.~.....(....*F.~....(....td...*6.~.....(....*J.(.....s ...}....*F.(...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Abstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26688
                                                                                                                                                                                                                      Entropy (8bit):6.277233700407285
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:yfK2U2DUz2NLkS90eeKY0YPO58Jpq+grBCrg+:q90eeKxLOpq+grBC8+
                                                                                                                                                                                                                      MD5:B345402DA847849CB9BC1948FAA397A5
                                                                                                                                                                                                                      SHA1:EC4F7695B38EAB6B05C3077258F8BC0EAC47F4E4
                                                                                                                                                                                                                      SHA-256:EC8FF200BF215399EB52D2CF74A6F3CED2F2F33D30C7A8F956C17D23F901C3F8
                                                                                                                                                                                                                      SHA-512:CF2D29A2BBA5D0024B479213BB8193C53AE1A255DDD4861734612D7415817E6D6310F4795F3966676EC6E5236E01AA41AA16AA507CF64ABEC8FA1225B590CDE0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r............" ..0..8...........W... ...`....... ....................................@..................................W..O....`..T............D..@$...........V..T............................................ ............... ..H............text....7... ...8.................. ..`.rsrc...T....`.......:..............@..@.reloc...............B..............@..B.................W......H........*..p+...................V.......................................(....*..(....*:..s....o.....*:..s....o.....*:..s....o.....*..{....*"..}....*..{....*....0..A.........~.......(....-..+...(.....(....,.r...p......rA..ps....z..}....*..{....*....0..A.........~.......(....-..+...(.....(....,.r...p......r...ps....z..}....*..(....*..-.r#..ps....z.-.r+..ps....z...s....o....*..-.r#..ps....z.-.r+..ps....z...s.....o....*:...s....(....*..-.r#..ps....z.-.r+..ps....z..(.....o ....o.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Caching.Memory.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32312
                                                                                                                                                                                                                      Entropy (8bit):6.308912157782851
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:YkmwVpE3sb8klWRc6AAAAAAAArRAAAAJ1zANg8Pc20Jgee44PUpXE5Xv+1zBdQzA:Yk0cbyRcGA68Aqvc1zBdcLBFwf
                                                                                                                                                                                                                      MD5:7198D6D8E44E42C88A4C9803B096CB4F
                                                                                                                                                                                                                      SHA1:35F3764D42490AD642BB4A16402F7806F4E5B515
                                                                                                                                                                                                                      SHA-256:A22C63ED32C77C0F315C380DD4CC16C745647B32209534308A64BA67621A5B9C
                                                                                                                                                                                                                      SHA-512:CF77574193EC8F922D495659F7B02EB7183AA58ADA70D6C140C689C3A9688001F86602298CAAE70C01660F319F74D02A94470A5D5D52E5D9AB6719B4F276DA4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....v..........." ..0..P..........Rn... ........... ....................................@..................................n..O.......P............Z..8$...........m..T............................................ ............... ..H............text...XN... ...P.................. ..`.rsrc...P............R..............@..@.reloc...............X..............@..B................4n......H........5...7...................l........................................-.r...ps....z.(....&.(...+(.....*..-.r...ps....z.-.r...ps....z.(....&..(...+&.*..-.r...ps....z.(....&.(...+(.....*..-.r...ps....z.-.r...ps....z.(....&..(...+&.*..(.....-.r+..ps....z..o....s=...}....*..-.rK..ps....z.{.....(....t....*n.-.rK..ps....z..(....(...+*...0..s........-.rK..ps....z.-.rS..ps....z.-.r_..ps....zs.......o....o .....o!...o".....o#...o$......ijs%...o&....{.......(...+&*..-.rK..ps....z.-

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Abstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20544
                                                                                                                                                                                                                      Entropy (8bit):6.39336708356651
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:0aEsyjAb8TG/ZvozRjz6r5c3JABzWSPTWC4c4HRN7+eRl3t3MmW:0b/Q4JApaB+eKJ
                                                                                                                                                                                                                      MD5:D8E064AD8F2419F204723CF7CAA7AB0B
                                                                                                                                                                                                                      SHA1:F19F20D758DAE8563FC4914C737E06F1292F58E2
                                                                                                                                                                                                                      SHA-256:32CCDB2AB4348F195D247F920D1432C0CBB1CC5FD548FEC8EE562C438AA48849
                                                                                                                                                                                                                      SHA-512:B2ED620BC914433435E655F7A1C956735F959C3E8C60A182D96AB0A59A54C81FFA0C52214D88C6E48CA82E198AD7E9FCB603D6DC017EC64399FCF40D3178C341
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............." ..0.. ...........>... ...@....... ....................................@.................................k>..O....@...............,..@$...`......\=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......*..............@..B.................>......H.......T#.......................<.......................................0..........(...+..,...o...........o....*v.-..*.r...po....%-.&.*.o....*"..(....*Z..s ...%.}....%.}....*n.-..*.o....-..o....(...+*.*j.-.r%..ps....z~.....( ...*j.-.r%..ps....z~.....(!...*....0..'........("...,..*.~.....o#...........Xo$...*.*..0..&........("...,..*.~.....o#...........o%...*.*.r?..p.....*f.(&.....}.....('...}....*.*...0..&........{......,...;.....*..}.....s(...}.....{.....{....o)....{....u...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.Binder.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25664
                                                                                                                                                                                                                      Entropy (8bit):6.321742244690199
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:IUUSzG5Eiqu07TKQ2Eqjy9gZ7cFq+33XBhzWcvGWCPc4HRN7gwslHa83//:IUUUG5Ezu0vKDEZjHnRnIBU
                                                                                                                                                                                                                      MD5:3FC2AA5A1717ACCF911040B215BCE29E
                                                                                                                                                                                                                      SHA1:4B70D0392884C1DFD5EC66242EF58F7F804F58E8
                                                                                                                                                                                                                      SHA-256:8D0BBBD3DA37805186B4958E9EB8C7DA038A759176E26EAE64DBDEA75E535AD2
                                                                                                                                                                                                                      SHA-512:C74240A310AD5F236A805B40C8C407F0BF501BA6664E259FFF610DEA0D0148628DF01EA96DD1D03A7C6CB01C7F59D374CB9B2E613A0B93813CC590AEAF0E2D4B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...pZ............" ..0..6..........NT... ...`....... ....................................@..................................S..O....`...............@..@$...........R..T............................................ ............... ..H............text...T4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B................/T......H........+..,#...........N......xR........................................{....*"..}....*..(....*..~....%-.&~..........s....%.....(...+*.0..4........-.r...ps....z......(.....(......-..........*......*...~....%-.&~......-...s....%.....(....*.0..(........-.r...ps....zs......,...o........(....*:..o.....(....*...~....%-.&~..........s....%.....(....*..0..1........-.r...ps....z.,.s......,...o.....o.......(....&*....0.....................(...+*v......(...........(.........**....(...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Configuration.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26176
                                                                                                                                                                                                                      Entropy (8bit):6.373614376396436
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:kfCpdoVDPMbHdJs2tIY+UMg3f/baO+U07zWX1VWWC/2c4HRN7v0Hll3t3Mma:rpduwBD2peM9c62Bv0HOp
                                                                                                                                                                                                                      MD5:BA5145200FCEA6B50A2223F98B468BD3
                                                                                                                                                                                                                      SHA1:7AF4F0B8A4A7B75763BBC72C5C3EDF3D85FD8A50
                                                                                                                                                                                                                      SHA-256:5971CA80CF7EC34845334C9734542CD4DE2548FB15192A19E6DF3272019E6317
                                                                                                                                                                                                                      SHA-512:3E442028CB9208B1925D53BC3F0146FA832E1A912B8C09DACC6B5EE419C78931E4B5E256D58299A3ADB9F54B2A66F24E454BE74017FD0F0E2FBE5B7E98ADA464
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...!............." ..0..8..........FV... ...`....... ....................................@..................................U..O....`...............B..@$...........T..T............................................ ............... ..H............text...L6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................%V......H........*...(..........<S..@...|T........................................-.r...ps....z.-.r+..ps....z.s....%.o....o....&.*..(.....-.r9..ps....z.o....-.rG..ps....z..o....}....*f..{.....o....Q.P(.......*:.{......o....*2.{....o....*.*..0...........,..{.....o......+..{....o.....s....%.~....%-.&~......I...s....%.....(...+o!....(...+~....%-.&~......J...s#...%.....(....(...+*..{....*"..}....*..s....*..(....*..{....*..{....*r.-.r9..ps....z.(.....o%....*....0..C.......s&.....(....o'..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.Abstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37440
                                                                                                                                                                                                                      Entropy (8bit):6.081048090601344
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:23VVPCLgCcYGJiHB/lWnQV46YlER0+NUoiw+NTzW4/LWCdc4HRN7F3lvMhbAtTSw:CbPmgC4iHVYQVTFN+w+N5LBFI
                                                                                                                                                                                                                      MD5:BD0CB2BC62A2485E93AA36FA6941C0CE
                                                                                                                                                                                                                      SHA1:453CFC5D9A9CB9C54EC38FEF07D7BB3289484C7E
                                                                                                                                                                                                                      SHA-256:4CBAFB5C80B11692638D857C0227429F56CD27DEE8FBF85B75CB1A98C8A86F84
                                                                                                                                                                                                                      SHA-512:14C74166CD8F010CC6F0C496931E0AD11B9292E35FD3C899620980432C191EF4E44A44100D675B5D288BC779FE850E0727E161EE718CAA60D1FDE286BD65A8AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0..b.............. ........... ....................................@.....................................O....................n..@$..........p...T............................................ ............... ..H............text....`... ...b.................. ..`.rsrc................d..............@..@.reloc...............l..............@..B........................H.......(;..H?..........pz.......~.......................................0..j...........Q.o.......u/...%-.&.+.&.o.....0...(....(.........&.......,).,...o....Q.P-..o....o....,...o....(....Q.*...........5........(....*.0..@........-.r...ps....z..(....,.r...ps....z..(....,.r+..ps....z....(....*..-.r...ps....z..(....,.r...ps....z.-.rQ..ps....z....( ...*..-.r...ps....z......(.........(....(....*..-.r...ps....z..(....,.r...ps....z...(....*~.-.r...ps....z......(....(....*..-.r...ps.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyInjection.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):60480
                                                                                                                                                                                                                      Entropy (8bit):6.223999171415957
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:rjcg1jdIBknLML9ERHePs4Wb0XQuY3EO9VzBmkV:rjlIBknLML9sehHXX6ECU0
                                                                                                                                                                                                                      MD5:9ADB29AA65A7CC5ADA2CF5C5E259407B
                                                                                                                                                                                                                      SHA1:A049318E3AB543354B87BA88058E362A06BBA90E
                                                                                                                                                                                                                      SHA-256:772AD7674284C0F62E5C90D0772283B8152AD704E612D5D46088C77D17314D1C
                                                                                                                                                                                                                      SHA-512:930F1F10A781C792742B9663CCAEF5DD6A77921C63938274422D072EC9843E71C34FBDC780B950F4F625EE8C85A675900F9F0E866D1DACCB5A922C216145A4DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Wd............" ..0.................. ........... ....................... ............`.....................................O.......................@$..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........U..t...........H.................................................(....*..(....*.0..j...........Q.o.......uI...%-.&.+.&.o.....J...(....(.........&.......,).,...o....Q.P-..o....o....,...o....(....Q.*...........5........(....*N.,..o .....(....*.*fs!...%...s....(....o"...*...0...........o#...,..o$.........i.(....*.o%...,....(....*~.......o&...,...o'...&*.o(...,...(....,,..o)...o'...&*...(....-..o)...+..o*...o'...&*..0..Q.........+..o+.....o%...-....(....++..[o,...&..,.o-

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.DependencyModel.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):62936
                                                                                                                                                                                                                      Entropy (8bit):6.1698518375087215
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:80WmvoLOOyoQLjuTRCw1eCKIJ5scDS6LubzsLYHk:80XoLFyoQPuh0MubzOYHk
                                                                                                                                                                                                                      MD5:2924800DC6A4E7F04C79CFD547B2CB26
                                                                                                                                                                                                                      SHA1:254828A2AB7F2F515035A41578E2063843A74B94
                                                                                                                                                                                                                      SHA-256:55D38B351EC02F26872D7A240C1ED02031F598513BEDBEC1EDBAD63B84C7B8E7
                                                                                                                                                                                                                      SHA-512:E256AC13C827058B3329D8D1B4488350C0428935A322DEDF4C529BE5DC8BFBC982EEB7A91302461A9548F6A56513EA0208930A8E1A22416EF6FF6CF016E8BB10
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Vs............" ..0.............~.... ........... .......................@............`.................................)...O........................#... ..........T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................].......H........]...............................................................0........................(....*.0..0.....................(......-.r...ps....z...(...+}....*..{....*.~....*..0..........s......(.....(....*..0..:.......s......,$.., ....+........o....,..*..X....i2..(.....(....*....o....-.r...p.(....(....s....z.*...!...%.s.....%.s.....%.s.....s.........*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*.~....*...0..w........(..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.Abstractions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48192
                                                                                                                                                                                                                      Entropy (8bit):6.169380663324594
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:YoodqqiKSspOLEJ13avFuitiPiXGydvQmwBjwu:YvdqqiKS1QJ5a9tt6KQmwBEu
                                                                                                                                                                                                                      MD5:FA43B31FAC519D4537325B2D77595C3F
                                                                                                                                                                                                                      SHA1:DC3C0912D2275684A95816401F63E155FE2B5ED1
                                                                                                                                                                                                                      SHA-256:CE4721EB7591C77EC23650C079C25730BC9E4F2AF440ED0CE913258151434CDA
                                                                                                                                                                                                                      SHA-512:E9E050EC7BD310CE3C5C13AC7F3849DD96EE34CA68A91956B956EEF6C228A23D790736D05F07562B039A888471F823107D11384E72E172F505192964680335F4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]?..........." ..0.................. ........... ....................................@.....................................O.......................@$..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......4C..hd..................,.........................................(....*..(....*"..s....*&...(....*2...(.......*>..}......}....*..{....*..{....*.0...........(....%-.&.(.......(....*B.(......(......*...0.. ........-..*.%.u....,..........(....*.*..(....*6.......(1...*......(/...*......(0...**....(....*6.......(1...*......(/...*......(0...**....(....*6.......(1...*......(/...*......(0...**....(....*6.......(1...*......(/...*......(0...**....(....*6.......(1...*......(/..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Logging.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31808
                                                                                                                                                                                                                      Entropy (8bit):6.340842410818935
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:KhATzquC707zKCROqI8sNBvSWWh4KU2Borgw:KhAquC7qzKCZINNBvsU2Bo8w
                                                                                                                                                                                                                      MD5:B7F13CB30356DBE3E3BF7C01E2D8C7B1
                                                                                                                                                                                                                      SHA1:712900D638167A85017AB7F99119964D84E0A39F
                                                                                                                                                                                                                      SHA-256:9CB78661A77FBBAE56DE368F018AC9B06E6A171DAB37E49091AC4ABC4A3D1126
                                                                                                                                                                                                                      SHA-512:6DF9337D590ADB72DF002CD64005A59F60BA064B2AE2D207559F0B43C9C8978AE75B22115556F0F4E7567B7B7862B99FE069EC92B3C98752623636BEA92D1BB5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....!..........." ..0..N...........m... ........... ..............................6.....@..................................m..O.......$............X..@$...........l..T............................................ ............... ..H............text....M... ...N.................. ..`.rsrc...$............P..............@..@.reloc...............V..............@..B.................m......H.......@2...9..................8l........................................~....%-.&~......Y...s....%.....(....*..0..^........-.r...ps....z.(....&.(...+(......9...(.....;...(....(....(......s....(...+(......sJ...o.....*...0.. .......sZ......}........[...s....(....*.0.. .......s\......} .......]...s....(....*.0.. .......s^......}!......._...s....(....*.0.. .......s.......} .......!...s....(....*.0.. .......sb......}#.......c...s....(....*.0.. .......s"......}#.......$...s....(.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Options.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):43584
                                                                                                                                                                                                                      Entropy (8bit):6.17781231838619
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:gNpHjW3XHbfZtbdWkbdWWbR3MNKRjsGVh0UBsr:QpHjSHbfZtbdWkbdWYSNsom0UBsr
                                                                                                                                                                                                                      MD5:D195309528F364DFACD3BAE393EA08B8
                                                                                                                                                                                                                      SHA1:763721AA95EB354FE7CB88AC5EADBF6D854BC5CB
                                                                                                                                                                                                                      SHA-256:123766D210B9793CE76C2779FA87B3C8FE122A526FAA6D46841CF7CF6E5495FF
                                                                                                                                                                                                                      SHA-512:332578FC59E8C518A0E45957D20A9A491B7D6D7567C1655C2F2FA5535450D2D9238B7937BA26B1EB271335E0DD605CB64768AC875EB0901692D021ACB1E344D1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`..........." ..0..|............... ........... ..............................*w....@.................................Z...O.......D...............@$..........p...T............................................ ............... ..H............text....z... ...|.................. ..`.rsrc...D............~..............@..@.reloc..............................@..B........................H.......x:..0Z..............H...........................................0...........-.r...ps....z......(.........(....(....(..........(.........(....(....(..........(.........(....(....(..........(.........(....(....(..........(.........(....(....(.....*6.~.....(...+*..-.r...ps....z.-.r...ps....z.(....&...s....(...+&.*&...(...+*6.~.....(...+*..-.r...ps....z.-.r...ps....z.(....&...s....(...+&.*&...(...+*F......(....(....*..(....o....,..o.........(....( ...*.*..0..R........(..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Extensions.Primitives.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36416
                                                                                                                                                                                                                      Entropy (8bit):6.181858754180119
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:HOBVTHyqXeGfbUnEsxaWYUeIBuiglpTcZZzBqyVO:HOvdXNN4aLUrBuiwi/zBqyVO
                                                                                                                                                                                                                      MD5:30F911D2FF61105F7B5680006A9E4DEF
                                                                                                                                                                                                                      SHA1:12285FFDA48A642F3B06B06CE73F79341475C006
                                                                                                                                                                                                                      SHA-256:42BBC209A1A39F3BAB6652478DE1BC7DD240146E3B668D34253425EB663BCC4F
                                                                                                                                                                                                                      SHA-512:BCC6E1B979A370D1E11083327776364620E7055CF21D05F56F5867839DE77C5C3823BD1ADF123865533263FE7766A6FDE6E66A55535C705A9097662E1181D463
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6............." ..0..^...........|... ........... ..............................bT....@.................................t|..O.......8............j..@$...........{..T............................................ ............... ..H............text....\... ...^.................. ..`.rsrc...8............`..............@..@.reloc...............h..............@..B.................|......H........9...>...........x.......{........................................('...*..('...*2.|....((...*"..}....*...0..K........-...(....*...o.....+..o.......(......X..o)...-....u......,..o*......(....*..........2......"..(....*f..{.....b.{....X.ja}....*..0...........-..+..o+......(....*....0...........-..+..o+......(....*....0................-..+...o,......(....*2 ....js....*V..}.....(-.....}....*..{....*"..}....*..0...........(.......(....*..{....*..0..E.........(/...-.(0...&.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):536152
                                                                                                                                                                                                                      Entropy (8bit):5.427411627903393
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:qDrB322zh+iKsRFN/eA+imQ269pRFZNIEJdIEY0lxPrEIgcvLcglxMwCepM1SwU1:Zj
                                                                                                                                                                                                                      MD5:9F9FEEDB05B87E1BE1C7AB710655D0E8
                                                                                                                                                                                                                      SHA1:2886A398D065E13F667B974180589BAFF890D2B3
                                                                                                                                                                                                                      SHA-256:5E172B4F558723B7DBB7F568F301077C84D6571436FBE5A5F45BFA621C020403
                                                                                                                                                                                                                      SHA-512:397BE2264710120F1F6C419FC7E6A95915EABD0B0586461FADF7335D3B3E0BC35EBCA96ACF5CB4002A46F6AEF90C0238564519C47C7C62C995B1D7469158B287
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&.me.........." ..0.................. ... ....... .......................`...........`.................................h...O.... ..................X(...@......0................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............ ...........................................................0..G.........()...}n......}p......}q......}o......}m.....|n.....(...+..|n...(+...*..0..I..........(!....ob....8..o,... .@..3.r...p.s-...z.z..o,... ....3.r}..p.s-...z.z*........................,.......0../........{....- ..{....t....}.......r...p.s....z.{....*................."..}....*....0../........{....- ..{....t....}.......ry..p.s....z.{....*................."..}....*....0../........{....- ..{....t....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.WinForms.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40528
                                                                                                                                                                                                                      Entropy (8bit):6.26392097818966
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:9FCniwqfU2Gm0bOVmW0etGjyf8ZDgcEST3p4Jjrjh2jJGSUyauTv1JKia5/Zi/WC:9Ijyf8ZDgcEST3p4JjrjaJGSUyau71JX
                                                                                                                                                                                                                      MD5:D15BFC4C7CCCC1E99466A1866FFC473D
                                                                                                                                                                                                                      SHA1:A4A6CE5968D346CA1DA16BF9195EEF8CDB07F570
                                                                                                                                                                                                                      SHA-256:BEF507A4CE7B6A848993BC504AF7E2273CEC22E77469787CB1D47D3F362164ED
                                                                                                                                                                                                                      SHA-512:28461110891A9BA7AF40DF3DE46D0937A52BDFCC4DBD88448672D7D34E2A4B4F68A5BA464051A5523AD172862D62CAA8BCCC2E780615722CE37EF1982A028F3B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..l............... ........... ...............................4....`.....................................O....................v..P(..............8............................................ ............... ..H............text....k... ...l.................. ..`.rsrc................n..............@..@.reloc...............t..............@..B.......................H........>..tG..............@...8..........................................}......}......}......}......}.....|............}.....(......*.0............{.....+..*B...}......}....*....0............{.....+..*B...}......}....*....0............{.....+..*B...}......}....*..{....*"..}....*...0............{.....+..*B...}......}....*..{....*"..}....*...0..v.........{....-&.(....-..(....-..(....-..(.......+..+....,-...(.....(.....(.....(.......s....(....}......{....%-.&.(...+.+..*...0..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Microsoft.Web.WebView2.Wpf.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):47680
                                                                                                                                                                                                                      Entropy (8bit):6.233831229199194
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:eV08pvSZjQIf1jlCPcePUO9w8aDP/ryEH0tBy4JjrD1h2j5hUURGvkq7FKKa5/Bw:t84jQW1jlOzP7w8aDP/ryEH0tBy4Jjrz
                                                                                                                                                                                                                      MD5:2B4A31DAA2E0AF6A5FD7DF0252CB3CAB
                                                                                                                                                                                                                      SHA1:6D30ED7787BBF1E464050CCE5169B978734DCB2C
                                                                                                                                                                                                                      SHA-256:BF8FD64FE7AFBCF7646631BAA160C3A6D85B8A51777E52FB471F0230950DE754
                                                                                                                                                                                                                      SHA-512:5FE91444803CAE9CAB98F5405EDA3AACC6B677E57BD51CB82D5EA6E7712F5A7FFD133B8AFBF7074215446938DEB601BB10B0B97B43F72D187F2CD215DEACFCDE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...|............" ..0.................. ........... ...............................^....`.................................=...O.......................@(..........\...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................q.......H........I...Y..............@..........................................B..}.....(......*....0............~....(....tX....+..*>..~.....(.....*...0............~....(....tX....+..*>..~.....(.....*...0............~....(....tX....+..*>..~.....(.....*...0............~....(....tX....+..*>..~.....(.....*...0............~....(..........+..*R..~..........(.....*..0............~....(....tX....+..*>..~.....(.....*...0............~....(..........+..*R..~..........(.....*..0............~.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Newtonsoft.Json.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):711952
                                                                                                                                                                                                                      Entropy (8bit):5.96669864901384
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
                                                                                                                                                                                                                      MD5:715A1FBEE4665E99E859EDA667FE8034
                                                                                                                                                                                                                      SHA1:E13C6E4210043C4976DCDC447EA2B32854F70CC6
                                                                                                                                                                                                                      SHA-256:C5C83BBC1741BE6FF4C490C0AEE34C162945423EC577C646538B2D21CE13199E
                                                                                                                                                                                                                      SHA-512:BF9744CCB20F8205B2DE39DBE79D34497B4D5C19B353D0F95E87EA7EF7FA1784AEA87E10EFCEF11E4C90451EAA47A379204EB0533AA3018E378DD3511CE0E8AD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D.}..........." ..0.................. ........... ....................... ............`.....................................O......................../.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......d....9..................h.........................................(....*..(....*^.(...........%...}....*:.(......}....*:.(......}....*..(....*:.(......}....*..{....*..(....*..(....*:.(......}....*..{....*.(.........*....}.....(......{.....X.....}....*..0...........-.~....*.~....X....b...aX...X...X..+....b....aX....X.....2.....cY.....cY....cY..|....(......._..{........+,..{|....3...{{......(....,...{{...*..{}.......-..*...0...........-.r...ps....z.o......-.~....*.~....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Context.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13824
                                                                                                                                                                                                                      Entropy (8bit):5.158692214593411
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:W/4i53Y4IkHBKK7mEHRCn0lTbkKM5N9R7EljEeDY4riw:K4hkIX0od4rh
                                                                                                                                                                                                                      MD5:CED2989533C108389C0AC1BAD7FCC2C7
                                                                                                                                                                                                                      SHA1:4FDEB5CD9B03E3E178556B3B46E6C695AC4326DE
                                                                                                                                                                                                                      SHA-256:3A17EDB81E4F6ADDFA32FA9D23AFEFBB0CADBDCD138B7F153E2BE33D5097FDCE
                                                                                                                                                                                                                      SHA-512:5C4A8CE7EBA0514E3910A800A3DAF6D7D6469815D94CCBD037078C45DF875E10F9EF1AC637D6A95A8DCE2FADC74D668E9A41F918C6A167139536FD078FBE9344
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..........." ..0..,...........J... ...`....... ....................................`.................................gJ..O....`..L............................I..T............................................ ............... ..H............text....*... ...,.................. ..`.rsrc...L....`......................@..@.reloc...............4..............@..B.................J......H....... )..l ............................................................(....*^.(.......,...%...}....*:.(......}....*:.(......}....*...0..D........(.....s+...}......s"...}......s1...}.....(.........{....s....}....*2.{....o ...*6.|....(!...&*f.|....("...-..{....o/...*..(............s#...(.... .....{....o$...&.{......o....&*2.{....o0...*b.{...........s%...(&...*.0..8........-.r...ps'...zs......{.....((....o....()......,..o.....*.........-.......0..:........-.r...ps'...zs.....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Coordination.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40960
                                                                                                                                                                                                                      Entropy (8bit):5.6693183910149605
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:ojvVaQqaR+eUdsPFGuF3W0kwoCBVUcLaiSdHLgLhPKunGLbV9d:uvEQxYeUdsPg2c+bUpiSdELhkHd
                                                                                                                                                                                                                      MD5:EF8D4E968AB341FFBA4A1E47E41C5AF1
                                                                                                                                                                                                                      SHA1:EC2C6A81B1E3E07E68922966C3F2FFBEC3696322
                                                                                                                                                                                                                      SHA-256:2EF53250402F5721795AA01EB2216D717E000DEACDB1677228E723411DEA2D4A
                                                                                                                                                                                                                      SHA-512:A79476FD3F8CA0DD95381B4889FA9BF375837039A473034FE9F9039535DA80B2EAA934B00E5BE32496CD61697E57A95E40ED53CC3DF5B1611921ABBA3BBDD0A1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0................. ........... ....................................`.....................................O.......`...............................T............................................ ............... ..H............text........ ...................... ..`.rsrc...`...........................@..@.reloc..............................@..B.......................H.......,Q...c............................................................()...*^.()......@...%...}....*:.().....}....*:.().....}....*..(*.....%-.&s+...}......}.....s*...}....*&...(....*&...(....*2.|....(,...*....0..&........{..........(-....{........,..(......*...................0..I........{..........(-....{....,...}....(/.......{.....{.....(...+....,..(......*...........4=......2.(0...(....*J..(....(0...(1...*2.(0...(....*....0..@........{..........(-....{....o2...,...}...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Interop.WaitHandles.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8704
                                                                                                                                                                                                                      Entropy (8bit):4.754973401459842
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:moQfnaZOHB05WuPWT+B/X2hDbJFmHYCmwF3aE:mbz+ZeWiUaE
                                                                                                                                                                                                                      MD5:08BC7405834CF94B89AF08C7FC12B1CF
                                                                                                                                                                                                                      SHA1:AB9442A2E70CC71323994B988F8F1A1C0E747936
                                                                                                                                                                                                                      SHA-256:47167222E130131EB83BABFE35D0B2A585AB293B7B18F9CDDE68DB3F1CFF208C
                                                                                                                                                                                                                      SHA-512:13A52690AAF142147C75A540F5B171708AC16DEBBF2298C518BF79C849CB3735C924A82DEEB61576A869C37507B6FEFF1BD40863C4E741681935C7C066E154E8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...h............" ..0.............~6... ...@....... ....................................`.................................+6..O....@.......................`......85..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................_6......H.......\#................................................................(....*^.(.......'...%...}....*:.(......}....*:.(......}....*F.~....(....(....*6..(....(....*6.~.....(....*.0..H........-.r...ps....z..o....,.(....*.~....(....,.(....*..(....,.(....*...(....*.0..G.........(....}.......}.......}.......}.......}......|......(...+..|....(!...*..(".....~....%-.&~..........s#...%........($...}....*:.{.....o%...&*.s.........*..("...*6.t....o&...&*...0..&........{......,.s'....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Oop.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6656
                                                                                                                                                                                                                      Entropy (8bit):4.2453708136189725
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:7kNb+UG1mfjmQtDX+FnICb34KxfWs7muwuSGF0Tznw:7ktG4LmYYImd+UFSIeE
                                                                                                                                                                                                                      MD5:0D680214103A28E65E840227F39F07A1
                                                                                                                                                                                                                      SHA1:B99FC65D71EAB8E4FB65EC1B2A3F8B74116ED1C1
                                                                                                                                                                                                                      SHA-256:68750CB34911A56BEE5AE3C133DCCC92F1D8901DAD59E295DE70481F7CBBE4EC
                                                                                                                                                                                                                      SHA-512:E10CAE46A5E8A11F222076E653A7CCBEB25537FFBFD3F383D7F4C599C835239651F5789768168AAFC21E91F4A2A0DE113410E94F169B06F157A57409FB268175
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#.G..........." ..0............../... ...@....... ....................................`.....................................O....@..P....................`..........T............................................ ............... ..H............text...4.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................./......H........!..D.............................................................(....*^.(...........%...}....*:.(......}....*:.(......}....*z.(......s....}.....s....}....*....0..@........{..........(.....{....-...js....}.......{....o.......,..(.....*........,5......~.{....-.r...ps....z.{....o....*..{....*.0..;........{..........(.....{....-.(........{....o........,..(......*.........&/......:.(......}....*^.{....o.....{....s....*"..(....*..o....*BSJB............v4.0.30319......l...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.AsyncEx.Tasks.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):35840
                                                                                                                                                                                                                      Entropy (8bit):5.665538970053075
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:GRr4c83p3+EDp3LzKKKKKuGzVVzbKKKb7lxDI0/DUWoT9MpaBnUpDe:GRr65Oy7lxFDUWoBMpaBnmDe
                                                                                                                                                                                                                      MD5:65157CC7ABA40F659DE78EAEC9995BD4
                                                                                                                                                                                                                      SHA1:DF1496D08CE7A53AFAC284EE692B819B45A7C6DE
                                                                                                                                                                                                                      SHA-256:59A2FE3C8C1D95D9F8CDB3F99875DCBFF769DDED6E660CDA4696F64237318EC4
                                                                                                                                                                                                                      SHA-512:486852EE050905209C62B0B4537C935A9AF43491AD245850069022E136E701615A3D22F0BF72E06CFC62469291697E137405B586D911B65689996C43F6F1E2B6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....K..........." ..0.............Z.... ........... ....................................`.....................................O.......p...........................0...T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B................;.......H........C..T[............................................................(....*..(....*^.(.......>...%...}....*:.(......}....*:.(......}....*6.(....o.....*Z.-.r...ps....z..}....*..{....*"..(....*2.{....o....*6.{.....o....*..0..r.......s.......}.....(.....|....( ...,...{....(...+("...*.s#...}$.....|.......%...s&....('....=...}(.....{$...o)...("...*..{*...*"..}*...*F.{(...%-.&*o+...*....0..?.........(,...}.......}.......}.......}......|......(...+..|....(....*n.-.r...ps....z..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Cancellation.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8704
                                                                                                                                                                                                                      Entropy (8bit):4.654008630932593
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ClLdASTnK4wJnQHJwr1CPkjMYPoE8jEX5eejKJ0RkSDFC5waX:CFyS4JnQpwWkjMYPoE8jEXQWKGsZX
                                                                                                                                                                                                                      MD5:33F68B3A986681D13BCC7D58623C6245
                                                                                                                                                                                                                      SHA1:55D0C402B60D9A5AD2B1C15C81710349801964A1
                                                                                                                                                                                                                      SHA-256:6CB66C1761663D6CBDD838ED644069A98EA968F9388A369393A247AC35C3BB48
                                                                                                                                                                                                                      SHA-512:99EB56630CF05619ACE17B047F1EE4C344330346D6E9D9D8A54F6EA9CC0E1CFCAA875D17EB691F09A7DF7EA2BF342D63CCE0E2ED978A92DFB650FDDB421AA0D1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............6... ...@....... ....................................`.................................I6..O....@..T....................`......t5..T............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`....... ..............@..B................}6......H........#................................................................(....*^.(.......!...%...}....*:.(......}....*:.(......}....*"..(....*..s....(......}.....,...o....}....*>..(......}....*F.{....%-.&*(....*..{....*Js....%.o....s....*Js....%.o ...s....*V.-.r...ps!...z.(....*.0..u........-.r...ps!...z.(....s".....o#...-.s....*.o#....3...o$...s....*.(.......(%...,..s....*.o#............o&....('...s....*>..s....%.}....*....0..9........o.....+..o.......(%...,......o....-....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Collections.Deque.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16896
                                                                                                                                                                                                                      Entropy (8bit):5.205989369799155
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:XWo4D257lCPrpSxP41vrlEwDqoY7WIZwj8x7WwF5LM+eU5vGoMjnJX6eP6+M0j98:O25ipSx+rxUWW0j98T
                                                                                                                                                                                                                      MD5:8624542959AB87DF919CCB5434D62328
                                                                                                                                                                                                                      SHA1:FB57A6E31F700ADC42D449D94390140924B30ED1
                                                                                                                                                                                                                      SHA-256:8F2F2999F24E2F31648A1FEFB83273BD3F38AFA97B6C8787B4B0A87FCE110716
                                                                                                                                                                                                                      SHA-512:4517FD9578649D79DEEFFAB855AFCF6A94480528C0BEF85C533D1F16D78548DEC2196D1BF62FBA153AF987BDF1E28001BE5375D1B0D1FCA7C2C700FAE2842CE3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....cf..........." ..0..8..........VW... ...`....... ....................................`..................................W..O....`..0...........................$V..T............................................ ............... ..H............text...\7... ...8.................. ..`.rsrc...0....`.......:..............@..@.reloc...............@..............@..B................7W......H............'............................................................(,...*^.(,......+...%...}....*:.(,.....}....*:.(,.....}....*...0..C........-.r...ps-...z.u......,..*.u......,..s....*.u......,..s/...*.s0...*..(1...../.r...pr!..ps2...z.......}3...*..0..H........(1....-.r]..ps-...z.(...+..o4......1........}3......(5...*.......}3...*"..(6...*..*R.(7....(8.....(9...*V.(7....(8......(:...*V.(7....(;......(<...*R.(7....(8.....(=...*...0..D.......(>.......(?....+..o........o

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Disposables.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10240
                                                                                                                                                                                                                      Entropy (8bit):4.817980741425928
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Z4qNTvfo9oEQbh/4ILP5MdbCzqKu6DV2atU6CzXtIcXHi+FoJNoZ:yqNDQ9oEEl4kP+z6DV2asq9JeZ
                                                                                                                                                                                                                      MD5:CCF8333DB03C30491CB6F3DE595D0FB8
                                                                                                                                                                                                                      SHA1:156E0965793B3EE3A48FEFC2C116FA5D8B8DFBC2
                                                                                                                                                                                                                      SHA-256:A454B07C1AE5355B49E9FB38E87AF6A94A7102995BCACCDC31D44A52B9B4A9D6
                                                                                                                                                                                                                      SHA-512:7FFF3D155777AD5150BD187FD4D46EC530D88EB8FEC23C2285171A8B4E66DA607858A42692E788348DE15B3E4A0599E08D0BA445E71452DF131916D433D7FA7D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w7............" ..0..............<... ...@....... ....................................`..................................<..O....@..4....................`.......;..T............................................ ............... ..H............text........ ...................... ..`.rsrc...4....@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........$................................................................(....*^.(...........%...}....*:.(......}....*:.(......}....*"..(....**.,..o....*...0..=.......s(......}.....{....-.*....)...s....(....,.*.(.....{....o....*..s....*"..(....*J..(...+(...+(....*....0..%........o.....+...(....%-.&+.o......(....-.*....0..=.......s*......}.....{....-.*....+...s....(....,.*.(.....{....o....*..s....*..s....*"..(....**.,..o....*....0..=.......s,......}.....{....-.*....-...s....(

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Async.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22528
                                                                                                                                                                                                                      Entropy (8bit):5.343110563653872
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:aif7NYA2AeurSia9cYi2AeufSiaKGVFbbexvrgWbIra7WXUqysFDB+gc/wlhm4Di:lYA2AeurSia9cYi2AeufSiaDW7WXUPCw
                                                                                                                                                                                                                      MD5:56B29DCB4887DE431447B9958C42FB48
                                                                                                                                                                                                                      SHA1:53E98F2939D853E5CF9CDBCD01176F8E4478FAA4
                                                                                                                                                                                                                      SHA-256:4F5D0735A7D7B5B141669732616AF4BCF014CF3B0E0D73CF02BA39ACFADD7D0F
                                                                                                                                                                                                                      SHA-512:387522E0D7721E228E6D0046EBF6473B401D9DD315B50C009BCC3C93958CEBB7E362EBCA760AF890A791130D3C44309530E832C576A4E1F14CC36858588F9F15
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..N...........l... ........... ....................................`.................................Pl..O.......4...........................|k..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc...4............P..............@..@.reloc...............V..............@..B.................l......H........9...1............................................................(....*^.(......./...%...}....*:.(......}....*:.(......}....*>..(......}....*6..(....(....*.0..!.......sY......}........Z...s.....(....*....0..%.......s[......}........\...s....(....(....*..{....*"..}....*Z.(....-..*.(....o;...*....0..?.........(....}.......}.......}.......}......|......(...+..|....(....*..0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Nito.Mvvm.Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13824
                                                                                                                                                                                                                      Entropy (8bit):5.0720090664140525
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:MrXbj+mpWJnplnFLTrzf/Etn/CU5n2gJjlZI:Mb2CmPFLTrzUqdoH
                                                                                                                                                                                                                      MD5:D2C852ACFCCC623E64AADA5D0D4D1954
                                                                                                                                                                                                                      SHA1:7594AE0FB8BD229A9091F448496F48348CE292A6
                                                                                                                                                                                                                      SHA-256:3F79FE1AD6FAE45BEE87C4AE9BFBF5118BB124CC8C4BB2F71E5D89B096C0BEA2
                                                                                                                                                                                                                      SHA-512:54E1818A6DEEFB059A21F2315A2FF688A3DAABA5D2ADD4AE0F79D8174B8B73B36A5E65BEF8FC30D85C2714D7816576819E1BAB2A7CCEFE3E15430DCB02366472
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...."............" ..0..,..........~J... ...`....... ....................................`.................................+J..O....`..............................\I..T............................................ ............... ..H............text....*... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................_J......H........(..| ............................................................(....*^.(.......(...%...}....*:.(......}....*:.(......}....*.~....*.......*.~......8...s.........~......9...s.........~.........*z.(......s....}.....(,...}....*J.|....(-....{....*..|....(-....{.....3.*..}.....{....o1...*b.|....(-....{.....o/...*b.|....(-....{.....o0...*J.|....(-....(....*J.s....}.....(....*.~....*....0..I........{..........(.....{.......o....,....".s......{......o.........,..(......*...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):235936
                                                                                                                                                                                                                      Entropy (8bit):6.38589620804016
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:ctW1vTy6YzsS5O7ngeSkm4bm8L8e/9Aoc:Hv268s3rc
                                                                                                                                                                                                                      MD5:879970D36B5601B83E97BF10D0D07F75
                                                                                                                                                                                                                      SHA1:4DA5CF31076D09A420375B2E78A577053F343017
                                                                                                                                                                                                                      SHA-256:A6049BCEA0972BED250BEFD3E61BD2D5021C0360DCE536FCCA837F4560E8A52C
                                                                                                                                                                                                                      SHA-512:367483C42652A99C0B3366242DB3143584258DB4B7371E81F55E83D5C29793F820671545BCCE2086724DD99FB48822675A59C17E4AB1C1A347267A3B3F58C483
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0..b..........J.... ........... ....................................`.....................................O....................j.../..........(...T............................................ ............... ..H............text...Pa... ...b.................. ..`.rsrc................d..............@..@.reloc...............h..............@..B................).......H...........(a............................................................(#...*..(#...*^.(#......n...%...}....*:.(#.....}....*:.(#.....}....*:.(#.....}....*:.(#.....}....*..{....*:.(#.....}....*V.(#.....}......}....*r.(#.....}......}......}....*V.(#.....}......}....*r.(#.....}......}......}....*..{....*..{....*..{....*..{....*..{....*..{....*"..}....*..(#...*..(#...*..(#...*..(#...*:.(#.....}....*..{....*:.(#.....}....*..{....*:.(#.....}....*..{....*..(#...*:.(#.....}....*..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.Core.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):63772
                                                                                                                                                                                                                      Entropy (8bit):5.553251383931376
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:MV8NyRz3zX1CV9hexih36y5+dKT09YEb+mV:Hk3z0VrexihH4KT09YEb+mV
                                                                                                                                                                                                                      MD5:4BCA139A23E70C0C1CDDAD494C9EC244
                                                                                                                                                                                                                      SHA1:85C4D3A7D3A3C477BB4899E2DE78F0EE28225B59
                                                                                                                                                                                                                      SHA-256:A3F558B64FB117F4EF360CBC172BCE13324D2566EA87C7F29B94D5B9E2DD6C04
                                                                                                                                                                                                                      SHA-512:ACC4295FD464C1C717D240B5BBDFE83C687F1457B56203DC6579F3AD9DD82073F3078623F4AAC8D7085537852237DB7D5E6D34FDFB9E2049961ADCFF57649A45
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|...|...#Pdb.........h..#~...i..L...#Strings.....l......#US..l......#GUID...|m......#Blob....d.Z3..J.....6.j..(.....W...............T.......F.......[.......b...............p...........z...1...............z...p.../...............................F...;...........^...=.......D...L...........................b...k...................X...a...................0...9...........................J...U...........................O...Z...................'...0...m...v...................?...I...........................`...j...................9...C...~.......................G...S...........................a...k...................J...T...........................H...P...........................M...U...................%.../...n...x...................X...b...................)...1...r...z...................<...D...........................Y...a...................9...A...y.......................A...I...........................U...]................... ...*...Z...d...................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):294304
                                                                                                                                                                                                                      Entropy (8bit):6.212135945837797
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:TIkf4G5/EQ9fabnQQVXZVy78VKT0IZaRWZIXP6YxbzTlROpa6r3PYqwL:TTebnQQVXZKgKT0aIZBJUp2
                                                                                                                                                                                                                      MD5:45DB64D3820DE980FEEAC76562855660
                                                                                                                                                                                                                      SHA1:CB6661F1854EC13328284EFAB31639716469EE2B
                                                                                                                                                                                                                      SHA-256:F55101172E8C01E055F87A505FDECBD2DA69954E18E3C1D7262AC19EE64D812D
                                                                                                                                                                                                                      SHA-512:9B07F6503626A8F12DF952ACB8D051C988B61098FEDCF2ADA14EDB712B5F3448FE90C2B09B5A10E36C85F772BB2057AE037D115FDFD041E95663CA882B65BF57
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P.Q..........." ..0..F...........e... ........... ...............................P....`..................................e..O....................N.../...........d..T............................................ ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H........^......................\d........................................(9...*^.(9......i...%...}....*:.(9.....}....*:.(9.....}....*:.(9.....}....*r.{....,.r...p(H...z..}.....*r.{....,.r...p(H...z..}.....*"..(M...*"..(N...*....0..,.......s.......}............s:...s{....{.....(....*.0..-.......s.......}............s:....s.....{.....(....*....0..(.......s.......}............s:.....{.....(....*.0..'.......s.......}............s:...s{.....(....*B...s......(....*......(....*.0..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Polly.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):81772
                                                                                                                                                                                                                      Entropy (8bit):5.288968322176841
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:4OakrcV3WGFAOqgv8RWvYuHYqKmt4nvSJWrBy:4OK1mlIvY2Y3C4K8rBy
                                                                                                                                                                                                                      MD5:8BE12DC2E0F74610DC3FF96DCFA3F7DB
                                                                                                                                                                                                                      SHA1:36FBBA09AF369081D6DD2C02C0B5EDAC44983D45
                                                                                                                                                                                                                      SHA-256:A448BBA346224DCCCD1DAD57A455A5FEEEE2CB4A0BA279C7A9F888ECFC4F32E0
                                                                                                                                                                                                                      SHA-512:F7E2F5417A8CD65A3C491C2787FA66C30954CD53998AE281451368D0CE9313413903607E4906F5CC2A991941EFF5BBE6FBC50B904091251A483491D5FF3B6B74
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|.......#Pdb............#~..........#Strings...........#US........#GUID...`.......#Blob...P..69.sD..gL^.8.o.......W...........................S...........L..............."...\...f.......A...........................7...................................c...............>...|...+...2...b...i...................I...Q...................#...-...e...o...................-...7...j...t...................6...@...z.......................9...C...x.......................E...O...........................K...U...........................H...R...........................Q...[...........................H...R...........................=...G...v.......................F...P...................0...:.......................!..._...i...................>...H...........................S...]...................!...+...b...l...................$.......Z...b...........................S...[................... ...*...]...g...........................P...X...........................B...J.......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):475704
                                                                                                                                                                                                                      Entropy (8bit):5.948731051267863
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:o21feucQmFanRWruEOw+UNPZgdOq/AP1A4nHmo++JmD:ohLQme05bZTnHZ
                                                                                                                                                                                                                      MD5:D0D18B9BE6EF7BC07C140D27BDB6A966
                                                                                                                                                                                                                      SHA1:10E4D7460378E8FCB13DE8FD06EEF434176C1733
                                                                                                                                                                                                                      SHA-256:61FD3FAED914CFC53A298AB7F1B15DD53E58FC5B7663A12409D0A79EB6D67EB0
                                                                                                                                                                                                                      SHA-512:CFBB3CE4847C4ECE944BBADB4AD50E111D1460EE51168FAF776DFFE50339F6590C53246E7F8DD419FDC402DA1F0F77A61054B29676BA0774678EDA4F44D79812
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."*G..........." ..0..............6... ...@....... ....................................`..................................5..O....@..D............"..8 ...`.......4..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc...D....@......................@..@.reloc.......`....... ..............@..B.................6......H.......Ds................................................................{....*:.(......}....*..0..)........u..........,.(.....{.....{....o ...*.*.*v ..v. )UU.Z(.....{....o!...X*..0..:........r...p......%..{.......%q.........-.&.+.......o"....(#...*..{$...*..{%...*..{&...*..{'...*..(......}$.....}%.....}&......}'...*..0..q........u........d.,_(.....{$....{$...o ...,G((....{%....{%...o)...,/(*....{&....{&...o+...,.(,....{'....{'...o-...*.*.*....0..b....... ..Q. )UU.Z(.....{$.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Api.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):135116
                                                                                                                                                                                                                      Entropy (8bit):5.01859956432702
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:SEruWJH6nQZpe8SdAS6VWmuyfqEImE/Bcgc0LLEs7UKPu5Wndd:ZiOH6nQZpe8SdAS6VWmuyfqEIm/wz
                                                                                                                                                                                                                      MD5:6D88015F8647F4D3517140F81A2B16CB
                                                                                                                                                                                                                      SHA1:6AE16111D1276D3D6DE1296542DF85A29DC24F63
                                                                                                                                                                                                                      SHA-256:04F0A465356F62B5D55CBA8F1B2A17B7E2E61E7E7425D8E1C4F56371C35F76BE
                                                                                                                                                                                                                      SHA-512:C0E4DAA1F93FB1AA73FBD5F782AFB951143BDD5379361DE521D5E376152A4D4823801FE9D5C6648B503E3AA63498E3C94952E2E70A2CA7E51C27C999711F9DF4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|.......#Pdb........TP..#~..PQ......#Strings....0S......#US.4S......#GUID....S......#Blob...uR...K.K.....g".h(......W...........x...............................S...........................d...............P...s...................................l...........r.......`...2.......9...C...w.......................Q...]...........................U...a.......................*...c...o...................S..._...................C...O...................(...4...n...z...................*...6...f...r.......................+...Y...e...........................P...\...................$...0...c...o.......................)...\...h...........................B...N...........................?...K...........................6...B...q...}...................1...=...n...z...................H...T...........................E...Q.........................../...;...j...v....................... ...Q...].......................)...d...p.......................(...X...d.................../...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):82480
                                                                                                                                                                                                                      Entropy (8bit):6.053979638596377
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:Md2fyxVDMmvCi5ZJ8nsn8lQT9A1/h369EOWI+wQQCtnE+E17on3haRQ:MZx9M8CiAU60+zE+E1zRQ
                                                                                                                                                                                                                      MD5:DAE4BD1FEA057E0837173BE427CD5DA8
                                                                                                                                                                                                                      SHA1:D007465F3C3FFA2BB7B55747FFCFEA074C05CD96
                                                                                                                                                                                                                      SHA-256:F84BE9773CED6EBE351F8EC30B02A38975A58FC4C4248587B5C812DB031CDC5E
                                                                                                                                                                                                                      SHA-512:20EAFDD06BB89DF42E7A971797F109828CD5630F735F6EAB622980E2FEEF7B13AD69AE24FF394AEAE3E3C15EAA5E4D436218048AC06B63DF56945F38DD2C4DCD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V............." ..0..............8... ...@....... ...............................E....`..................................7..O....@..............."..0 ...`.......6..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H...........(.............................................................{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*.0..D........(......}......}......}.......}.......}.......}.......}.......}....*.0...........u.......;.....9....(.....{.....{....o....9....(.....{.....{....o....9....( ....{.....{....o!...,w("....{.....{....o#...,_($....{.....{....o%...,G(&....{.....{....o'...,/((....{.....{....o)...,.(*....{.....{....o+...*.*.*....0.......... ...M )UU.Z(....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.dll.config

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4506
                                                                                                                                                                                                                      Entropy (8bit):5.0072344071081245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c27GOeg+Z0z7Kig+wBz7Vg+Gz7og+wBz7Q6g+Gz7ag+wBz7xg+wBz7ng+wBz7Eg/:pGliKCUHO0UTOaUbUdUoUwSAOrH4OlN
                                                                                                                                                                                                                      MD5:E4F2927ADBA5BBAA23586A6F33BB6B8C
                                                                                                                                                                                                                      SHA1:6D76469C92ED51F02A840AE16F6FF6554DB6C70A
                                                                                                                                                                                                                      SHA-256:B55B838BEBA1AD5FD995C62D9747887E68B4E87A3EE3E374687F78E62019F93C
                                                                                                                                                                                                                      SHA-512:911F609A3DD67EB1FA907AE869576F991449FF88C073E5D81A35E83DBFA32BB2CDC58391AFC7885FCDF2B00B74811586050FE97420D050039E9638DF372E3A59
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.ComponentModel.Annotations" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.1.0" newVersion="4.2.1.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Data.Common" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-4.2.0.0" newVersion="4.2.0.0" />.. </dependentAssembly>.. </assemblyBinding>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="System.Diagnostics.StackTrace" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />.. <bindingRedirect oldVersion="0.0.0.0-

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.DB.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23704
                                                                                                                                                                                                                      Entropy (8bit):5.893218733335627
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Co6iE6KqrQt8UguAxT1ha3ZbH2B+kCanbJq8gLYAT1m4NL+UQ9I:C35iaNAami6C
                                                                                                                                                                                                                      MD5:0E15FF76A2B9A1E14533E37A3324691A
                                                                                                                                                                                                                      SHA1:B0A731566675A9C87CADB0EECF48FE325474D9AA
                                                                                                                                                                                                                      SHA-256:20D73EEE47FDED771E971612D17C49EB47F8436B2FCFE366E61BEFA1305735B9
                                                                                                                                                                                                                      SHA-512:4643DD44A876C4BFA9796AAA508125D2F05F0010DC3C87215569994B08E232147AC98C887425DEAD7892B21258DE87DD22FF98736E9B6CE3840559286706612D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|...t...#Pdb............#~..........#Strings....`.......#US.d...`...#GUID........?..#Blob...%.hd.E.j.D....%.......W...........b...D.......................#...[...:.......u.......p...........$...9...|...............................................<.......8...B...........................F...R...................-...7...................6...B...................I...W...................E...Q...........................=...I...v.......................T...`...............#.........................................................................................................................................................................................................................................................................................................................................6,...,...,...,...,..)-..3-..=-..G-..Q-..[-..e-..o-..y-...-...-...-...-...-...-...-...-...-...-...... ...0...@...P...`...p.................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):655928
                                                                                                                                                                                                                      Entropy (8bit):5.459214283708295
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:Znc+ZS8UtJ02lxF2o+xs+B+lrF/H7ez2QiugOZScZ6ZS:fhU/Havk
                                                                                                                                                                                                                      MD5:CF0914DE88C49370CF951FFEEA446102
                                                                                                                                                                                                                      SHA1:0441A07385D90804260BA7005A990090D34EA9F8
                                                                                                                                                                                                                      SHA-256:FE716ECFE8518A5B118975BDF16BE8A1A08134AF6C8DFBB9B551E5BA79B102D2
                                                                                                                                                                                                                      SHA-512:CCF374926FE5604C5534702C8A96D869C0CC546E245C718378E3C71069DC4B1B3F3493D111DFC7EA03E25044047973CE5E1891853CD431D4DE48E0D55A22E55D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.........."...0..~...b......f.... ........@.. ....................... ......r.....`.....................................O........^..............8 .......................................................... ............... ..H............text...l}... ...~.................. ..`.rsrc....^.......`..................@..@.reloc..............................@..B................H.......H...................G...\S...H............................................{/...*..{0...*V.(1.....}/.....}0...*...0..A........u,.......4.,/(2....{/....{/...o3...,.(4....{0....{0...o5...*.*.*. r}.q )UU.Z(2....{/...o6...X )UU.Z(4....{0...o7...X*...0..b........r...p......%..{/......%q/..../...-.&.+.../...o8....%..{0......%q0....0...-.&.+...0...o8....(9...*..{:...*..{;...*..{<...*..{=...*..(1.....}:.....};.....}<......}=...*..0..q........u1.......d.,_(2....{:....{:...o3...,G(4....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe.config

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8652
                                                                                                                                                                                                                      Entropy (8bit):5.0365163839961
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ur71E7Ko7KPrzRafr/qmxr4qRdG64Gli6MMUwfKCUHO0UTOaUbUdUoUwSAOrH4Of:ur76797Orv8laHT
                                                                                                                                                                                                                      MD5:A827686F394D328B71146A50BC325237
                                                                                                                                                                                                                      SHA1:80FAC9C23E8614BEE42BCCF2F437AA6565468D33
                                                                                                                                                                                                                      SHA-256:FD199EDC328EA12EBEBB90EC7C8A743D2B83E22E8D0E6A7816D496DB891DF8A8
                                                                                                                                                                                                                      SHA-512:B644BB189C3BB1F974603E58CD19644912636ADA9EBD5B40F24444CD05D12FFCE10A15229853CEE813429BF062976434845FAFC657CD613ECA3A7158A4404065
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">.. <section name="Procore.Ditto.Settings.DeveloperOptions" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. <section name="Procore.Ditto.Settings.Settings" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <startup>.. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.1" />.. </startup>.. <system.net>.. <settings>.. <httpWebRequest useUnsafeHeaderParsing="true" />.. </settings>.. </sy

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:MSVC program database ver 7.00, 512*1427 bytes
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):730624
                                                                                                                                                                                                                      Entropy (8bit):3.879785868356058
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:1POkv6OovwplWNBwYt7fsaY+/104NF2dBd3LUgbX91n/xx75ryHljSQf+IrV8xdr:17+lt7fs3vRwIxNIhMdKac5vvSCLylr
                                                                                                                                                                                                                      MD5:AFCDFB57BDFC04EF1E523A05BF300224
                                                                                                                                                                                                                      SHA1:95F8C479373848E4EAD08EE4A1B0B06A7DB73FEA
                                                                                                                                                                                                                      SHA-256:5ED444120E294FD952D0F83AA6721E39DB964F7F1D28AF3C599AF925D33C62BA
                                                                                                                                                                                                                      SHA-512:A8F283BEA3763793B3A1C7B7A48446CAEE272F04777214DC616A4D9C3081A162BC50BF7041244DF4FFFE71E5D6C92EE5ABD9C09C6C5A139B9F88DD551E12E6B9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Microsoft C/C++ MSF 7.00...DS...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Remotion.Linq.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):182784
                                                                                                                                                                                                                      Entropy (8bit):5.775503868232327
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:nwnzA883Ay5wl7eLxZNZ1/aG4FoKEw4ztk6Etd/q7pCIeW174gfuAPKWoT0jt4We:t8Qm1eLzXJKoKEw4ztk6Etd/q7pCIeWD
                                                                                                                                                                                                                      MD5:F81CC998D21E09443972313793BB8F9B
                                                                                                                                                                                                                      SHA1:9F410AFD31C9347FD7E616B4D519D548709EAD98
                                                                                                                                                                                                                      SHA-256:3C7D5BE7674E29E21CA3F1E529CB6EC1ECAA63105032250BAD60D1756993485F
                                                                                                                                                                                                                      SHA-512:E27C2C066A59027D287E0423957665DA0DBEFC622267499BEBD178AF148F5119DD98F6E164DB208347157FFE81F8924E7BA32C0DC3415B6DC638A67004D195BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....zZ...........!..................... ........... ....................... ............`.................................P...K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......L.......................P ...........................................@.....z..zgEU..EG2!.`a_..+>..]........|...&bw...n.6....$..[f..}y..6>.6T..z.[.(.+.N.*.%N...v...G.N.Q?.f`=.K.....7g.\...:.(......}....*..{....*..(....*..0...........(.................(....*..{....*"..}....*..(....*..(....*&...(....*V.(......(......(....*..{....*"..}....*..{....*"..}....*..(....*..(....*..(....*"..(....*:.(......(....*..{....*"..}....*....0...........u......,..o.....(......*.*..(..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_green.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5120
                                                                                                                                                                                                                      Entropy (8bit):3.956203714736947
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:6X0+lAIcMFJbFSaqCAyZPnCPNM4+OuSoiWHQoPiLYtPz+J+yLsnOarSlfbZm:O/5FSGzZPnCr+1SoxHQ2AYtqmgd
                                                                                                                                                                                                                      MD5:9A6FD1B130CDFBA7CFB256995FD0251E
                                                                                                                                                                                                                      SHA1:6171361095AC8431DD3BAD38FE0888E756034C4C
                                                                                                                                                                                                                      SHA-256:E961424E2727B996904BD9C574003E23F15D4A640115BA43E872A8D7FF9E0E0A
                                                                                                                                                                                                                      SHA-512:502F565B636B71A785FC89DB9E2A3DE8832CA0B537E645CBC9E6CFF2BDC5C4DDBDCDB743C5BE53EB4CAFFB8264F6D5CF6231AA9AB169435C5F52E1AA896B529F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._.\.........." ..0..............(... ...@....... ..............................A&....`.................................8(..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................l(......H.......\ ..\....................'.......................................s....(....*BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID...$...8...#Blob...........G..........3................................................C.u.....u.....b...........-...&.-.....-.....-...c.-...|.-.....-...i.......-...............!.D.....D...?.D.....;...............D.=.....P ..............\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\...a.\...i.\...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.batteries_v2.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5120
                                                                                                                                                                                                                      Entropy (8bit):3.9561586633060912
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:6I+lo5SHtX7KQvCAyz3gOcIPNM4zOuSvNLSlLYtP16xyLsnOaqLlmSZm:y5NLNqz0OcIrz1Sv4BYtd6n6I
                                                                                                                                                                                                                      MD5:D4C512144BFB09050212FB8D6F2231A3
                                                                                                                                                                                                                      SHA1:6BB8046B0A36C127F000E285EEF6C89C5F871A88
                                                                                                                                                                                                                      SHA-256:CE9400D2354B7B4DBCE66E1F38529D9247C8FF15DE8ED2352C4FE859C13C1AA1
                                                                                                                                                                                                                      SHA-512:825813651C0038BA83040BB596272687FB1428E73D25556578C890C65D2C938532FC795432F1D2998DAAE1C7407BED95EC59A98AE784C0684B02B04F7E4ABFD6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._.\.........." ..0..............(... ...@....... ...............................(....`.................................0(..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d(......H.......\ ..T....................'.......................................s....(....*BSJB............v4.0.30319......l.......#~..@.......#Strings............#US.........#GUID... ...4...#Blob...........G..........3................................................j.|.....|.....i...........4...M.4.....4.....4.....4.....4.....4...........4...........-...H.k.....k...F.k.....b...............k.=.....P ..............c.....c.....c...).c...1.c...9.c...A.c...I.c...Q.c...Y.c...a.c...i.c...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):38400
                                                                                                                                                                                                                      Entropy (8bit):5.616105038862064
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:DplbqUHwwIAU0hLBb1reT8Ej+yg8cng1D+YfY/:DplL1ZrhLF1reT8E6t8Ey6/
                                                                                                                                                                                                                      MD5:E97D54AA785C978B9D9134AC56A6F2A0
                                                                                                                                                                                                                      SHA1:BDE7A50146E1EBF87989E3B5C34F379806A7DFFC
                                                                                                                                                                                                                      SHA-256:351EB5EBA1998E8E476D39383B71491951CBA9A35E2F8A88B30CDE6B6DB0B42F
                                                                                                                                                                                                                      SHA-512:DE16D7D1314B038C6B45D3F9FC9BEB775B75F3361AE1397CCA51A9D79E076963203F93B2C721AAC24002177C8F3734A3D7D208743CA808A41D5653255A05733C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._.\.........." ..0.............N.... ........... ....................................`.....................................O.................................................................................... ............... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................0.......H........-...{..................|.......................................FsW..............*Z~....,.*.o....&......*.......*....0..........~.......o......s....Q*...0..........~.........o......s....Q*:~.......o....*..o....,..*~.....o....o.....o....*..o....,..*~.....o....o.....o....*2~.....o....*F~.....o....o....*:~......o'...&*N~.....o......o(...*N~.....o......o)...*N~.....o......o*...*N~.....o......o+...*R~.....o.......o,...*N~.....o......o-...*R~.....o.......o....*Z~.....o.....

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SQLitePCLRaw.provider.e_sqlite3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):39936
                                                                                                                                                                                                                      Entropy (8bit):5.692896959760722
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:9h9lVz70mAJy7kAajBZklYaEOWvr3e/0p4dncL7Vmr:jF71AA7AOWvrO/tUUr
                                                                                                                                                                                                                      MD5:94C376B622C91186B0747A9FD6074F1D
                                                                                                                                                                                                                      SHA1:0E2FFD1C53CF62837E7407362899560C5ACADAC5
                                                                                                                                                                                                                      SHA-256:E522AD75E1670C85756C284E061BC6BA79B95805763DF431960D46724EA1BA27
                                                                                                                                                                                                                      SHA-512:B249996BBD8DDAC950628141197D23E97389215139307041B2B10046A4A00BACF6E6857AC9A05CD998892E7143BA452A8FBBD2D9246C74274EF9BE5C883C8A37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._.\.........." ..0................. ........... ...............................`....`.....................................O.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........:...v...........................................................~.....~@...%-.&~?.........s....%.@...o....*.0..........~.......o....,..o....*.s.........*...0..5........-..*(.....o.....X.../....(.......o......o..........*....0..%..........~....(....,.+...X...(.....0...X..*....0..<..........~....(....,+.(.......Y./.........Y(....(........io......*.0..1..........~....(...., ../........(....(........io......*..(....*..(......}......}......(....}....*2.{....(....*.0......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):33280
                                                                                                                                                                                                                      Entropy (8bit):5.665095862444878
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:0E4c3g4vuh+t/j7zAJ0eBHdDaXRrbNoihV0gZ:2ktt/Hk2eCXR9/p
                                                                                                                                                                                                                      MD5:C25357A7950DCFC7F85EE9D593CB1A24
                                                                                                                                                                                                                      SHA1:6A533712852465AB3C11B5C76004312D6482F07F
                                                                                                                                                                                                                      SHA-256:5B70DC2EECEB1963F9C3690C1CC8FFA793B280E903FA9A31780E6A7BB0BDFCF9
                                                                                                                                                                                                                      SHA-512:30CA628B17B2A51BD9974FE1380CAF728E7826C2BB552E4BC5AC15BE8F819E908FC1744932DB23734FEC64E0F2C758372D8C49D019407EFDFB076133C6DF70C6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^.H..........." ..0..x............... ........... ....................................`....................................O......................................T............................................ ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc..............................@..B........................H........=...V..................P.........................................(!...*^.(!......G...%...}....*:.(!.....}....*:.(!.....}....*..(!...*..(!...*..(!...*..{....*:.(!.....}....*..(!...*..{....*:.(!.....}....*..{....*^.(!......H...%...}....*:.(!.....}....*..{....*..{....*z.(!.....}.......H...%...}....*V.(!.....}......}....*..(!...*..{....*:.(!.....}....*..{....*:.(!.....}....*...0..,.............................................(....*.0..*...................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.Sinks.File.pdb

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Microsoft Roslyn C# debugging symbols version 1.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10852
                                                                                                                                                                                                                      Entropy (8bit):5.894275997148726
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:gB4d7haGWdGXY5JKhX9FdoMD1ATVVaCRd2Ahg48Z0aZTojArYEwhKlZ2KYDRr1Ak:gQ78ndTJKvFq+kVoCRddhuZMUMEw0Heh
                                                                                                                                                                                                                      MD5:F1AF59548261BE14DD1A0D5A10CADEC0
                                                                                                                                                                                                                      SHA1:411C5EB1B529AEC73F6A246AB965C25248701E14
                                                                                                                                                                                                                      SHA-256:0AE6BE9B8D7BA5B2D7AD09C9A0C2439671D6D419211199A86C3C6722E9FA6CF9
                                                                                                                                                                                                                      SHA-512:C2C12D8137774788C447C5BF735D8D090414E42A925EB5590A3AEDE7AA50D528323120A2D636602774B51CA54AAE4044E218154EB29B6FC52468A9F6FA142067
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSJB............PDB v1.0........|...p...#Pdb............#~......4...#Strings....,.......#US.0...P...#GUID...........#Blob.....q..*.H...JGG@........W...........k...'..._...................5....................................................................... ...........%.......3...........\...d.......................*...e...r.......................+...b...o...........................[...h...................'...4...t.......................................<...U...................6...O...................0...I...................D...S.............................Q...]...i...u...|................................................... .......1.......$...,...5...>...j...................................................................5...A...........................<...O...........................+...2...Z...................b.......................+...G...d...........................G.......*...7...T...}...................................................................................$.........

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Serilog.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):126464
                                                                                                                                                                                                                      Entropy (8bit):5.956128121745012
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:XfwtSQoXux2ogH8I/eXXXXXPXXXXXHXXXXXTaXXXXX14N0QXVsABFkNfM+HFukRb:PwtSQoXux2M3XXXXXPXXXXXHXXXXX2Xh
                                                                                                                                                                                                                      MD5:0AA45A8A1CD24CD2B589E4AAD925F35D
                                                                                                                                                                                                                      SHA1:0DC29954C4C2FFEA4C33AF0E56CE84158849B81E
                                                                                                                                                                                                                      SHA-256:7A26A473AF5EB7A00196E275C86D773F36E1D4CAEF566F97F1DF7E07E20B1670
                                                                                                                                                                                                                      SHA-512:7A865B16633C09BDECDA34FDF15C62DB4F04F2FB8DB0ABF57563AEA51DE67DAF9ECA0C08F053F551937A0C3C7987A53DE2454ECB13139A193291633DF7262981
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............." ..0.............".... ... ....... .......................`...........`.....................................O.... .......................@..........T............................................ ............... ..H............text...(.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............N............................................................{(...*..{)...*V.(*.....}(.....})...*...0..;........u......,/(+....{(....{(...o,...,.(-....{)....{)...o....*.*. ... )UU.Z(+....{(...o/...X )UU.Z(-....{)...o0...X*.0..b........r...p......%..{(......%q.........-.&.+.......o1....%..{)......%q.........-.&.+.......o1....(2...*..{3...*..{4...*V.(*.....}3.....}4...*.0..;........u......,/(+....{3....{3...o,...,.(-....{4....{4...o....*.*. .T.2 )UU.Z(+....{3...o/

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Converters.Wpf.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):147456
                                                                                                                                                                                                                      Entropy (8bit):5.917397529246561
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:5ga3ecshorHvfwP42TYFZy0cuAMC8fxTbEbD:e98dcYFZy0cuAc
                                                                                                                                                                                                                      MD5:B8C2955715EB88E62BC9CEC1686735FC
                                                                                                                                                                                                                      SHA1:E8315DDD96EB10B76B6B648AF85779D04B81049C
                                                                                                                                                                                                                      SHA-256:DAA799231FC3E487AE425D83555E41C0A7E92C84ED947B6CFCAA455FFC906E8C
                                                                                                                                                                                                                      SHA-512:EC3D1DB198B49C5D8D5976883030994A693E8D6B8F9C4F7125CC6AF8537B97F032AE96381444537ED03F5F62FDB0BA6958219A915FA4CF731446493FEF78E838
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U............." ..0..6...........T... ...`....... ...............................)....`.................................kT..O....`...............................S..8............................................ ............... ..H............text....4... ...6.................. ..`.rsrc........`.......8..............@..@.reloc...............>..............@..B.................T......H.......x2..(............J...... S........................................{-...*..{....*V.(/.....}-.....}....*...0..A........u........4.,/(0....{-....{-...o1...,.(2....{.....{....o3...*.*.*. Q... )UU.Z(0....{-...o4...X )UU.Z(2....{....o5...X*...0..b........r...p......%..{-......%q.........-.&.+.......o6....%..{.......%q.........-.&.+.......o6....(7...*v..(......}......}......}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*"..}....*..{....*..{....*"..}....*..{

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):186880
                                                                                                                                                                                                                      Entropy (8bit):5.885512045174915
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:kmMLuKPdOihRn5azyrqLpJxgW2MgnLHSQN7b47ZElsN8nzT6l1aw0BBmtE:kmM5PLTYWqLpJxgW2M9QNo7ZEnM0fmt
                                                                                                                                                                                                                      MD5:BC6D9B410B9CA2A2814D812DEA389631
                                                                                                                                                                                                                      SHA1:1A8B193BC12AA003698C780117174E8D5B42D1EA
                                                                                                                                                                                                                      SHA-256:7A4FC5A159F356C71F9AD764EB107CF6D07E4DC91F6D9CCF585B47B43EBA0BE4
                                                                                                                                                                                                                      SHA-512:93973BA1D635B47E80EE26BE1549E5955724613B9E3CB146268D350BE26A7B759872A861442E9FDA8D5ECD70B7823D71E172A2967A641541E9F3AA373562EEB1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0.................. ........... .......................@......rF....`.....................................O............................ ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........N......................p..............................................-....v....*.......uv....v....v....qv....v......*.......-....v....*.......uv....v....v....qv....v......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*2.s....(....*"..(....*..0............(......-..{.....o......*...0..)........{.........(....t......|......(...+...3.*....0..)........{.........(....t......|......(...+...3.*....0..).......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Css.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):93696
                                                                                                                                                                                                                      Entropy (8bit):5.505327452146448
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:w5D4Rl2u9QnIJeMHpZnnfPPPicAT9bzoR0:plB9QIXJZnnXPPicAT9b60
                                                                                                                                                                                                                      MD5:13DDBA589189EAB81C3636B8F3FCA0F4
                                                                                                                                                                                                                      SHA1:C6C2FFE17610F65556D945E53D6883ACFE8B5F49
                                                                                                                                                                                                                      SHA-256:F0DE32B012692B10519AAE7FB43247025110B0EAA59FC1F3F055528453D96192
                                                                                                                                                                                                                      SHA-512:3998AFB38D69ECEDF829FAF4EDA0074BE25CBFE470D3CAE24406A7AE1931E988199FFA463D01500C4ADB6CE3F3D7D00EB014CE067B4989E40A05085C622C97CA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]..........." ..0..d............... ........... ...............................\....`.................................V...O.......................................8............................................ ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............l..............@..B........................H...........l................... .......................................2.~....(....*f.(.....s....}......(....*..0..G........o....-..*.(....,..{....,..*.j.+..{......o....o....,..*..jX...o....7..*..0..7........o.......o.....1%~.....o.......+.......(......X....i2.*2.{....o....*..o.....1-.{.....o....&.{.....o.....r...po ...,...}....*..r...p(!...,...}.....{.....o....&*6.{....o"...j*....0..W.......~......{....o#....+..o$......r...p(%.....o&...-....,..o'.....o.....1....o.....Yo(...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Dom.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):34304
                                                                                                                                                                                                                      Entropy (8bit):5.442330354801151
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:6f2MnttCqTihbi1CVMCdCmgdx7kCWIGd+kAZn/0Ms6SzawpD446kkQwdHWtIB4:6f2KCqdvNWIGxAZMjb0/B4
                                                                                                                                                                                                                      MD5:3812D41B9A22ABD79429582E4556D2B6
                                                                                                                                                                                                                      SHA1:830BDAD7E09D87FCAE753D5571FFAA60FBF2186E
                                                                                                                                                                                                                      SHA-256:6B36C3FF1855C72D1780E1EDB9950D561A62B69E5A976E3620DE6320E744692C
                                                                                                                                                                                                                      SHA-512:8206163BD56C87E1935D0BB8026A72D0E17EA9621A981D48A4F97C70C850512FE0925C51AEB64900CCA4F988B2F830CD046962244AAD725964130741B584AB3C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t,..........." ..0..|............... ........... ..............................)<....`.....................................O.......|..............................8............................................ ............... ..H............text....z... ...|.................. ..`.rsrc...|............~..............@..@.reloc..............................@..B.......................H.......h?...Z..................l.......................................b......(*.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*6.{.....o....*V...(+.....s....}....*>.{.......o....*>.{.......o....*6.{.....o....*N.{...........o....*F.{.........o....*:.{......o....*:.{......o....*..(,...*....0............(-....o....u......,...o;...*6.{.....o....*V...(/.....s....}....*>.{.......o....*>.{.......o...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Model.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1072640
                                                                                                                                                                                                                      Entropy (8bit):5.85593465623031
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:blisGW3OXKcDu/JacepqwV1jnQxZdlCG3pFb6KtXX2nrfSNT6v2q6w:pisGoOXKcDOs
                                                                                                                                                                                                                      MD5:84FE02FA0312875DC0B6E01BB13F2C1D
                                                                                                                                                                                                                      SHA1:6A711C2C45BDDCA4CD700805DE0609FAD012C247
                                                                                                                                                                                                                      SHA-256:ECC1FD683A384EB61FEA97B774FE9408F25DD351399588F865B67AB91BA7EB61
                                                                                                                                                                                                                      SHA-512:87433444C7093822905C27E4C7B02E381AEC770ACCC5EC2C35D128FC1B9F1C7D57AB161C3B81599CE1798885849F92BDF8552E9D3446B44C96E259EDD43426E1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N............" ..0..T...........R... ........... ...............................]....`..................................R..O.......|............................Q..8............................................ ............... ..H............text....S... ...T.................. ..`.rsrc...|............V..............@..@.reloc...............\..............@..B.................R......H.......\?..............d....U..dQ........................................{M...*..{N...*V.(O.....}M.....}N...*...0..A........u........4.,/(P....{M....{M...oQ...,.(R....{N....{N...oS...*.*.*. $.. )UU.Z(P....{M...oT...X )UU.Z(R....{N...oU...X*...0..b........r...p......%..{M......%q.........-.&.+.......oV....%..{N......%q.........-.&.+.......oV....(W...*J.(O....sj...}....*f.{.....ov...,...}.....*.*J.{.....ow...,..*.*J.{.....ox...,..*.*....0..........(X.....(Y...-..{....(Z....+.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Gdi.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):112640
                                                                                                                                                                                                                      Entropy (8bit):5.954024364309941
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:ww/AzhOFKNFwqSN8wSFNyycWTQuF6AAe+igk:ww/UOF4wrNpoV4
                                                                                                                                                                                                                      MD5:F78D041D7BA675898B68C1E49B2D47D8
                                                                                                                                                                                                                      SHA1:9592C1347D79CC1EDB94435F079D734A84B22588
                                                                                                                                                                                                                      SHA-256:D5BEE13CDDED08D6C56C8B6BB194636FC6BF4E522D39CED2B75BC7B500199F85
                                                                                                                                                                                                                      SHA-512:3DA31B3773AB89D4E0AC6BBD24A08529011FC215219083D14B585E417897444C5B1165A6A76A9CC39CDB8EF020D290D5C3C5C28ECDF14495439E1D6DBC66888C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....TB..........." ..0.................. ........... ....................... .......{....`.................................Y...O.......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................X................................................0..g........-.~5...*.o6...9z....o7...o8.....9b....(9........YE............Z...............N.......................0...E...........8......(:........c;&......p;2......u;>...8......(:........a;<......h;H...8......(:........h5....a;@......h;q...8.......i;x......u;5...8......(:........b;m......i;y......t;....8].....(:........c;.......w;....8=.....(:........g;.......i;.......m;....8......(:........h;.......s;.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Rendering.Wpf.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):229376
                                                                                                                                                                                                                      Entropy (8bit):6.011258574702616
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:bP/hRp8ttf+57or5PDoieEe7q125vW3QWq83tVJ2:bP/+tf47or5Be205fYd
                                                                                                                                                                                                                      MD5:F65044B621D1CE74FE5B632041BD2F73
                                                                                                                                                                                                                      SHA1:8661D53A644AB512DFF0B6267C0769BA2FFE7239
                                                                                                                                                                                                                      SHA-256:F9A86A52B5C41D7128F66FD0D06949CCF25322531B59B02BEDA19925A5D853C0
                                                                                                                                                                                                                      SHA-512:D2A399B40B13F8B737B400F925B72199E1BA0589D9F0F3A16BFC924186B0E6707FC5F6FDED956E64308821E4C78C9EA7CAE4AF725F1E03980BCA5E32C80051F2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b{<..........." ..0..v..........B.... ........... ..............................bp....`....................................O...................................$...8............................................ ............... ..H............text...Pu... ...v.................. ..`.rsrc................x..............@..@.reloc...............~..............@..B................!.......H.....................................................................2.~....(....*:.(......(....*..{....*..~....}.....(....-..(....,...}....*.s....*..0...........r...p(5....~....}.....o.....3 .o ...~.....{!...("...,..o#...,.*.r...po$.....(....-"..(.............o%....{!...("...-t*.o.....3H.o ...r...p.{!...("...,R.r+..po$...r5..p.{!...("...,5..r[..po$...}....+".o......3..o ...~.....{!...("...-..o&...-.*..0..M........rg..p(5....~....o'....r...p.(.............o%...o(....r5..p.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SharpVectors.Runtime.Wpf.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):73216
                                                                                                                                                                                                                      Entropy (8bit):5.949080179915291
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:1TZQYATcOYRMsm0cKnAqSYnuqa6brKkiYIxlr8A:7dAjsCKAqSeuqHrOxloA
                                                                                                                                                                                                                      MD5:9D3C2F0ED900E4C87ABF5EBA7EE24510
                                                                                                                                                                                                                      SHA1:1892F2F2E4D7F4B08B4139D66EF6A602DBC07FDC
                                                                                                                                                                                                                      SHA-256:9BDC5B8DAD7C500C11B5BF9468E1E2A6E0257D9628D412DCBA2ED8381A3D7B6E
                                                                                                                                                                                                                      SHA-512:540062D476ADD2D43C90BD64B6B6777982B75F5A327575AA8D0207F11DB0449F360A5E20B2E8DABA8FB3A30574B6C09185D1961D46D00511ABE9EFA92925D287
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m..........." ..0..............1... ...@....... ....................................`..................................1..O....@.......................`.......0..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......xm...............*......d0......................................f.#.......?#.......?(....*&...(....*.0..S........(#....($...-..#........5.r...ps%...z.($...-..#........5.r...ps%...z..}......}....*..{....*..{....*..{....*F#......X@.{....Z*F#......X@.{....Z*..0..6.......r)..p.{.......r/..p(&...r;..p.{.......r/..p(&...('...*^.u....,...t....(....*.*...0.. ........{.......((....{.......((...X.b*.0..2........-..*.{........{....()...,..{........{....()...*.*f.-..-..,..-..*..o

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\SimpleInjector.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):445440
                                                                                                                                                                                                                      Entropy (8bit):5.850981616801001
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:Wm0hJDO/8ubmL4XotU5ng5UXCngF8u20DLWDdCi2D+KNus9s4EczL+IyB:P//8u/dclgF8F0jsE+tB
                                                                                                                                                                                                                      MD5:C00D1A98D23DFC7D6614BD674C3E9A78
                                                                                                                                                                                                                      SHA1:95C02FACFAD71762E3095C225EAC9683CA678BA6
                                                                                                                                                                                                                      SHA-256:E76FFA965E7B74E651A0A39A62334F1508C8DB0EE723972922CF30D09C05B8AC
                                                                                                                                                                                                                      SHA-512:D4D693E816420911988F1C13459BC0A8A0CCE3E53B8708683EC77746E559A2739B41238F28CB22EC628675CB62B3CFE391C2E737FBA671ECBA3F7EC9795D3761
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^o............" ..0.................. ........... .......................@............`.................................]...O............................ ......d...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......P.................................................................{<...*..{=...*V.(>.....}<.....}=...*...0..;........u......,/(?....{<....{<...o@...,.(A....{=....{=...oB...*.*. .w.G )UU.Z(?....{<...oC...X )UU.Z(A....{=...oD...X*.0...........r...p......%..{<.........."....."...-.q"........"...-.&.+..."...oE....%..{=..........#.....#...-.q#........#...-.&.+...#...oE....(F...*..{G...*..{H...*V.(>.....}G.....}H...*...0..;........u$.....,/(?....{G....{G...o@...,.(A....{H..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Buffers.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20856
                                                                                                                                                                                                                      Entropy (8bit):6.425485073687783
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
                                                                                                                                                                                                                      MD5:ECDFE8EDE869D2CCC6BF99981EA96400
                                                                                                                                                                                                                      SHA1:2F410A0396BC148ED533AD49B6415FB58DD4D641
                                                                                                                                                                                                                      SHA-256:ACCCCFBE45D9F08FFEED9916E37B33E98C65BE012CFFF6E7FA7B67210CE1FEFB
                                                                                                                                                                                                                      SHA-512:5FC7FEE5C25CB2EEE19737068968E00A00961C257271B420F594E5A0DA0559502D04EE6BA2D8D2AAD77F3769622F6743A5EE8DAE23F8F993F33FB09ED8DB2741
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..$..........BC... ...`....... ....................................@..................................B..O....`..@...............x#...........A............................................... ............... ..H............text...H#... ...$.................. ..`.rsrc...@....`.......&..............@..@.reloc...............,..............@..B................$C......H........'...............?..X...8A......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*B.....(.........*R.....(...+%-.&(!...*^.....("....(...+&~....*.s$...*"..s%...*..(&...*.*....0......................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Collections.Immutable.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):180096
                                                                                                                                                                                                                      Entropy (8bit):6.144379148099784
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:gUbJLl+WMe7FJ02NPhVN0T2rcoNXvUJ4C0jucx2ejoVjM4xT56pL:gUVMWNvrxUJ4CDcY5G
                                                                                                                                                                                                                      MD5:8F55C22412F7D448D6E7B83102665368
                                                                                                                                                                                                                      SHA1:88DF86EE0B137992AF15A35825804274FA252E30
                                                                                                                                                                                                                      SHA-256:67730917B4E856E37A9D78245527584087FAC6B20A7377677B2F444CD15DB918
                                                                                                                                                                                                                      SHA-512:058431AA2280511B00A72EA55DED9BDAEF55420F5BCE10C9352D4F92736A11884D1E70706016B988CCA560358B3B43CE1BAD5C9BD726F11D8AD66E3C91F98CCB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....A..........." ..0................. ........... ..............................IX....`.....................................O........................#.............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H...........\...........@...(...h.........................................(....*..(....*^.(.......U...%...}....*:.(......}....*:.(......}....*:.(......}....*..*.0..1.......(....,..%-.&.*..(.....o.......&...,...o....,..*.*....................(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*..,&(....,..r...pr...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*...(....*.(....,.r...p...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ComponentModel.Annotations.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):43152
                                                                                                                                                                                                                      Entropy (8bit):6.137234963318556
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:GnXppnvYs47bNql0kevR9SDQxSWIfYYL8oRT3KI3lUlBmeEZeTfyDxdQocwc1fVZ:gXDQsPurQcR3y6JOnSHDYFD9VioLQJ
                                                                                                                                                                                                                      MD5:7D3D14B0417A68CCDD9C51972FF74863
                                                                                                                                                                                                                      SHA1:CEACBD53B6A02E1F7337A6B0058924E1E11949BB
                                                                                                                                                                                                                      SHA-256:04113C8549185519F3202790CEB23DF609644872B9C249A56D2BCF59566102C4
                                                                                                                                                                                                                      SHA-512:B2D133214F21D700E1AF0C248DCC11EF66EA6DA62043FF6D5E900FE2A1665D75583E4CD218526A146F2C62E22ADF4CA2FA3B8879AE0F5A2E515E2C3A5184CE9C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0..Z..........Bx... ........... .............................../....@..................................w..O....................j...>..........8w............................................... ............... ..H............text...HX... ...Z.................. ..`.rsrc................\..............@..@.reloc...............h..............@..B................"x......H........$...............R.. $...v......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2r=..p.(....*2r}..p.(....*2r...p.(....*2r...p.(....*2r%..p.(....*2r]..p.(....*2r...p.(....*2r/..p.(....*2r...p.(...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Data.Common.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):146616
                                                                                                                                                                                                                      Entropy (8bit):5.463575796974816
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:6HOdYYWm6xNUw/1/jb3fx0vLBblQ6NdkaZbyYSI4Zki+BReD4pK/uYx0BekV7813:NdY3x6oxjLx0vBzZbDSzZ8B0uA0BeIA
                                                                                                                                                                                                                      MD5:4EC7C87D3C8820C20E8C2EF80D80D363
                                                                                                                                                                                                                      SHA1:1FEABEBF78539D5E7316BC4352B4383D239FD438
                                                                                                                                                                                                                      SHA-256:4FE23DD147813C0B724B62FCFC0CE419E9A4AD36F3DA4CC43E5DA97D796E289E
                                                                                                                                                                                                                      SHA-512:2504DFED8DCF4F5C1CC56CB9EBCB03833CFB6837D0592F82DBDBC28899B6F1AAE2E007E0175AD7544FF13B017F3063145E1826267A5DFAEA91BE182ACCA3C5BB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............B.... ... ....... .......................`.......v....@.....................................O.... ...................>...@......T................................................ ............... ..H............text...H.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................#.......H.......|8..............l!..h...........................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r;..p.(....*2ro..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rK..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2rM..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.DiagnosticSource.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):58504
                                                                                                                                                                                                                      Entropy (8bit):6.348499100309825
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:2C5mb2//6hDjsgXj55UJ6DwrKts7EK5m2yFVBg6WZZjbUpUhD1Vi5tL+v:2CYb2/CRv5M6jtUZjQUhRVCNA
                                                                                                                                                                                                                      MD5:7EFAC59FC8919FFAA25FE733996573D6
                                                                                                                                                                                                                      SHA1:CC1520C5D5734683BC1DF93B2EB352EFD539199A
                                                                                                                                                                                                                      SHA-256:B1A2164C7B68C4F7BA4E97A026F303A1AA4305B7FFF6B459A99C49D4D84167DA
                                                                                                                                                                                                                      SHA-512:C965BAE3AC434A2E916E93550DC0370CF1E9876D0A941EE28F7FCA7693BDB82BF5CAF6523EABE5AF4122F3AFB0D7FD175CF1E6E08D4A920C76824B0B65046F3B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.................. ........... ...............................M....@.................................h...O........................>..........0................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........I...l..............0.............................................{!...*:.(".....}!...*..0..#........u......,.(#....{!....{!...o$...*.*v ..yN )UU.Z(#....{!...o%...X*....0..M........r...p......%..{!....................-.q.............-.&.+.......o&....('...*..{(...*:.(".....}(...*.0..#........u......,.(#....{(....{(...o$...*.*v ..:. )UU.Z(#....{(...o%...X*....0..M........r-..p......%..{(....................-.q.............-.&.+.......o&....('...*..{)...*..{*...*V.("...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.StackTrace.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23264
                                                                                                                                                                                                                      Entropy (8bit):6.774646602911335
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:y3FfF4YVxWfOWqWWOWS3szm0GftpBjBvYsaQHRN7CblUaaTJcYq:yVfFGCi8zViD3LCmN0
                                                                                                                                                                                                                      MD5:C20C268EABDCC95DA38AD646A0AA0310
                                                                                                                                                                                                                      SHA1:3760E870DFCFA41071E5B39CCA59265657B3715B
                                                                                                                                                                                                                      SHA-256:E932B25F50E3B09DD7759FF5B9E9ABFA8FC115EA171B768164AE21387FEAC7E8
                                                                                                                                                                                                                      SHA-512:422F8F7A50F457EB979652B14A6C06A51A6A94C7EB9F56045A4B944ACBE3026580465AEFFFD9F30A4334A556FA1EED8488DB0766C16D637023E72B579A26DFCF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............*,... ...@....... ...................................@..................................+..O....@...................>...`......$+............................................... ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..T....................*......................................BSJB............v4.0.30319......l.......#~..L.......#Strings....h.......#US.p.......#GUID...........#Blob............T.........3............................................................................!.X.........I.................s.....).....B.....`.....}.....].......................5.k.............................R.....R...!.R...).R...9.R...A.R...I.R...Q.R...Y.R...a.R...i.R...q.R...y.R.....R. ...R.&.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Diagnostics.Tracing.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31448
                                                                                                                                                                                                                      Entropy (8bit):6.616838441934921
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:AlQnCMi33333333kj8xe+5PTYM3zUy+CezHjzgwj0uzWOdWmWJdWD3szm0GftpBO:uQq33333333kX+Trk8o8zVi6wLtuCq
                                                                                                                                                                                                                      MD5:482573CB18B537A7415DCC00C906611D
                                                                                                                                                                                                                      SHA1:4377161FBD9644953471A94021DF437F21FE83E6
                                                                                                                                                                                                                      SHA-256:D4A59FB62D8A7A138A49911110F8B2AB416196DF95F4CFC599ABB6EC61629E5E
                                                                                                                                                                                                                      SHA-512:AA96E1544FD0286FB1D6A77B8ACE8745F69EC4835CF0957C457AA3026B4AD5EC02E953C7BC106D80205109A85512D1DF99AB3DE7D41300E96858298AE5767FE5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............RM... ...`....... ...............................:....@..................................M..O....`..x............<...>..........PL............................................... ............... ..H............text...X-... ...................... ..`.rsrc...x....`.......0..............@..@.reloc...............:..............@..B................4M......H.......8*...!...................K.......................................0..H........(.....-.r...ps....z.-.r...ps....z.(......}......(#...}.....{.....o....*"..(....*....0..Z.............%.r#..p.%..{.....%.rA..p.%..{..........%.rS..p.%..{....l.{....l[...ra..p(.....(....*&...{....*.0..4.................}......+....{.....".......X.....{.....i2.*.0..k..........{........{..........."....(.......X....{.....i.0%.(..........(.....(.......,..(........"....3.....}....*.......=..M......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Globalization.Extensions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24296
                                                                                                                                                                                                                      Entropy (8bit):6.79992817760312
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ne3E7jRb4HFg1RPWYR1Rw0R9WYRPWYRDRj0R9W13Em0GftpBjTjRlaQHRN78JRjT:naMFUgzNzwu/NljusUViDlL8f9Lx
                                                                                                                                                                                                                      MD5:8DE05921A38C0FF54E6D4B4ED0C32235
                                                                                                                                                                                                                      SHA1:5BA1692964F8732D2CAAFA6A8D1009DFB8B4A764
                                                                                                                                                                                                                      SHA-256:F690794A0296D8DAD4F30D626A8A89121DF51B5909E440DA08707B09518D040E
                                                                                                                                                                                                                      SHA-512:B7DAE61979760224EDDC28C717B78AABDCDE2C9ACD3659958041D08B44CDA12E9D62F15B436691213771A4B32714BD78D54D2BA4C90471FC7BFF4BF274C66C07
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............1... ...@....... ....................................@.................................N1..O....@............... ...>...`.......0............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................1......H.......|!.............../.......0......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~..l...0...#Strings........4...#US.........#GUID...........#Blob...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.IO.Compression.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):110784
                                                                                                                                                                                                                      Entropy (8bit):6.432343245052119
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:rvc/U5yNq2oS4Zd0LE3YigSFvhoZONK3aAYHtTfXmNoJXRVnwmk1:Lgk1tiLMYiDFvEqrNDWNoJXLRY
                                                                                                                                                                                                                      MD5:B2CE49C37351D7A7471CD20C9E02B6E9
                                                                                                                                                                                                                      SHA1:44EB7732131B4B1B25EA8D023C3D2F544E017F24
                                                                                                                                                                                                                      SHA-256:76FCACCF84313BF78F523B3BC8198C2D040DABDC04A5DC863B46C8AF7AC10A88
                                                                                                                                                                                                                      SHA-512:40980B050861F7C4F1ED5B71F7F7FD91052FCFC1C49B7B3490D9A4FD68FEC8FD3C95AF38D113ABA8E7F1CE2B4CEADD1B6D66C5D1EA68064EC6265C266BE1AFC5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..d...........W... ........... ..............................*.....@.................................6W..O....................r...>...........V............................................... ............... ..H............text....b... ...d.................. ..`.rsrc................f..............@..@.reloc...............p..............@..B................jW......H........................9.......V......................................j~....%-.&(I...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2r7..p.(....*2rs..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r=..p.(....*2r_..p.(....*2r...p.(....*2r...p.(....*2r...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Interactive.Async.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):252344
                                                                                                                                                                                                                      Entropy (8bit):6.419090266327684
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:sOmrUvPIuppGOQHd9nHTUYK2r7ckIHEHLYNWkZ:svyKtdYUkZ
                                                                                                                                                                                                                      MD5:CC8E2AE24FDD4512BB9381574E6AE124
                                                                                                                                                                                                                      SHA1:56C4868E8C1865DA862DCED7283C7D97319149F9
                                                                                                                                                                                                                      SHA-256:C3A50929E93C6C8C5AC799A596FA1131A0123EB4E9178B073994D01759DC2E1A
                                                                                                                                                                                                                      SHA-512:C7A306D90F45265078D9D11F8704E4043C4397FCA728E737608DBA2D603B4E07D7A6BBC483B566DD3FF26562613C74422D7A89973770DB922FAD689CB62FA89E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a..........." ..0.............>.... ........... ....................... ......I.....`.....................................O.......T............................l..p............................................ ............... ..H............text...D.... ...................... ..`.rsrc...T...........................@..@.reloc..............................@..B................ .......H........................k..8...Dl......................................^.(...+......(...+.....*.0..A..........}D......}E.....(F...}G......}H....{G........(...+..|G...(J...*....0..A..........}K......}L.....(M...}N......}O....{N........(...+..|N...(Q...*j.-.r...psR...z.(S...oT...*..-.r...psR...z.-.r%..psR...z.-.r=..psR...z....(S...(...+*..-.r...psR...z.-.r%..psR...z...(S...(...+*..-.r...psR...z.-.r%..psR...z..(S...(...+*..-.r...psR...z.-.r%..psR...z.-.r=..psR...z......(...+*..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Memory.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):141184
                                                                                                                                                                                                                      Entropy (8bit):6.115495759785268
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
                                                                                                                                                                                                                      MD5:6FB95A357A3F7E88ADE5C1629E2801F8
                                                                                                                                                                                                                      SHA1:19BF79600B716523B5317B9A7B68760AE5D55741
                                                                                                                                                                                                                      SHA-256:8E76318E8B06692ABF7DAB1169D27D15557F7F0A34D36AF6463EFF0FE21213C7
                                                                                                                                                                                                                      SHA-512:293D8C709BC68D2C980A0DF423741CE06D05FF757077E63986D34CB6459F9623A024D12EF35A280F50D3D516D98ABE193213B9CA71BFDE2A9FE8753B1A6DE2F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0.................. ... ....... .......................`............@.................................X...O.... ..0................#...@...... ................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H........,................................................................('...*>..}......}....*..{....*..{....*..{.....{....3..{.....{....((...*.*..0...........%.u....,..........(....*.*z.{....%-.&.+.o)....{....(a...*..(....zN........o*...s+...*.(....z.s,...*..(....zF(U....(O...s-...*.(....z.(V...s-...*.(....z.s....*.(....z.s/...*..(....zN........o*...s0...*.(....zrr...p(\....c.K...(O...s1...*.(....zBr...p(Y...s1...*.(....z.s2...*.(....z.(X...s3...*.(!...z.(_...s3...*.(#...z

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Http.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):198464
                                                                                                                                                                                                                      Entropy (8bit):6.151150327815787
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:reruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/1v6RpZ8dwPS1TIm:WW60VcTvakcXcApVh
                                                                                                                                                                                                                      MD5:5A5E18C377228FDB1D3DB74F1140C1BF
                                                                                                                                                                                                                      SHA1:E36366D2CCB64AEBCC9DF8FD7FADC7A9BB562AF7
                                                                                                                                                                                                                      SHA-256:8646A26A64928866BBE8746F3323A1F446C5A28C10B6B81DF9BF4A08336B8C02
                                                                                                                                                                                                                      SHA-512:0C308B29FEBFB5D4CB52BD3B7B0C61A5844EBF1BDF305BE2B89FB0F5040F52ABD8557E9C4245A4F35C527A23674F1AE97BB12CC3A02A7DD7C8387208FCC73152
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.................. ........... ....................... ...........@.....................................O.......h...............@?........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...h...........................@..@.reloc..............................@..B........................H........$..H...........$....,...........................................0..,........ ....1.r...ps0...z.............(.....s1...*.0..l........J.2..J.o2...2.r...ps0...z..Jo3....%36.o2....JY.2*..J.Xo3.....J.Xo3...(...... ........J.XT.*...J...XT.o3...*..o2....Y./..*..o3....%3 ...Xo3......Xo3...(.... .......*.*..0..=..........J...XT..%....J...XT.~..... ...._.c.....J...XT.~......._..*....0............02...91...A2...F1...a2...f1. ....*..91...F1...aY+...AY..X+...0Y...02...91...A2...F

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Net.Sockets.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):23224
                                                                                                                                                                                                                      Entropy (8bit):6.809094648714493
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Wjt4Yn8fcWS9sWPW8YsWA3szm0GftpBjEKTPcaQHRN7ilPLM:UuoMK8zVi66ELOg
                                                                                                                                                                                                                      MD5:B59AF5CBDDAFDC5DC5FF3E34533D6857
                                                                                                                                                                                                                      SHA1:DEDE511B5270D55E306E1A744E4BC0384A35C8BE
                                                                                                                                                                                                                      SHA-256:A4B4BB8B9BE478600F48E43AE8571E6C123F8130923067F10FC92546D0900FB6
                                                                                                                                                                                                                      SHA-512:4E0104C8A650943D8680F0BD449D4B953B25FF909BF50BE19772E88295F9CE7542F29211528E20B4AD798D26251A50211EEEA8685E3D81FAB72DF1380CA6B984
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..............-... ...@....... ...............................8....@.................................8-..O....@...................>...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................l-......H.......P .......................,......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID...........#Blob............T.........3..........................................p.........E.............l.....l.....:.....................a.....~.........................................U...........+.......M.........o...................4.....4...!.4...).4...9.4...A.4...I.4...Q.4...Y.4...a.4...i.4...q.4...y.4.....4...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Numerics.Vectors.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):115856
                                                                                                                                                                                                                      Entropy (8bit):5.631610124521223
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
                                                                                                                                                                                                                      MD5:AAA2CBF14E06E9D3586D8A4ED455DB33
                                                                                                                                                                                                                      SHA1:3D216458740AD5CB05BC5F7C3491CDE44A1E5DF0
                                                                                                                                                                                                                      SHA-256:1D3EF8698281E7CF7371D1554AFEF5872B39F96C26DA772210A33DA041BA1183
                                                                                                                                                                                                                      SHA-512:0B14A039CA67982794A2BB69974EF04A7FBEE3686D7364F8F4DB70EA6259D29640CBB83D5B544D92FA1D3676C7619CD580FF45671A2BB4753ED8B383597C6DA8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0..v............... ........... ..............................DF....@.................................f...O........................>.......................................................... ............... ..H............text....u... ...v.................. ..`.rsrc................x..............@..@.reloc..............................@..B........................H........Q..|?..........$... ...D.........................................(....*&.l(....k*&.l(....k*..l.l(....k*..l.l(....k*&.l(....k*&.l(....k*&.l(....k*j~....%-.&(....s....%.....*..*.0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2rG..p.(....*2r...p.(....*2r...p.(.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.Linq.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18896
                                                                                                                                                                                                                      Entropy (8bit):6.979332723730078
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:AXnEubrScMYsK/WFkXZSZmZP0g/aULDgf2haPZ:fm9UK+FkL0pWUf2hah
                                                                                                                                                                                                                      MD5:B5083064CA9781BA4CEBA4C3F23F8776
                                                                                                                                                                                                                      SHA1:91A43D0979C1BB06AA3998AF2585EA70E1B46FB8
                                                                                                                                                                                                                      SHA-256:D611DC7D933A63363EE9FF4A38D267ADBE132067B3832D6195053428B6FFDD79
                                                                                                                                                                                                                      SHA-512:1F6B3A9FD434FD16663441EB53609DE4D725A4B49E0D5D3F41B45BAA7D31D8A068E4059D72B080D99CB742E2D11814F60AF4F6E5AAF8F458A3DCD26992216979
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.. ...........?... ...@....... ....................................`.................................U?..O....@...............*.......`.......+..p............................................ ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................?......H.......P ......................T+......................................BSJB............v4.0.30319......l...x...#~......p...#Strings....T.......#US.X.......#GUID...h.......#Blob......................3................................&...............j...............................8.....8.....8.....8...M.8.....8.....8.....`...........{.....{.....{...).{...1.{...9.{...A.{...I.{...Q.{...Y.{...a.{.......................#.....+.7...3.p...;.....C.....K.....S.....[.I...+.c.........p.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Reactive.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1456592
                                                                                                                                                                                                                      Entropy (8bit):6.154150814769915
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:ogLZGSNKw0cM1PWq2Nw7MyJHAAlpt7hGj5LG+3USQrzLvHoipC6bbsw5a7iabomA:z989VFAAlpt7hSVSowlaMmA
                                                                                                                                                                                                                      MD5:0099C6E7AC47455A8661516D2F18C2CD
                                                                                                                                                                                                                      SHA1:1836C64A831F6C882DDCAED2F91D6EFDC0B956ED
                                                                                                                                                                                                                      SHA-256:EAFA9A048B8F5D0CC13098B3F078A29B49090D9B24EBE69021C78B9AE5BC077A
                                                                                                                                                                                                                      SHA-512:98E966032736E0C857133A8CEC2FB84D2A3D7D23161EE87E6CE7FD7BC468D9842BFFAE5FE4EDE091E07E5A668D5034D0E211BE577DA406B2A5CAEED1A52C87F5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]A............" ..0.............~.... ...@....... ...............................6....`.................................,...O....@..p....................`......xO..p............................................ ............... ..H............text........ ...................... ..`.rsrc...p....@......................@..@.reloc.......`......................@..B................`.......H.......p_..`............=..(....N........................................(:...*..(:...*^.(:..........%...}....*:.(:.....}....*:.(:.....}....*V!..4.....s;........*..-.r...ps<...z.~=...~q...~p...s>...o?...*..-.r...ps<...z.-.r...ps<...z..~q...~p...s>...o?...*..-.r...ps<...z.-.r...ps<...z.-.r...ps<...z...~p...s>...o?...*..-.r...ps<...z.-.r...ps<...z.-.r-..ps<...z..~q....s>...o?...*...0..G........-.r...ps<...z.-.r...ps<...z.-.r...ps<...z.-.r-..ps<...z....s>...o?...*..-.r...ps<..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Runtime.CompilerServices.Unsafe.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18024
                                                                                                                                                                                                                      Entropy (8bit):6.343772893394079
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
                                                                                                                                                                                                                      MD5:C610E828B54001574D86DD2ED730E392
                                                                                                                                                                                                                      SHA1:180A7BAAFBC820A838BBACA434032D9D33CCEEBE
                                                                                                                                                                                                                      SHA-256:37768488E8EF45729BC7D9A2677633C6450042975BB96516E186DA6CB9CD0DCF
                                                                                                                                                                                                                      SHA-512:441610D2B9F841D25494D7C82222D07E1D443B0DA07F0CF735C25EC82F6CCE99A3F3236872AEC38CC4DF779E615D22469666066CCEFED7FE75982EEFADA46396
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ksa...........!.................6... ...@....@.. ....................................@..................................6..K....@..............."..h$...`.......$............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......D%..<...................P ......................................_...+.'g.......x2..}}...B.O....T...e..?.M..R"M.~pg..c..LD#..y.....y....:u.v*...#.;.-.h.......0..#.....a5|T%W...].!.%'..9.0...........q....*..0..............q....*...0..............q....*...0.................*.0....................*..0....................*..0............q.........*....0............q.........*....0............*..0..........*....0................*..0...............*...0..............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Runtime.Serialization.Primitives.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26888
                                                                                                                                                                                                                      Entropy (8bit):6.643670774301852
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:qO/Ll27yzDVfHWFgQBVWeHWFyTBVW4XRm0GftpBjCYP0aQHRN7Dy9l4aRIS0:lh+ypqgQBfqyTBVViYYsLDnA0
                                                                                                                                                                                                                      MD5:A84B438DBD4DF29560EEB5765E03723A
                                                                                                                                                                                                                      SHA1:37DE951F703687CF061556B1A52C6F548CBF779E
                                                                                                                                                                                                                      SHA-256:A576D1609CC08C46A46CE708B7FDAE33452A3BEFB701128A5BC9D6FF1F1B6DFD
                                                                                                                                                                                                                      SHA-512:EE6855BCA6EE6FF8AC7CE5C0565CCC77C35E5F1B3096F1EDE2C018D3364683BC289C6C520472BA46E174FDBD821EA673BFFA7DABC9358CE4C86D26F0C08FCC7C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............Z8... ...@....... ..............................:.....@..................................8..O....@..8............*...?...`......<7............................................... ............... ..H............text...`.... ...................... ..`.rsrc...8....@......................@..@.reloc.......`.......(..............@..B................:8......H.......|!..............L1..p....6......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*......(....*..BSJB............v4.0.30319......l.......#~.. .......#Strings........4...#US.........#GUID...........#Blob...

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.Cryptography.Algorithms.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):44816
                                                                                                                                                                                                                      Entropy (8bit):6.127690865006285
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:57EsZ/sfMlkvhXQiOk5jpemwgRAkQnMQCbeCoa6IsLr4mF72r2KOfWmzYcroOhve:p/pkomj7qjeaWKs0SSF++VigLcLf
                                                                                                                                                                                                                      MD5:79C6FA92DBA0C34DB2C412BFA62E48A3
                                                                                                                                                                                                                      SHA1:583A3E0F870ECE6419350A8656D7D4AC21746F1B
                                                                                                                                                                                                                      SHA-256:A83CA72A33172E977D7FFF1E96FA6CBAC6BEFE86DCA21D651C04578210325225
                                                                                                                                                                                                                      SHA-512:386AB22AA5299C5D4FB3D8B551F97C916129F05FA87D4D3D90B58BE1CC304FFD3431B0B5402A0A77F2DB64B713F31BA60B3D006D0F01EB5A5195A4307ED7F590
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0..`...........~... ........... ...............................C....@..................................~..O.......8............p...?...........}............................................... ............... ..H............text....^... ...`.................. ..`.rsrc...8............b..............@..@.reloc...............n..............@..B.................~......H........$..$3...........W...%..8}......................................j~....%-.&(F...s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rI..p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r...p.(....*2r9..p.(....*2rm..p.(....*2r...p.(....*2r...p.(....*2r=..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Security.SecureString.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22240
                                                                                                                                                                                                                      Entropy (8bit):6.811891410080919
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:zbdbvWApWmWTpW4sngm0GftpBjKaQHRN7bsZlPLnI:zFrykngVi4L4U
                                                                                                                                                                                                                      MD5:A6DE3093FFB397AF3E4D2A91FA46B738
                                                                                                                                                                                                                      SHA1:FB9FF696F96BB574EBD40C2AC9C980FE45AB0F84
                                                                                                                                                                                                                      SHA-256:9239DE3543EA4DCF71AD86F16AA23EEB760566BC69078925900D0E41EEC859AC
                                                                                                                                                                                                                      SHA-512:3EC05A1DE21EC4C96D6137788A868342AADE033B2D6E9ED7972C8FBEF3503CD03DD4728BA34E37C577AC301C056BB8C142516332C31D2F131599021A307DA86B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............Z(... ...@....... ....................................@..................................(..O....@...................>...`......X'............................................... ............... ..H............text...`.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................;(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......<...#Strings....P.......#US.X.......#GUID...h... ...#Blob......................3......................................................Y.....-...........A.................@.................X.....u.....*.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.....;.....C.9...K.Y...S.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Encodings.Web.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):76904
                                                                                                                                                                                                                      Entropy (8bit):6.044596523315333
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:HOOuOOOoODVoXY9BnEf8uOxvW8hYEWroNFMRwkTuMd:VDGXmnEUuOx+8KEWrobMRzuq
                                                                                                                                                                                                                      MD5:BA1AF3BBFF4D457B6D3F730234C3C701
                                                                                                                                                                                                                      SHA1:1B75BC14DAA093502C7C5814852928E28AB6659A
                                                                                                                                                                                                                      SHA-256:78EB5B4FEE580E163D1BEA1FDB7D371FDFCFD30ACD8708FF62C4372AAA219F7C
                                                                                                                                                                                                                      SHA-512:51895C9B0EDE088B034C581AB4574A36F80E41F2B04186B3C066B6D72DA85680E00EA5E07DC9C89DB7D997C1AD3D9686ACCDC827859EAAB2918376C4C9E469B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............v.... ... ....... .......................`............`.................................#...O.... ..................h$...@......8...T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................W.......H........l..T...........0.................................................('...*..('...*..('...*^.('......7...%...}....*:.('.....}....*:.('.....}....*:.('.....}....*^.('......8...%...}....*:.('.....}....*.0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X((.....R...((.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X().... ...._.S...().....d.S*..0..&.........+....(*...G...Z.(......X....(+...2.*...0....................(+.....1...(+....Z.9.....(...+

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Text.Json.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):513128
                                                                                                                                                                                                                      Entropy (8bit):5.9701629217973755
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:xJBN/XZToL9giIvDwGueSK+9V2VeLs2JkJiNqh1+hV765g:XHmLjsDwGjSK+9V2VYs2SJN5g
                                                                                                                                                                                                                      MD5:0AC9D215C380FE4B1FA48408D16243AB
                                                                                                                                                                                                                      SHA1:023D71EB9609CD65B855F3A671639B13AB19D9B4
                                                                                                                                                                                                                      SHA-256:D125F0F7E2EC4209E1476461A3BE2E05F82627E1AD11CEBE3872C0E754911850
                                                                                                                                                                                                                      SHA-512:D4AF1AD6FC1882676834F446B4D72E1375CD8B5887EAA08FAFF852480A5B4561A4F01EA83F191940AA7A5604F6BEEA02A202239575E35D825BA9F5862962E49E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{..........." ..0.............J.... ........... ....................... .......r....`.....................................O.......................h$..............T............................................ ............... ..H............text...X.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................).......H............>...........U...f............................................(H...*..(H...*..(H...*^.(H..........%...}....*:.(H.....}....*:.(H.....}....*:.(H.....}....*....0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(I.....R...(I.....d.R*....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(J.... ...._.S...(J.....d.S*..0..&.........+....(K...G...Z.(......X....(L...2.*...0..............n.....(L.....1...(L....Z.......(...+.+...(L....Z........sN..............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Overlapped.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25816
                                                                                                                                                                                                                      Entropy (8bit):6.721972796724283
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:1V7z0MHKyOHsHb7AQH0gPsWHQHjWJZWaWsZW3KDzDm0GftpBjSgaQHRN7wl4aRIt:1V/Fhoq5VViMgLdAO
                                                                                                                                                                                                                      MD5:C8CE5A96458742641AB9752B5B564039
                                                                                                                                                                                                                      SHA1:B3315E3657442F82B9A84E9ADE610846D183CAD1
                                                                                                                                                                                                                      SHA-256:A74A34E69B5226F0EE4882F7AC1FC0A88602139ED439202C5FC5C8ED489BFA11
                                                                                                                                                                                                                      SHA-512:16D4C5180ED313C10886C1E411BF38B5B664D5D3E1B9CB1CDE2D6DDF9EFE39367A792E818636B5E12F90A027C68347A546BF43B386195F50904BD9B5882A005E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............~7... ...@....... ....................................@.................................*7..O....@..x............&...>...`......x6............................................... ............... ..H............text........ ...................... ..`.rsrc...x....@......................@..@.reloc.......`.......$..............@..B................^7......H........!..4............1.......5......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*2r...p.(....*2rK..p.(....*2ry..p.(....*2r...p.(....*2r...p.(....*2rc..p.(....*......(....*.BSJB............v4.0.30319......l...|...#~..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Threading.Tasks.Extensions.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25984
                                                                                                                                                                                                                      Entropy (8bit):6.291520154015514
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
                                                                                                                                                                                                                      MD5:E1E9D7D46E5CD9525C5927DC98D9ECC7
                                                                                                                                                                                                                      SHA1:2242627282F9E07E37B274EA36FAC2D3CD9C9110
                                                                                                                                                                                                                      SHA-256:4F81FFD0DC7204DB75AFC35EA4291769B07C440592F28894260EEA76626A23C6
                                                                                                                                                                                                                      SHA-512:DA7AB8C0100E7D074F0E680B28D241940733860DFBDC5B8C78428B76E807F27E44D1C5EC95EE80C0B5098E8C5D5DA4D48BCE86800164F9734A05035220C3FF11
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....jM^.........." ..0..8...........V... ...`....... ....................................@..................................V..O....`...............B...#..........PU............................................... ............... ..H............text....6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................V......H........0...$...................T........................................(....*..(....z..(....z2.(....s....*2.(....s....*:........o....*.~....*~.-..(......}......}......}....*~.-..(......}......}......}....*Z..}......}......}....*J.{....%-.&.*o....*^.u....,........(....*.*~.{.....{....3..{.....{......*.*&...(....*2...(.......*....0..'........{......,..u....%-.&..(...+(....*(....*n.{....,..(....s....*.q....*..0..a.........{....o0.....,;..{....o2...(......;...3.~.......s......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.ValueTuple.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25232
                                                                                                                                                                                                                      Entropy (8bit):6.672539084038871
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
                                                                                                                                                                                                                      MD5:23EE4302E85013A1EB4324C414D561D5
                                                                                                                                                                                                                      SHA1:D1664731719E85AAD7A2273685D77FEB0204EC98
                                                                                                                                                                                                                      SHA-256:E905D102585B22C6DF04F219AF5CBDBFA7BC165979E9788B62DF6DCC165E10F4
                                                                                                                                                                                                                      SHA-512:6B223CE7F580A40A8864A762E3D5CCCF1D34A554847787551E8A5D4D05D7F7A5F116F2DE8A1C793F327A64D23570228C6E3648A541DD52F93D58F8F243591E32
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.Z.........." ..0.............b2... ...@....... ...............................H....@..................................2..O....@...............$...>...`......x1............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................B2......H........!..T....................0......................................j~....%-.&(....s....%.....*..*...0..$.........(.....o.......&...,....o....,..*.*..................,!(....,..r...p.(....(....*..(....*.*.(....,.r...p......%...%...(....*..(....*.(....,.r...p......%...%...%...(....*...(....*.(....,!r...p......%...%...%...%...(....*....(....*.~....*2r...p.(....*2r[..p.(....*B.....(.........*.BSJB............v4.0.30319......l...4...#~..........#Strings....t.......#US.@.......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Windows.Interactivity.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):39936
                                                                                                                                                                                                                      Entropy (8bit):5.593512133791687
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:6MazwAgR8/XJ665bKZdxuB8DCuL5enM7JxKjuMlZCZN+R0E7E:63wBccZdxuB8mQen6JxKjrlMZgR0Eo
                                                                                                                                                                                                                      MD5:3AB57A33A6E3A1476695D5A6E856C06A
                                                                                                                                                                                                                      SHA1:DABB4ECFFD0C422A8EEBFF5D4EC8116A6E90D7E7
                                                                                                                                                                                                                      SHA-256:4AACE8C8A330AE8429CD8CC1B6804076D3A9FFD633470F91FD36BDD25BB57876
                                                                                                                                                                                                                      SHA-512:58DBFCF9199D72D370E2D98B8EF2713D74207A597C9494B0ECF5E4C7BF7CF60C5E85F4A92B2A1896DFF63D9D5107F0D81D7DDDBC7203E9E559AB7219ECA0DF92
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...du.K...........!..................... ........ ;. ....................................@.................................\...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......4O..X`..........xD......P ......................................{c...2......q..Z,.C.....3.n.Z..7....R.....T.{yF")i.$JMv...,a.....U...M:,...Z.Q:..c..N.{....<....h%.....:s..T...Z.gSI.....6.(.....{....*...0..&........(..............s....o.....s....}....*...0..K........(.....{....o........,3..+&..( .........{.....o!............*..X...(....2.*..0..L........{.....o"...,=(#...(..................($...o%.......(&...o%.....('...s(...z*.0...........o).......E............d

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\System.Xml.XPath.XDocument.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):22744
                                                                                                                                                                                                                      Entropy (8bit):6.807604823714972
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:N4YTzW+wW8WpwW4am0GftpBjPXaQHRN7MlUaaTJQi:NH5JVidXLvND
                                                                                                                                                                                                                      MD5:54A0AE378C4D20F237E8B01B29E907F2
                                                                                                                                                                                                                      SHA1:08FD364458B935C82ECCCA43AC53EA182DA4EA45
                                                                                                                                                                                                                      SHA-256:05DF614F3252B522D2AA078585DCDDD502A25BDB06CA3A44B1C0D24C1ADB85A2
                                                                                                                                                                                                                      SHA-512:12EA4FFBCD243F3DB5FEC4D4901F5550F044E49478A909416E7B588EB15E9C6DD005D8255ED8235E803C76B57FBEEBA6FC9B0B85A8155787C1D885537EB87611
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......Z.........." ..0.............F*... ...@....... ....................................@..................................)..O....@..x................>...`......H)............................................... ............... ..H............text...L.... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B................'*......H.......P ..x....................(......................................BSJB............v4.0.30319......l.......#~..l...$...#Strings............#US.........#GUID...........#Blob............T.........3................................................................G..........._.V.................................g...................................G...........s.i...8.....-...................P.....P...!.P...).P...9.P...A.P...I.P...Q.P...Y.P...a.P...i.P...q.P...y.P.....P. ...P.&.

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\af\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.291972485177625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:S0uGkvyZAeuKau8ZSZmZP+JUK/Oatdh+A:S0kIAeyu4+JU1ch+A
                                                                                                                                                                                                                      MD5:DF813113735421896532F6FE9A3ACCC6
                                                                                                                                                                                                                      SHA1:6132DAA7A0399B881F3095D84CB291C68897FB54
                                                                                                                                                                                                                      SHA-256:C4AD86BEB764AEF34F380289ABE9EF07BA251644137B80F27091E7AAC358D7D6
                                                                                                                                                                                                                      SHA-512:2D0E2D876C48D800804D7BE4CA6983A69F743D5E0AF397FA3F7199ABD6EF4706EBC9598C95A33BA3D96AB977AF404722FA2D8F3DDD871A4B26C500DB97549F81
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q............" ..0..............5... ...@....... ..............................3.....@.................................X5..O....@............... ..h ...`......<5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ar\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21608
                                                                                                                                                                                                                      Entropy (8bit):6.13789981359193
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:v6Y5Eg19U7GWdFWauXZSZmZP+JUK/O0kQAbh+:v6qU/uL+JU10Ch+
                                                                                                                                                                                                                      MD5:F7F817EF119097F0D7CFE2C4298949B1
                                                                                                                                                                                                                      SHA1:B20A817AC53E2BBAA1FF9BB46E0CD8033C0B1103
                                                                                                                                                                                                                      SHA-256:DC5C0EEC2AFCE5B20FF66863CC8F332B180900A79172C1F0FE1DCD49FBF2C036
                                                                                                                                                                                                                      SHA-512:89E488B497713B4C766A30793CDCC04D9817A9AEDD192A38CACA80AE191F7CB77F0E5FAC959586E8511DD6E8E5CB25487A6F6452C81E27664F94A6E59C2EDF1C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..*...........I... ...`....... ...............................w....@.................................hI..O....`...............4..h ..........LI............................................... ............... ..H............text....)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H.......P ...............&..."...H......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................V.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\az\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.333500822439101
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:dsZlETs6kvycfse4uauNZSZucQZPMH7T1JUbO/dAUBcBZH1a:iKQ6kvycfKuauNZSZmZP+JUK/OUUhM
                                                                                                                                                                                                                      MD5:10DF33BEBB0EED6973CC5179B06A0909
                                                                                                                                                                                                                      SHA1:DABF4263F102C58F8B6488146B08AD31DDFB5A1D
                                                                                                                                                                                                                      SHA-256:E0030FD39BD9C977AB723AB27F69B58612D6BC223414FEE76C16C272B85D2860
                                                                                                                                                                                                                      SHA-512:3E8F7DDA666B4E658E65BC7C529C41BCF72AAEA4EAF8B0446517AD15BCF9438A4589F58CF66D415C3DFEC67BA588273564FF67A76E1DC0210E5683C10B490638
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....8..........." ..0..............5... ...@....... ...............................l....@..................................5..O....@............... ..h ...`......|5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\bg\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.343509571986003
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:LAygh8vyJzraYEauhZSZucQZPMH7T1JUbO/dAtS8nI5cBZH1PQU:bgh8vy1GauhZSZmZP+JUK/OtSN5Gh5D
                                                                                                                                                                                                                      MD5:67A1333B33B5AA5666A6D40EDC28F0F5
                                                                                                                                                                                                                      SHA1:A8251AE27154785C3CE848EF6D57CB1BCD447124
                                                                                                                                                                                                                      SHA-256:C0F934A65E5BC9B35D9AC5C78EDEA4699BD01882D91A3A0930B474914658542E
                                                                                                                                                                                                                      SHA-512:F70FD4DA020AA84D5AFEEAD9067ABF8F5690310AE0DCA3FCFEEE730611729F0F66042768A38B46D9353658DD6BFA606AD8479A7FC198243D4EC65AFC3C7DAB1F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............:7... ...@....... ..............................r.....@..................................6..O....@..............."..h ...`.......6............................................... ............... ..H............text...@.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............&..8...L6......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\bn-BD\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.395122340550442
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:0oservy2GI4mdauyMZSZmZP+JUK/OeK6ThHS:0osMVYud+JU19ahy
                                                                                                                                                                                                                      MD5:6067F4B27161106FA9AC2585D2455D31
                                                                                                                                                                                                                      SHA1:19EAAB68786EB9AABD6245625341FAF3184ED53C
                                                                                                                                                                                                                      SHA-256:D260E454AC1F02F1F659F601663333B9E5313BD98764A40C03000A69AC469B82
                                                                                                                                                                                                                      SHA-512:55419E7FAEC25F8933A4B5BFEFD2A5A1F9A04CE90B24226EE5004B28935EAD94FA6A140C438FD74C5EDB3511E919154BC1AB11E8D233065AA52FA271D39E6794
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..............7... ...@....... ....................................@..................................7..O....@..............."..h ...`......x7............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ...............&.......6......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\cs\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18536
                                                                                                                                                                                                                      Entropy (8bit):6.162014527912186
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:uKeJka33W8cnauZZSZmZP+JUK/Ord3h9f:uKelm8caup+JU1rlh9f
                                                                                                                                                                                                                      MD5:532E43669CB504C01ABDD255A74B705E
                                                                                                                                                                                                                      SHA1:50F416F89F6FD45AE4E26942E7524FDF7BF6CB99
                                                                                                                                                                                                                      SHA-256:0DD2044A423CF9BADECC86B9EFF396F37F8E4B3350D707440BAD6AFFBC82D42F
                                                                                                                                                                                                                      SHA-512:21C3277AC6C14E1DF8B106CE7D543CD34342D638A87A4F14E92E2F04557C6954237C0CAAA6C385DF89D46C22971614D7D32F2734AFE228CE6A2615F9AAC29A3A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............=... ...@....... ....................................@..................................=..O....@...............(..h ...`......p=............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............&.......<......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.......................l.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\da\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17512
                                                                                                                                                                                                                      Entropy (8bit):6.266367489463609
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:6T8s0ZwYNYF3ChQfuouauPZSZucQZPMH7T1JUbO/dAEgBZH2d:4EwYNYEafujauPZSZmZP+JUK/OEyhm
                                                                                                                                                                                                                      MD5:FBACAE305F51A31BE2CE85CA1A10C399
                                                                                                                                                                                                                      SHA1:7A9EB9628170D2AD76A050FDC8C9A7688CAFC754
                                                                                                                                                                                                                      SHA-256:A1849E30A00B6D0767F076DED12D22EF701A81E11A1C82DE5B85DB69548FC793
                                                                                                                                                                                                                      SHA-512:2CE93CB94C1F7A37CE9D9D10E64F7904C36054E878BAD0EF094EF6C00D481FE779B36AC222207BDED8A14D99C0DB82FB177E51C3422D830754624079D9778C85
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..............9... ...@....... ..............................?.....@.................................89..O....@...............$..h ...`.......9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B................l9......H.......P ...............&.......8......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\de-DE\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21040
                                                                                                                                                                                                                      Entropy (8bit):6.207080848398213
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:VAk/OiNxTFie1IQdUPhV+lyrdEPaCkLKT0YIYioZs3ct8JN77hhXsn:aXiZdUTdYavQ0BYioZssK3hhs
                                                                                                                                                                                                                      MD5:198378B54F0FE54A9C2E073528CA4558
                                                                                                                                                                                                                      SHA1:C295DA6C894D7D565A710D4A3FC9AFE4FAE51046
                                                                                                                                                                                                                      SHA-256:B2923470AC20417D8D02BCB0FB7ABB3D5F4D0F12010341673A62613E0D15EA79
                                                                                                                                                                                                                      SHA-512:66D65B2924C3B367599D8E84E1AAF50EDE2684E74BE74F4A86BE23572A5F89438981D0021A1817583994A42C15895D001C4BF39119EB6849DAD8C46674AB9707
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....*...........H... ...`....... ....................................@..................................G..S....`...............2..0 ........................................................... ............... ..H............text...$(... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................H......H........D..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\de\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19560
                                                                                                                                                                                                                      Entropy (8bit):6.10190772180962
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Aw0Zf8RFGWuqkofEpjeufp5lauKZSZucQZPMH7T1JUbO/dA/YxBZH7PY:Ef8RwWnDAauKZSZmZP+JUK/O/Uh0
                                                                                                                                                                                                                      MD5:0B09E735BB535666472EFECA91581E35
                                                                                                                                                                                                                      SHA1:06CC8BA7D667A976CFC99DE485D63724545DC7FF
                                                                                                                                                                                                                      SHA-256:2BD443B07FA7415301969C0AAD0BF040B4CB32555C4A074D298557F621E73A20
                                                                                                                                                                                                                      SHA-512:C54758CDE6DC2360C9CA3BA1A5DA4F2E245F8E0A23CF3EE884C456F528DC00258B63DF4A72F6C8CAC335A5288BA1A6CC36B86340FCAE9FB11201E096488DC1F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:............." ..0.."...........@... ...`....... ...............................;....@..................................@..O....`...............,..h ..........|@............................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............*..............@..B.................@......H.......P ...............&.......?......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\el\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17512
                                                                                                                                                                                                                      Entropy (8bit):6.337594624143942
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:yg/fgysvNfCbPauBZSZmZP+JUK/OR/ZVhj:ygwDNfCGuh+JU1Rvhj
                                                                                                                                                                                                                      MD5:401D146DFA828B1F4985677EB81681BD
                                                                                                                                                                                                                      SHA1:7EF3FE4962F0EFB62830871C161EAD1AEDB52093
                                                                                                                                                                                                                      SHA-256:361E57CF0D442A6F1FCC7414671631AFD76D90BF35AF9E748B5DCCF4924C0557
                                                                                                                                                                                                                      SHA-512:05F763BCF4D8F6A7A3255421E2A4E6926774549690DD8663762BB8BF5FB439E7E0A65067D58F73596A0E01FD18C6C14784C4A6438A85F9E55131C85C990009A2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a............." ..0..............8... ...@....... ..............................4.....@.................................p8..O....@...............$..h ...`......T8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......P ...............&.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-AU\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20024
                                                                                                                                                                                                                      Entropy (8bit):6.221548650409101
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:WAk/GCirTiNcQ23ZQfs8Wv0DNq7NHv4IYioZs3bYn8JN77hhX:r/COZiJNqxHvhYioZsrn3hh
                                                                                                                                                                                                                      MD5:2268F999042952EB5BAFDB6F07CBAF9F
                                                                                                                                                                                                                      SHA1:BCE4BC54BC7FA7C8D5BF553DAD0241FA40E05300
                                                                                                                                                                                                                      SHA-256:C11489C8C08C12E3DDA01CF67763D99F5DE58EC05EB3EACE4DEDDD8734E1CAC8
                                                                                                                                                                                                                      SHA-512:38190B05E1D8084598CC648A0449C7D011DEEABF3E11ADC39EE7E04EC76F4C90EA8A0C347DC9C9A39F6865C2E9031834B3A49F49A3B5EC16533B59DEA5DDD222
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....&...........D... ...`....... ....................................@.................................hD..S....`..................8 ........................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H........@..............P ..W ..........................................S .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-CA\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20016
                                                                                                                                                                                                                      Entropy (8bit):6.224675116748554
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:5Ak/GCdbad0/CiIhLrysdYw3adVI/pIYioZsoeYf8JN77hh8f:u/CdYLSw3adK/+YioZsH/3hWf
                                                                                                                                                                                                                      MD5:851D8D68FC61845A76C203103B5A6132
                                                                                                                                                                                                                      SHA1:C9E8F5DED90C18AF001649607BC1C21B7887AA26
                                                                                                                                                                                                                      SHA-256:557A002A34F2690F564C72E4DD4BDE1238A4EB5270A2234301F365058E4E857B
                                                                                                                                                                                                                      SHA-512:A8857EED7306FAF6E37FF6D774FFD04E8490770813133FA0EACABEC2CD0AE8E895844EB98B02C58235FDD2881181DD79240C6B41C462AE2F6450F7AC6289828A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....&...........D... ...`....... ....................................@.................................xD..S....`..................0 ........................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H........@..............P ..e ..........................................a .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-GB\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20024
                                                                                                                                                                                                                      Entropy (8bit):6.217246247914002
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:IqAk/GCirTiNcQ23ZQfs8WvYNqqvvFIYioZsH9fo8JN77hhvS:A/COZizNqivyYioZsdfL3h5S
                                                                                                                                                                                                                      MD5:77327E8B5A67D69A7FA3BC6291F8C815
                                                                                                                                                                                                                      SHA1:D6EC7469F474C4118D11977F011100D4B86FC648
                                                                                                                                                                                                                      SHA-256:7A9AEF7FB57950B04C810896C7CA4817DDFD0FE85A5E1F11E314C1C0CBE41E96
                                                                                                                                                                                                                      SHA-512:E63927BC3112E5186D2E90B0B776B669A0686BCB383E514CF519FF5C4697E28A676AD4556D9BFF75E6D9EE2202FED404A1D3BA3FD6E7900EC43A1E9893AF3C7D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....&...........D... ...`....... ..............................h.....@.................................hD..S....`..................8 ........................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................D......H........@..............P ..U ..........................................Q .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\en-US\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19512
                                                                                                                                                                                                                      Entropy (8bit):6.2693898256210465
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:NM8AhcoC3jhevxQUy2fScCKNqfmaWF9UTIYioZsX08JN77hhRoS:NohcoCefSczaWfUcYioZsH3hUS
                                                                                                                                                                                                                      MD5:AE41BF54E34CC0E083561DBFD2AA7F8B
                                                                                                                                                                                                                      SHA1:E6692586C57A72658CEAC748487400ED33DA2116
                                                                                                                                                                                                                      SHA-256:48C3986008519E54A51B78F9F2D467A56C18692CC0A15F07ECCE351DE50960F0
                                                                                                                                                                                                                      SHA-512:A22D65FF2EB0470B7C71A942E3ED20371117CB9CB1BC4756DE3ACD98062055D6B5998B929ACFC8A923D61E5509FA0D4E96214D54B3444982B91B2992C1CBC997
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....$..........NC... ...`....... .............................._C....@..................................B..O....`...............,..8 ........................................................... ............... ..H............text...T#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............*..............@..B................0C......H.......<?..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....j.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z........................<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..|......

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es-ES\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20528
                                                                                                                                                                                                                      Entropy (8bit):6.245424280112497
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:QAk/2SGZpPuhlaIYDrRZ416Gk3dmIH7ABAXpw7IYioZsQ/8JN77hhMI:xfSLYDFxNNoawEYioZsF3h2I
                                                                                                                                                                                                                      MD5:2C48F72AAAE51642F859A561CDB8F126
                                                                                                                                                                                                                      SHA1:A50A3B992391974499441DADBE40628BFB528BEF
                                                                                                                                                                                                                      SHA-256:EA47F8288E371790B1B85C886AB270DF734009227227FBE6A628E3559243BDB2
                                                                                                                                                                                                                      SHA-512:C253298B1284A4618CC212508E68B89D287299136BB26F42508CB85C78DC61C7D7FA03F4CC75E5E15FF34CE16F5662613E7D140991F8632844181755190712C7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....(...........G... ...`....... ...............................$....@.................................DG..W....`...............0..0 ........................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc..............................@..B.................G......H........C..............P ..4#..........................................0#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es-MX\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21040
                                                                                                                                                                                                                      Entropy (8bit):6.168482833459626
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:kAk/NVOhVx2EZs1KWlgNIOdsEZkx3Gh7YvXWMofuIYioZsIDjbi8JN77hhEe:lMVtlgN81KnMo7YioZsaN3hae
                                                                                                                                                                                                                      MD5:993A3C83CF62DB0F5C4205C187E7B859
                                                                                                                                                                                                                      SHA1:E077CC0E5FFE089992F855F35BF888832F7026A7
                                                                                                                                                                                                                      SHA-256:11AAF27C18604407E6241B47490A4A64F7D7BE13424D873C46EF2D31B2C4BBCD
                                                                                                                                                                                                                      SHA-512:D0E646E565ABFECA9CE074F365768876D0270D00A2EC4DA05B79CFF05E98C8E32B4DF07A50DDEE42DE87BD1ADC1C8480B45167C76CC5A9B5B0CC969C8A3119EF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....*...........G... ...`....... ....................................@..................................G..K....`...............2..0 ........................................................... ............... ..H............text....(... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................G......H........C..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\es\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):33384
                                                                                                                                                                                                                      Entropy (8bit):5.5419946748803905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:wKD9rfoj4z2PDapUSw3lCdMIaugZSZmZP+JUK/OW3qhX:wKDfyOpHMbuM+JU1lhX
                                                                                                                                                                                                                      MD5:F9126767970152F6951744C0A011194F
                                                                                                                                                                                                                      SHA1:03B6B0DE1878CF5C7C21836464A614E71180894D
                                                                                                                                                                                                                      SHA-256:210682DD6564E3EEA41CF8D07FF1EF64B9410817D28C6AF934A531DD56DD0919
                                                                                                                                                                                                                      SHA-512:0FBDD9EAB4968C06E03BA19E494AEB7FE7A7886FB26ED8C635A922F83EE84D2F3D04A6E30E6E097130C1C85FAC24C446633266D5732851B74E58FE3C5BC138E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..X...........w... ........... ..............................i.....@.................................Lw..O....................b..h ..........0w............................................... ............... ..H............text....W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................w......H.......P ...............&...P...v......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fa\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.29921705312917
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ck0ZwUCvy3tfau1ZSZucQZPMH7T1JUbO/dAAUcdQBZH0lM:UwUCvy9au1ZSZmZP+JUK/OAURhp
                                                                                                                                                                                                                      MD5:5EFD1F3316B8A5BFA0B920643A33D6EF
                                                                                                                                                                                                                      SHA1:55FF7398411399E5186BFEC7DBD05C8DAE72C3B3
                                                                                                                                                                                                                      SHA-256:786AA7532A1AD24B839E8E1BB160CA1761129DFF5B6B6081340F80AE5C792DB5
                                                                                                                                                                                                                      SHA-512:49F2E72D3C779E295D2098314DCCF0FB3D818995BCB61DB7F0DEA566CECD30C5FA8720A0A84638C3A5E26773D43A9F724D19E190D2F53166F74C81845C09C9EA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?............." ..0..............6... ...@....... ....................................@.................................06..O....@..............."..h ...`.......6............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................d6......H.......P ...............&.......5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fi-FI\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13928
                                                                                                                                                                                                                      Entropy (8bit):6.544532224257793
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Fqoa7hLQe6mOQWauBZSZucQZPMH7T1JUbO/dAS4/zCBZHHj:4o8LQe6bQWauBZSZmZP+JUK/OS4zQhD
                                                                                                                                                                                                                      MD5:CFDBD76E060DF5351C5CD7C15D500E2A
                                                                                                                                                                                                                      SHA1:0D2795C88578AA1DCF7DC26E106A01768B0D8A13
                                                                                                                                                                                                                      SHA-256:6089ED61C12F4B0F5963D967D91108035B473C177D37A2A991A91E5B69E1365E
                                                                                                                                                                                                                      SHA-512:935B6F368573FB921B77C5ADC0288D65E0FBB9AE36DF5BD795F81D94963096516B82D7F707100AD65A69BDF34704C016ACB36FF5964637AC35733B50EA5EBBC8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!............" ..0..............+... ...@....... ....................................@..................................+..O....@..................h ...`......h+............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ...............&.......*......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-BE\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.209227646537335
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:do5GeTVyTMyjVtEY4auCZSZmZP+JUK/OuBwShHj:do5GWYnjVtEYruq+JU1QwShD
                                                                                                                                                                                                                      MD5:4BC635EABA29E086449C73CADFAD9601
                                                                                                                                                                                                                      SHA1:F84BD2343C57F03EA0808FAF2B9ECEE804400E5E
                                                                                                                                                                                                                      SHA-256:58746E243FEC36552C1A7D65B7356A47EF1213CC2FC215D6B569EA54410F0BD2
                                                                                                                                                                                                                      SHA-512:027FA9060B0C147BE48CF6D08701827399D42C5678E9DE8517A323F808B01226D730AB256ED9582CA7D913D4A42F3133F6A993F8E6AE9DD3C0E3081BA4A5A4EC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............6... ...@....... ..............................c.....@.................................T6..O....@..............."..h ...`......86............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......P ...............&.......5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-CA\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21048
                                                                                                                                                                                                                      Entropy (8bit):6.22848620868751
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:uAk/2TQ4LNmRO8IhB6/24koDR1RePwZdB1VwMb2HujX6IYioZsG5b68JN77hhd:zfTvhB6/tP2OjXHYioZsOJ3hz
                                                                                                                                                                                                                      MD5:43C9EC83512D7A5D573E9D42CF7CFEAC
                                                                                                                                                                                                                      SHA1:602581BC43FA2C4623D67E2861AB0AA472A41464
                                                                                                                                                                                                                      SHA-256:CEEA939CAF5A9FE48B165338D406DA7300ABD5F0271E1B5354807110E0A95725
                                                                                                                                                                                                                      SHA-512:9C018CB7CBF34372D70813C545F5F195DC9A05A6881053593B9ED184D0EE6B4999870E6869D04FF0A6EEB3FC1EA6985E3B73CB82AD31AA96869C86D3522818A7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....*...........H... ...`....... ....................................@.................................lH..O....`...............2..8 ........................................................... ............... ..H............text....(... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................H......H........D..............P ..\$..........................................X$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr-FR\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21048
                                                                                                                                                                                                                      Entropy (8bit):6.233541228868438
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:LAk/2McnjAapuRXPMjDRVPNuyndRRePwZcFnMb2HP/FIYioZs6+8JN77hhO:kfMfMjQy12v/yYioZsE3hs
                                                                                                                                                                                                                      MD5:BB7746B5B80FC13E80285D4E44BB1683
                                                                                                                                                                                                                      SHA1:75A980DD4F6DB82B9BDEE98DAB3EA811666EF199
                                                                                                                                                                                                                      SHA-256:0B35EE69171BBECBFD72BC5B39D0A25C840280F0906EE19262B61C5124D2A142
                                                                                                                                                                                                                      SHA-512:DBDC34E4B3A8BD0732B45C85F6C3965BE126D526D08A683A27E8A515DBEE851EBCA07169959BFD734EF2B2D9E0027FF1462CCC4C8D5BABA189C2F4B271FC48DC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....*...........H... ...`....... ..............................Z.....@..................................H..W....`...............2..8 ........................................................... ............... ..H............text....(... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................H......H........D..............P ..s$..........................................o$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\fr\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19048
                                                                                                                                                                                                                      Entropy (8bit):6.101334747811885
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:gasOnRiDAjVtEYJNauhZSZmZP+JUK/Okuh/v:gaXaAjVtEYJMuB+JU1fh/v
                                                                                                                                                                                                                      MD5:40B65DFEB49A8C6AD633479ADFC17D2C
                                                                                                                                                                                                                      SHA1:4C9D738DD6F008000D6AEF2B351D0B60DD2FB31A
                                                                                                                                                                                                                      SHA-256:DEB5CD0C096E1210A01CD16C93FF4181FEA83D48F6ED2140205D827B620EA98E
                                                                                                                                                                                                                      SHA-512:042E2E773B682ABED3ED5A89D24321B7E3761BD4564ED6E422BC8340EB4CFE654F11951EB27D8C9F8EA3687FEBE7949778FABDE4EA41959C50ABCD56AD3CE126
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...N.B..........." ..0.. ...........?... ...@....... ..............................!.....@.................................h?..O....@...............*..h ...`......L?............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................?......H.......P ...............&.......>......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................V.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\he\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21096
                                                                                                                                                                                                                      Entropy (8bit):6.078168311168296
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:m/YzEga+YMegOIuauWZSZmZP+JUK/OeChyDg+:m/FAOI9uu+JU1VhyDH
                                                                                                                                                                                                                      MD5:EA0722B565EC30A68B08A818B66C0079
                                                                                                                                                                                                                      SHA1:93E876A5EA2ED9843958BAB12270CC50896CABCF
                                                                                                                                                                                                                      SHA-256:41628707A6C9E989FBACF44164DEA1D47F1FAD4260875DC3B7FCF47CAD6E549D
                                                                                                                                                                                                                      SHA-512:3A7E59724ADF28DC2D1D78EA3997E3AB1A11373958D172ABE4D04234F3F7C2212B2FEFBE5DC1811E2636C5A7D7A3F54EDDBE1FB7C58CAC00DEDFC27705BCD647
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}v..........." ..0..(..........zG... ...`....... ..............................G.....@.................................(G..O....`...............2..h ...........G............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................\G......H.......P ...............&..x ...F......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hr\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19048
                                                                                                                                                                                                                      Entropy (8bit):6.075049638100045
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:/QsW9669676lauOdZSZmZP+JUK/OwbNh7H:/QFLw6Eus+JU1YNhj
                                                                                                                                                                                                                      MD5:24B96909C0B6E4B42FCF71BC0339D2FE
                                                                                                                                                                                                                      SHA1:0A091DEDBD54EBC844F60CFD353FD936643D06EF
                                                                                                                                                                                                                      SHA-256:3447ED7F8AD4B808391EA20CB99A7E04F9B9F8782255F94F5BEF35FAAE1EAD8E
                                                                                                                                                                                                                      SHA-512:FFA266873157C0D74C57505111420388520897C40592C8C5901E4D7189FA9F55CC336C356C874DF8D301C35F314F010839D085D83710E409B5D1EF10639DB5E8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x............." ..0.. ..........2?... ...@....... ....................................@..................................>..O....@...............*..h ...`.......>............................................... ............... ..H............text...8.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................?......H.......P ...............&..0...D>......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................V.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hu\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.31563208553524
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:3KQFwvyN1YmHGautZSZmZP+JUK/OY2thj7:3KQKvkVud+JU15thj7
                                                                                                                                                                                                                      MD5:2349BE1BE23C53CC408623DDC2794073
                                                                                                                                                                                                                      SHA1:8D76E666D04C12EE76D617BB4878304765589571
                                                                                                                                                                                                                      SHA-256:9B5128479EBE024F93AD137BD0964D5D97D02425A4FA54A477498C0DAB37BD48
                                                                                                                                                                                                                      SHA-512:A3BD93CDC77AF0A1A0A4558978BC11A65FA9BEFB4671FD68BC4EB23DABAEE977DF68DC25B665D04B4AB98504465903A5C1E48632D71EDC92416585DD881DB7EF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c............." ..0..............5... ...@....... ....................................@.................................h5..O....@............... ..h ...`......L5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\hy\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.315435844584834
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:kkZlETshhfvyPPo4HRauGZSZucQZPMH7T1JUbO/dAm34TVOBZH2hh:LKQhhfvyFRauGZSZmZP+JUK/Om0KhMh
                                                                                                                                                                                                                      MD5:A2AF6E57791A7E8D0E16DC49F618E1DB
                                                                                                                                                                                                                      SHA1:6738AABEAE1A4830C7DEE53CBCDD9198DDFF6D3C
                                                                                                                                                                                                                      SHA-256:53DD183C132957617A8A1A551197E71B2C873E407B2F2CD29BE004E9A86A4154
                                                                                                                                                                                                                      SHA-512:9522B4F40DD6A285BDF59722314C3CF96BBC2BECE9762D945F61759A2B62E0AC5DA7340FC8BE54047882F8BFFB12DD506AC0AF5ABBE6BC8A46F4CB93218972FF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>............." ..0..............6... ...@....... ...............................;....@..................................6..O....@..............."..h ...`......t6............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......P ...............&.......5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\icon.ico

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:MS Windows icon resource - 8 icons, -128x-128, 32 bits/pixel, 16x16, 32 bits/pixel
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):153205
                                                                                                                                                                                                                      Entropy (8bit):3.402710205062059
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:tJkNMHP+XOgoqiY5OQDh/Qlwl7PqkjmUOlYILwYFBotXIqees:NgoqiYrQlo7SkjmUOlYIlis
                                                                                                                                                                                                                      MD5:E2D7DBB0192920B0643BB9D56DC9E907
                                                                                                                                                                                                                      SHA1:1E8EAE23F950A075D5569E533A4849692F6BF258
                                                                                                                                                                                                                      SHA-256:5C47D57614F70ECCA312908010B85DDB49DEF66AB80C7A285E1F880025CA9CA1
                                                                                                                                                                                                                      SHA-512:6A120B8FC26F934E9CA4F5834056DA9DF88DFC86F0B80E7BE7A7A6F642D32001A4193244C110867ACB4B875B7C14EF8A74EBBFEF2CC3B75D1E9ABDE71AD7ACB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:............ .(............. .h............. ............... ..2...... .... .....UI..00.... ..%...Y..@@.... .(B......``.... .........(............. ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\id\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.205351317704627
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:lE0ZAySvyIyoKauLZSZucQZPMH7T1JUbO/dA0/z2NBZH7nU:hAySvyIyJauLZSZmZP+JUK/O07yhbU
                                                                                                                                                                                                                      MD5:FC492BCF28A6A9CBF55254B8AAF710C1
                                                                                                                                                                                                                      SHA1:D577F6884C3C58A6561A5E4498B9F87DFCF705B6
                                                                                                                                                                                                                      SHA-256:3FA8D689F8FB9302C9848A7D90544348515BE8A7CC3509BBEC67CDB19DAE8D25
                                                                                                                                                                                                                      SHA-512:38296EB5423E33CBE014F6F5011B03803DE6A421AB19C392DD7EF15D27E1F3F8F8C777F504662DC2D43FDD1346C609E391C3EABBFEA10F2DC4A857EA6CBD6BD1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:C..........." ..0.............26... ...@....... ..............................w.....@..................................5..O....@..............."..h ...`.......5............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......P ...............&..0...D5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\is-IS\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20536
                                                                                                                                                                                                                      Entropy (8bit):6.3213192624516825
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:yAk/sIinmiVg2snjTEs9qyBti0rEcGvio4IYioZsPqC8JN77hhA:HdIdjTHtiXcGviohYioZs83hK
                                                                                                                                                                                                                      MD5:317D0D887756E5FAA13AFC2E859129A7
                                                                                                                                                                                                                      SHA1:C10DBACBE4B08271D3035265DBAB0D23A5AC3ABF
                                                                                                                                                                                                                      SHA-256:724D95939BC8DC752558E74EECFCBB4F9B9C35F565F91C383659256C82BA6BE0
                                                                                                                                                                                                                      SHA-512:2842215E6DB5D6417C306F0BAD51F75036620426429A7591983E10EE98C322E854A1FBB5ECB2D2D614CFD06A1504B08C04F0204B9107E3F4D4BC8766FD74F260
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....(...........G... ...`....... ...............................#....@..................................F..O....`...............0..8 ........................................................... ............... ..H............text...4'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc..............................@..B.................G......H........C..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\is\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24168
                                                                                                                                                                                                                      Entropy (8bit):5.904139050850343
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6KQxD+nZRTvi2m2jEFaujZSZmZP+JUK/O8Z8uhc2:6KQ+ZXJuX+JU1Vuhr
                                                                                                                                                                                                                      MD5:E9652E25F822B770D318D73C8E9BB8C3
                                                                                                                                                                                                                      SHA1:85A0A85A5C276184ACD7495BD649C35C517E1BE2
                                                                                                                                                                                                                      SHA-256:179475E10B51D753325BDBACD8219ED7D251D611E6A2458AC72D0FE232780692
                                                                                                                                                                                                                      SHA-512:75CE761B79197C33B192D0F660C112AB1CE50E85D26C496EB4D5DD84C56C8A8070CA1450EB47CB4955FFCD8FDC6CB3EB3B85A33A3353F6609031AD7A4F731BDA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..4..........zS... ...`....... ...............................v....@.................................(S..O....`...............>..h ...........S............................................... ............... ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B................\S......H.......P ...............&..x,...R......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\it-IT\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11824
                                                                                                                                                                                                                      Entropy (8bit):6.743813963964201
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:2dvfmIYiYF8iZtNjLn74biQjfH0JOqsmVgz28WhBqcI5Ze:2FfmIYioZsbiw8JN77hh4S
                                                                                                                                                                                                                      MD5:A3EA2D9019A3DE3926F0DAAD5648954C
                                                                                                                                                                                                                      SHA1:90E0759B9E662F25D90F3853B05475FC16F58610
                                                                                                                                                                                                                      SHA-256:4BDB6C36980E1B7E1AEB1FF55FA1AAEFB47C9321AB15981854AA2521BD130E0E
                                                                                                                                                                                                                      SHA-512:E346D9DF781C4F284562387A10E5BA2AE4F4940900961D14D38FF16C4BF18C4F0D2DF647DFF2E8F0A22E303AD2966560E1971DD0AD1665B07EAC68669792F2AE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.................%... ...@....... ..............................}.....@..................................$..S....@..................0 ...`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................%......H........!..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....BSJB............v4.0.30319......l.......#~......x...#Strings............#US.........#GUID...........#Blob.....................%3................................................%.....B....._.....x.............................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\it\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.288788909813754
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:kGKQ9DvyqEau+ZSZmZP+JUK/OsiP0TahYG:XKQd9/uG+JU1ZNhYG
                                                                                                                                                                                                                      MD5:6DCE69A52428F24D45512AC6B6C1DC2A
                                                                                                                                                                                                                      SHA1:2BE15246FFE8E9F268FD88396E907F759214E9FB
                                                                                                                                                                                                                      SHA-256:F828FA4C2D04E8A69A4BD9890F98AD32A277768F5270F0CC90FBD5184CDBC6A1
                                                                                                                                                                                                                      SHA-512:780D01768FC851AB296BC075A00BE39821B6E793B747C37573FCAD70B6CF0E25A3CDE75C027491A5EACD43039AF9B696306E74E8DA144FA6FDD380E43E35D767
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............5... ...@....... ....................................@.................................H5..O....@............... ..h ...`......,5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................|5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ja-JP\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21560
                                                                                                                                                                                                                      Entropy (8bit):6.524021420506021
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:wAk/IAOFHB/8HE9Pg9K0qOp7D09257QgMIYioZsqRFF8JN77hh0u:RBAOFg9nn0I7QgdYioZsEA3h6
                                                                                                                                                                                                                      MD5:A9E6CD640491381217D503356FB936D7
                                                                                                                                                                                                                      SHA1:675606DB3B7B1207FBDB7E1A38F70B12B4B81632
                                                                                                                                                                                                                      SHA-256:536B55878C357C64FABB0DA43C01CB109F47E2AB845DDD70DB343B816378258D
                                                                                                                                                                                                                      SHA-512:DD81F15D811F264B1C4C8CB372E84024C1FF2646CE7463A028B8BAD24BC764A3E0C5367EE668F2B9DE2DF8527F7D3AC80980927A1EE46E95EC52DAB1A1382CFC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....,..........nK... ...`....... ...............................A....@..................................K..S....`...............4..8 ........................................................... ............... ..H............text...t+... ...,.................. ..`.rsrc........`......................@..@.reloc...............2..............@..B................PK......H.......XG..............P ...'...........................................'.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ja\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.312699999691037
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ks0ZQrfvy1cpCNBauBZSZucQZPMH7T1JUbO/dAi4I+UBZH0z:MQrfvy1cpCrauBZSZmZP+JUK/Oi4IRhY
                                                                                                                                                                                                                      MD5:E8732B26347CF4CA4834C85F12F06642
                                                                                                                                                                                                                      SHA1:8928EC341E7559895C1815AD57211CC1F093629B
                                                                                                                                                                                                                      SHA-256:D661621A29D91BB408E1CE9FB19CA441FC2A45606519FA8444174D6932B3C049
                                                                                                                                                                                                                      SHA-512:9C7E10EAF1AE4F2B579A114E92D04480EA2D289926B5A91482E899FC1894858220A2E94269499D5CA5EB963954B3EBD48CEB30DBABC6F8A86E1D2738C509F08C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....H..........." ..0.............J5... ...@....... ...............................7....@..................................4..O....@............... ..h ...`.......4............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................,5......H.......P ...............&..H...\4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ko-KR\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26728
                                                                                                                                                                                                                      Entropy (8bit):5.710454430307726
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:PoQnZWHPxE3oGQG9auHZSZmZP+JUK/Ory/hDPv:PoQEpub+JU1W/hr
                                                                                                                                                                                                                      MD5:E0C14E303FCEE5576E688F31B0C5AA09
                                                                                                                                                                                                                      SHA1:90A1592F3828AC2C37A95DC2ABE1B5139BD3E806
                                                                                                                                                                                                                      SHA-256:483DD17E12D7A8916B467D9B177EE34C87F112267EE9FF8E328A3584CB9E27FC
                                                                                                                                                                                                                      SHA-512:1EF6C201AB1229EA5320B57D5689685150CDF9A8700B6C974A4C132AE96DB3BA7BBD9FF37BE707DB346A5C870C4FC6D1FF924100BD492F2BF7753C026358D439
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L............" ..0..>..........N\... ...`....... ....................................@..................................[..O....`...............H..h ...........[............................................... ............... ..H............text...T<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B................0\......H.......P ...............&..H5..`[......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ko-KR\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20016
                                                                                                                                                                                                                      Entropy (8bit):6.5771642201626905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:nsNstPXKveaS3ka9936BDTu9KpnmOcctU7CRTe0IYioZs5KtVg8JN77hhAx:YstPX336MuXTnRTeFYioZsg3hax
                                                                                                                                                                                                                      MD5:5DE42B364D6A27DFF997092CA4A6A5F6
                                                                                                                                                                                                                      SHA1:4EED881B9450B9858FEA65D92E79BA04D07FDECE
                                                                                                                                                                                                                      SHA-256:42CE1B82EE47D99EEBE24DA6CB2286910C064247CDBE779D950704C65EB0B60F
                                                                                                                                                                                                                      SHA-512:F7FDD687ECC733F599E6168B0D89CB280E6133881F3BF82E205C486892AB649DE689BF6080BA5C3F381C9D8255FAEAC46FCB9BA7257DBD16C0230849AD12229D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....&...........E... ...`....... ....................................@..................................E..K....`..................0 ........................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc...............,..............@..B.................E......H........A..............P ..n!..........................................j!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....h.......PADPADP*......6%.mM....:..t..=.....-..+3.tc9...;......xm.rXk...i.....o!...z........................<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..|.........

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ku\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):30312
                                                                                                                                                                                                                      Entropy (8bit):5.780531282950646
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:SKQ5t0bPXJK3uKvfhKKKKKvuuuusf9auUZSZmZP+JUK/OLGhjH:SKQ+g3hvauuuusfcug+JU1Chb
                                                                                                                                                                                                                      MD5:9AA8EF1A2F8CFD1D67569E7D3B45B5FE
                                                                                                                                                                                                                      SHA1:B45335E52C3107F7AD975E84EF3BBF5336BA66CD
                                                                                                                                                                                                                      SHA-256:E080137740867BA8B4A10E28A91F8F6FEEE6E0E08D135C2270E7C08E70D81D9E
                                                                                                                                                                                                                      SHA-512:5A8A1E9E835EF56D6BE4F6642C2C43947401FF00DAC53A561A04DC7985D0FA83E26A6BF31040042D5A5B2B4FC44441DC5E7848CDBDB0382F37DEE7161C456C5C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............" ..0..L...........j... ........... ....................................@.................................hj..O....................V..h ..........Lj............................................... ............... ..H............text....J... ...L.................. ..`.rsrc................N..............@..@.reloc...............T..............@..B.................j......H.......P ...............&...C...i......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\lv\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27240
                                                                                                                                                                                                                      Entropy (8bit):5.696024978223131
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:jKQbKWHPxLtXwBJIBHtbauaZSZmZP+JUK/OcN7h6v/I:jKQN1OI9tmuy+JU1oh6I
                                                                                                                                                                                                                      MD5:9C42D76AE3F16EFAED0DC5340CD251AC
                                                                                                                                                                                                                      SHA1:0FA7A2552907BACCA7A3543C5B40CCCD4B74965D
                                                                                                                                                                                                                      SHA-256:48610350B08B8CF202A9E3F71997CBEE26211E03A99E7443167E42B159D840A3
                                                                                                                                                                                                                      SHA-512:C992544D25F406B74162A36FDBFFD6403B996C063B8DB10FBEC0639BCCA7F8ED9B6BC52C7B90BCEE18616298E3EEA4DED33C7B99B29DE20BD5E9C87A21200FE7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..@..........._... ...`....... ....................................@..................................^..O....`...............J..h ...........^............................................... ............... ..H............text....?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B.................^......H.......P ...............&...8..$^......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ms-MY\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27240
                                                                                                                                                                                                                      Entropy (8bit):5.6821524479038255
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:EoMntWHPxxyZRRRRRV8auKZSZmZP+JUK/O8Chl:EoMAIxXuC+JU1Hhl
                                                                                                                                                                                                                      MD5:BF86895E7071600F82E37A5E92A6F893
                                                                                                                                                                                                                      SHA1:C3965CE29FA128D471B6FD8CE02FF0D22E5251A8
                                                                                                                                                                                                                      SHA-256:776F448B87DE9FD143DB79B77D4BC94624C6E5FBD510D114397E2708277BA63D
                                                                                                                                                                                                                      SHA-512:8C8D258A1CE8E7C0932EAD166458B9686CEF937D97E30A0A3954B7EC2CEFB4CB14D70EE4A0D9E3E0C8362F896C13D6811BBFB50F0B7E814B886C6ED467E653E4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..@..........._... ...`....... ...............................D....@.................................T_..O....`...............J..h ..........8_............................................... ............... ..H............text....?... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............H..............@..B................._......H.......P ...............&...8...^......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\mt\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29800
                                                                                                                                                                                                                      Entropy (8bit):5.598991827927489
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:/KQxwEY/TOnnd8PyMBVhjrcJauJZSZmZP+JUK/Ofd3h1u:/KQ+/Cnajhjrcgu5+JU1Jh1u
                                                                                                                                                                                                                      MD5:7850CD6CCE2241871B3C91CC91C63B10
                                                                                                                                                                                                                      SHA1:785602C66F637037E949F85295FCFAE895BE8C31
                                                                                                                                                                                                                      SHA-256:1BF4B7EE4A663579BD4B27D01E828FA6B11E1F2439EBA4B0AFAA0FD684158A70
                                                                                                                                                                                                                      SHA-512:C638586A99B0C8D98EF1295785A909145A5D9B9ACB714C602FE77CD4775E1B2801EEFFCF62150C9F337FBC1262290BDC58C11575A3642EBD70E3ABBCBA550A08
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....$/..........." ..0..J...........h... ........... ...............................;....@..................................h..O....................T..h ...........h............................................... ............... ..H............text....I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................h......H.......P ...............&...A...h......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nb-NO\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17512
                                                                                                                                                                                                                      Entropy (8bit):6.190353336574491
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:2Rqoa7FD8Q21nQEBau3ZSZucQZPMH7T1JUbO/dAqR5nBZHwKwNk:3owD8Q21Q2au3ZSZmZP+JUK/OqR5BhbR
                                                                                                                                                                                                                      MD5:40B596D9CD67F361B92E66987B67BEC7
                                                                                                                                                                                                                      SHA1:2396EF965F952143EF94120BFF9B4B22C41BA3B6
                                                                                                                                                                                                                      SHA-256:5757675E10AD62581440F31730C5AC173EBC5BC4F0851F20AA04951CBD963507
                                                                                                                                                                                                                      SHA-512:708B05A040C58CC8E88C46C6367AB525AC6D1A3FD22FA3409D86E725F6A7BC396A42BFE6CD97E103F6BF0640AD74614B8F9203B43E254EB3D265318C2F5660A1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$.R..........." ..0..............8... ...@....... ..............................7.....@..................................8..O....@...............$..h ...`......p8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......P ...............&.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nb\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17512
                                                                                                                                                                                                                      Entropy (8bit):6.183849201475738
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:M/A0ZS4M8Q21nQE6aurZSZucQZPMH7T1JUbO/dAtTIkBZHwT:0SV8Q21QlaurZSZmZP+JUK/OtkOha
                                                                                                                                                                                                                      MD5:785543F5A321BBEC10DBD0D810D91662
                                                                                                                                                                                                                      SHA1:D27A51210765D1B9C98AEDCB8BC1FBEA0963C731
                                                                                                                                                                                                                      SHA-256:70ED7116B4BC1C4D5A04219FAD67F7D0B3E780E14194D5538F5A843F9EBC9716
                                                                                                                                                                                                                      SHA-512:0FA826DFF1BFCFFE664B10D3C9D4EF76BE71B114D8A5985719A487C9D48B104FD99E6F3D55B412C72C9CEDD41B7390DB404C0B6F4377840181595F57583F40E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....d............" ..0..............8... ...@....... ....................................@..................................8..O....@...............$..h ...`......l8............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......P ...............&.......7......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...D.G...a.G.....G...-.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\nl\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.305175036251108
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:AM/e0yevyDwgKK1daurZSZucQZPMH7T1JUbO/dA+5BZH2M6fi:5e03vyMGfaurZSZmZP+JUK/O+vhH9
                                                                                                                                                                                                                      MD5:6ADE09645F4DB08A6067BE7C84B4B2E1
                                                                                                                                                                                                                      SHA1:2A08417561B2A32559F5124A26543AD45AD30868
                                                                                                                                                                                                                      SHA-256:B53B3123E77F13BA1BC88A958E75E4AC57E5A3A799504C6A2E7D3BE833254350
                                                                                                                                                                                                                      SHA-512:FA760DD1B1C1A91F9FB0C47C073E7244E39A98F775F52F28B82C21F071CEB38CF603843D3FCCE533315BA6AB95E79F61907DFAF873CA9391E74FE7D3C7B16496
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............5... ...@....... ..............................T.....@..................................5..O....@............... ..h ...`......d5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................D.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pl\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19048
                                                                                                                                                                                                                      Entropy (8bit):6.051068576179452
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:QTu3Aa3gxldhPau/BZSZmZP+JUK/O6ZOTn3ehB:2uLgxEuJ+JU16wTnOhB
                                                                                                                                                                                                                      MD5:84DDF7853931330A1DC77C08606C5131
                                                                                                                                                                                                                      SHA1:A0D5A0F53E702BAFE3BDB71ACA93FAB575F93B24
                                                                                                                                                                                                                      SHA-256:5ED7693B9758D699005FF5BDF8B676948CBF0C55E7717872823FC512BA452463
                                                                                                                                                                                                                      SHA-512:55192B55C9D7652C66F5DB9B1262D4B497C030529EE9663F92E7A2D5AC88576113AA6031991B11B938F6106ADD258FE36F35797B655D2B982E30F36804A547DA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3............" ..0.. ...........>... ...@....... ...................................@..................................=..O....@...............*..h ...`.......=............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................=......H.......P ...............&.......=......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................D.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pt-BR\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20536
                                                                                                                                                                                                                      Entropy (8bit):6.2398281454950535
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:JAk/s/qUFMRYMA2QRkYNgcF6ZFdZPIYioZsqq8JN77hhCV:ed/9R98rdZwYioZs43h8V
                                                                                                                                                                                                                      MD5:22DB2234D902D7EBD0526BFAEDB93967
                                                                                                                                                                                                                      SHA1:8AC97F94A114829F4A70E705F18301D0FD1298BC
                                                                                                                                                                                                                      SHA-256:1C8FC15DBEB0EA98E21D5B7B4058ADE3A9B746658B31CDAD129C9219DCE821CA
                                                                                                                                                                                                                      SHA-512:A4BB32672253FAC2A756E99CA0C58CAF5997086F3FABBBC5978665591A6AA0FD7488DEE34A7A7865466A2061A1D33F993629FA328DBC6C7367B112606C4CED60
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....(...........F... ...`....... ..............................4D....@..................................F..K....`...............0..8 ........................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc..............................@..B.................F......H........B..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\pt\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.299592209635978
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:0KQesvynwMmirauQZSZmZP+JUK/OA3shuc:0KQjSJmZuc+JU1eshJ
                                                                                                                                                                                                                      MD5:1FDEF91FD128EE99B397B9C241C86A9E
                                                                                                                                                                                                                      SHA1:26A3D4EBC0E5591E0DA35D3D9F46CBFA3BF50A0F
                                                                                                                                                                                                                      SHA-256:FD99BE61F47055D993F6AF29FA859CE1AA56693F5D7AE9D7F656FE8B3D8B3D5C
                                                                                                                                                                                                                      SHA-512:AE545866CAAD80F1C82ECC39325E7E162CFB20FAD0F52EEE58FABB442C8CF46A99364197A63D216B35C1B54A65CD77C4918EEEEC223AE58432B78BDA113B5BCD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............5... ...@....... ..............................z.....@.................................p5..O....@............... ..h ...`......T5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\release-notes.json

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9271
                                                                                                                                                                                                                      Entropy (8bit):4.795716454679156
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:zqHcsrs1C5yqNK+Er1DJ1+05GWBMrAh7HB:zq8ys1C54+Er1DJY05Gwhh
                                                                                                                                                                                                                      MD5:10C855B02C0ED49BCB4C76458DF62F86
                                                                                                                                                                                                                      SHA1:EF9B96040AEAD1D8528B7A019F4467C1FE1753D6
                                                                                                                                                                                                                      SHA-256:BA3AD81F8C94FAC8BB736EBE3296021842367DB814A7F0B127701DCBB930000F
                                                                                                                                                                                                                      SHA-512:966FC2819E9E9EDF54C9029CBB960FEBADD6CD1CC592BAED5915F33D836F9DF4A1FD0F8B776FA6915DCD41B1D106DF6E4CD984590686E6C221E45C50133FFFCC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[.. {.. "version": "0.1.0",.. "notes": [.. "Initial Beta Release".. ],.. "release_date": "2018-04-10T15:04:20.184084-07:00".. },.. {.. "version": "0.2.0",.. "notes": [.. "More extracts and bug fixes".. ],.. "release_date": "2018-05-04T14:19:44.7870064-07:00".. },.. {.. "version": "0.3.0",.. "notes": [.. "Allow for cancel extract during first phase",.. "Shows progress for large amounts of data in first phase",.. "Support rate limiting".. ],.. "release_date": "2018-09-07T14:03:24.3506532-07:00".. },.. {.. "version": "0.4.0",.. "notes": [.. "Allow complex RFIs to be extracted".. ],.. "release_date": "2018-10-04T14:00:35.3321263-07:00".. },.. {.. "version": "0.5.0",.. "notes": [.. "Use smaller page sizes when building extracts",.. "Increase timeout when processing drawings".. ],.. "release_date": "2018-10-18T09:35:43.3629586-07:00".. },.. {.. "version": "0.5.1",.. "notes": [

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ro\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.32258968853905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:gdb6+sGvyofpl7gauOZSZucQZPMH7T1JUbO/dApRS8fBZHIWza:5+sGvyof30auOZSZmZP+JUK/OpUyhja
                                                                                                                                                                                                                      MD5:C985232E250FA2C83BAE4CC28941B612
                                                                                                                                                                                                                      SHA1:1C13112067F3258A5DBB2EC15E16C3F91118AA21
                                                                                                                                                                                                                      SHA-256:A82F5F39387303D3641DD4E2A6E8DBB44316F3560C013A276CA68E1FBDBA1DA5
                                                                                                                                                                                                                      SHA-512:2BA02C93429CE5F01C3D478696694927383CBB245E02DA80AC0173941BB0C700B545C7810A26ED5538A94E5390963615D2F67CC03C729578905C458B0FBBD8C0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............5... ...@....... ...................................@..................................5..O....@............... ..h ...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................V.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\ru\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21608
                                                                                                                                                                                                                      Entropy (8bit):6.082119437294713
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:DKQPmR/HuKDJBkau5ZSZmZP+JUK/OmLDKhKr:DKQ2/RJBfuJ+JU1cKhC
                                                                                                                                                                                                                      MD5:DF95A755A1D857BD9FD593B6BFD037E9
                                                                                                                                                                                                                      SHA1:3538CA0F0DA3D8774B0A42FFF0B7F6DA1CE7DA93
                                                                                                                                                                                                                      SHA-256:44450F187210C8BCC61CEF79808E992D817C96D893E73586250EFA53CE3D296D
                                                                                                                                                                                                                      SHA-512:7941436D4EC6C39CBB0BE9797DCF696E555D93A06A0EB73CC9579BC14DDFE8F16241892CD261EEB57B4461F4A3D7BE9C4C7535895E5F7847FE8E974BA2E6EC0B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(2..........." ..0..*..........2I... ...`....... ...............................&....@..................................H..O....`...............4..h ...........H............................................... ............... ..H............text...8)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H.......P ...............&..0"..DH......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-arm64\native\WebView2Loader.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) Aarch64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):137792
                                                                                                                                                                                                                      Entropy (8bit):6.04209692843392
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:2Mma3Ncfa//PFRO+yaTLEMEtCqCSeS4AQv:aa3NgaNsMEt1eS4Z
                                                                                                                                                                                                                      MD5:06ECF3F289CE5D2E2862217D2E2A63A8
                                                                                                                                                                                                                      SHA1:70F2A9EA03AE6E815EB659C3DEA8225180BFDA73
                                                                                                                                                                                                                      SHA-256:A2DB5A4F76238837D46ABAC8255D1C5F7691D39BBA20C5C5271E64A9700964E5
                                                                                                                                                                                                                      SHA-512:3A1F257A87DD80345EA0131B9A35A5AB915931DCF185F0AFA878F6AAFC9CB9338710B32CB3A72CFC184D0D215A14E598EF67AF048A46C55049DA1E4B4B5F4013
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...U2me.........." .....0...........W.......................................P......T.....`A...................................................(....0..................@(...@......l...8.......................(... A..@...............h...x...`....................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....pdata..............................@..@.00cfg.. ...........................@..@.tls......... ......................@....rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x64\native\WebView2Loader.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):162368
                                                                                                                                                                                                                      Entropy (8bit):6.1918256403694265
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:sjvcJbdPop1MEsdhRVkiO6DxKkHkHA8SKGTT2EtetX72Wnwp:0qY1MdPHrbFkJEtwo
                                                                                                                                                                                                                      MD5:AEE20EF43CF692C9080C5973B1B79855
                                                                                                                                                                                                                      SHA1:B3885791B0E122F8360D6FB7C0E0AC7FE4FA14FB
                                                                                                                                                                                                                      SHA-256:31423E905E29C8A40A483E81DAE1491990805FA066634D218B35BB96692BEF0D
                                                                                                                                                                                                                      SHA-512:EAB6684095C0A7555D921FB1A2E136FA1D761C5766C48571000A97403E6D437A3A4833C571F86C039AA8307FB2FC3FAE1ACFFD63085AE9D2EA0D9E7F9EC1ACE6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...U2me.........." .....N...........K..............................................l.....`A....................................................(............@.......R..@(..........l...T.......................(....a..@...........h...........`....................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data........ ......................@....pdata.......@......................@..@.00cfg..8....`.......*..............@..@.gxfg........p.......,..............@..@.retplne.............>...................tls.................@..............@..._RDATA..\............B..............@..@.rsrc................D..............@..@.reloc...............J..............@..B................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\runtimes\win-x86\native\WebView2Loader.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):117312
                                                                                                                                                                                                                      Entropy (8bit):6.490545802062009
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:yOoLLhblA9t2JqgDyBGFHyklk3QKHS8TnoEtpAl+D6uq9FZ:0blct2JFkxkxEtisPqB
                                                                                                                                                                                                                      MD5:9A9DF483ED55BD568CCCDD7485804931
                                                                                                                                                                                                                      SHA1:1C0D0363AF131AAB8CD81108C16354947007856F
                                                                                                                                                                                                                      SHA-256:AD5CFE82F102739D4CC15C3EB38A411525762520C9C4229C902F67DBAB23C5FB
                                                                                                                                                                                                                      SHA-512:0C989EA9E3C3CCFB7F8990098B1F5B0C7BFA311F83438AEB5047FDF3ABCDA872905927DDBD17245A9DE2E73DEFD69DFEE5271BE2DB254154C2F8E5478096DE8D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...U2me.........."!................PD..............................................0Y....@A.........................u.......v..(.......................@(...........n..8....................l......`............... x..<...lt..`....................text............................... ..`.rdata...u.......v..................@..@.data...,............z..............@....00cfg..............................@..@.tls................................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sk\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18536
                                                                                                                                                                                                                      Entropy (8bit):6.1607630308956605
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Varna3JUt8gBauHZSZmZP+JUK/OXeShMy:VaAJsn4ub+JU11hn
                                                                                                                                                                                                                      MD5:987ADBDAA5EC31F04BB55853B765704D
                                                                                                                                                                                                                      SHA1:7213F6B14FAD0169C9E79457A5A2E773B1892930
                                                                                                                                                                                                                      SHA-256:B2A3FFDB29273843886910B9CBA65557CEA94242CA44DE186BD95D4E9F0FCA40
                                                                                                                                                                                                                      SHA-512:9393E5EC93E57DC5B32F5D0B18EC4455713F2985648F50C305EAA9EBB89A73E6291491F184226C684123B1937E5387D40319629CBD63B14C27D15A35364CE8D4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2..........." ..0..............=... ...@....... ..............................t.....@..................................=..O....@...............(..h ...`......l=............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............&.......<......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sl\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21096
                                                                                                                                                                                                                      Entropy (8bit):5.94908140344428
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:D5/oxt9HTP/xz2TtfgI2augZZSZucQZPMH7T1JUbO/dA8jkpBZHSIU+:Boxt9xyTS9au8ZSZmZP+JUK/O8jkfhF
                                                                                                                                                                                                                      MD5:7D69E51D738027F0B981E022592BE2CB
                                                                                                                                                                                                                      SHA1:D9CE285C61A9B6908417735D35F5A8E3966A9CED
                                                                                                                                                                                                                      SHA-256:E69DBD877DA160F7B92000D3E2155D3378E3CBEE9057C02AB6A7551D263E0876
                                                                                                                                                                                                                      SHA-512:D89A5952F21166BDC22F9F477CD6D41579B517046BD91D80DC93027434DD44254A00A9AC15D98160915CE82DFDBE8FB5EE9495AD0444CCD9AE08E0C7C2BE13CB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..(...........F... ...`....... ..............................cy....@..................................F..O....`...............2..h ...........F............................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H.......P ...............&.......F......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................D.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sr-Latn\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18536
                                                                                                                                                                                                                      Entropy (8bit):6.139775468082087
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:jsajCSa3CnrkNPauYZSZucQZPMH7T1JUbO/dAiBXVBZH1Rgm:FjCSa3CrkNPauYZSZmZP+JUK/OiBXTh3
                                                                                                                                                                                                                      MD5:23B0BA65215FCA1EE47C3194D0439696
                                                                                                                                                                                                                      SHA1:B668AEEAB4F9D6319BC4E88B7AAE767A6B009E22
                                                                                                                                                                                                                      SHA-256:9ED6E24F46A3300069CD8C783D1AF489CA2943331118B27CE4EF8A014FD97787
                                                                                                                                                                                                                      SHA-512:1F975C4306844E1C204F31DDB5525CF49C06B5DDCE23E6EE212CF3E77A4EBBBC9FF197AD882CF07A1D4FC72B5C63C91FBF292696C3677A0A9FE8428C1D9F2C83
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Zf............" ..0..............=... ...@....... ....................................@..................................=..O....@...............(..h ...`......d=............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................=......H.......P ...............&.......<......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........w.....w.....d...........D.....D.....D...A.D...^.D.....D...*.D.................^.....^.....^...).^...1.^...9.^...A.^...I.^...Q.^...Y.^.......................#.....+.....3.G...;.....C.....K.....S.......................V.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sr\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):19048
                                                                                                                                                                                                                      Entropy (8bit):6.2262912758363305
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:iKRWha3cQrpoNhyauvZSZmZP+JUK/O++5kxheO:iKRRFaNnuz+JU1nsheO
                                                                                                                                                                                                                      MD5:2112C6F7876EA41F4832CDFC57A3A6BA
                                                                                                                                                                                                                      SHA1:769DD8D40A5A8DB319BE9B9811EDA1FB996BA1C0
                                                                                                                                                                                                                      SHA-256:C817A0F696919F2291BAF2266C1529D7CFD7E11C5D24042F1556600F03C6DAD6
                                                                                                                                                                                                                      SHA-512:1AFD531E029DC0E981630E492388F63EA789C8D4A94687E8DA08B31866CF1DB28A04D50449BBF3ACCF2F1EBB827561900E1906FB30F4C92648DF87E012B4BD97
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.. ...........?... ...@....... ....................................@.................................P?..O....@...............*..h ...`......4?............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................?......H.......P ...............&.......>......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.......................\.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\sv\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.318371460733676
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:GsZlETsRJvykLr4HPzJWVau6ZSZucQZPMH7T1JUbO/dAs7JWtBZHwS:FKQRJvyA4EVau6ZSZmZP+JUK/Os7QrhZ
                                                                                                                                                                                                                      MD5:0F605065CA864ACAAD5F96E50ED6568A
                                                                                                                                                                                                                      SHA1:3ABBE0F7CAD51C7F244212D6995A6D0ACB44B634
                                                                                                                                                                                                                      SHA-256:0207128EEFCEC5864205E20207DA85D47B4D50B1C750DD5E932EC23483046B23
                                                                                                                                                                                                                      SHA-512:D2D60B86943F314593409BFDC842FB9575579A7A86BC2117EA07EA6E0F56076900D1A0367D28845E3BD73FDD7EF7C181AAE42BE5EE76214C5DD3FF5D667D7BDE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.6..........." ..0..............5... ...@....... ....................................@..................................5..O....@............... ..h ...`......l5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\th-TH\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):29800
                                                                                                                                                                                                                      Entropy (8bit):5.80574622682804
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:voYlhWHPxI/nt7Fwau+ZSZmZP+JUK/Ozah/TU:voYm+pjuG+JU1Wh/TU
                                                                                                                                                                                                                      MD5:C9ED55F437DA69B383979774F013D579
                                                                                                                                                                                                                      SHA1:DAAFCC2934E1F4AD6ABD9371AE1750945673FD86
                                                                                                                                                                                                                      SHA-256:EE870C95353459D3EF470A45578A0C54A20B429A2C3E3AF0B8F9A6EABC0CBE53
                                                                                                                                                                                                                      SHA-512:225E9CD4C9BEF82A827AC41B13304A659E334FEF087E4ACF6890BA2166992D8B644742692FE0C1F49642E25997D7DA99CC21CCECA91C8D991F490DD182A6F460
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....T,..........." ..0..J..........vh... ........... ..............................].....@.................................$h..O....................T..h ...........h............................................... ............... ..H............text...|H... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................Xh......H.......P ...............&..pA...g......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\th-TH\Procore.Ditto.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):26168
                                                                                                                                                                                                                      Entropy (8bit):6.077895401158316
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:HPfSnGFr6h8+h8ATh4hUA3AdT5lT5LT5HT5yT5ihpiWl1lpCUe90gEtPu+ttK0hR:y5LkkDhZKE/liXfemE6qMJ7o03hJB0
                                                                                                                                                                                                                      MD5:68BA0442B4F70375397BF63DA2D9DFD7
                                                                                                                                                                                                                      SHA1:8B8D3910320E778E30D1C98ED402CB71C293D32A
                                                                                                                                                                                                                      SHA-256:689C213D2DF108197294B835BA7342E64B0C6327869966A70B3C8837EBBBC36F
                                                                                                                                                                                                                      SHA-512:1DBD23C2BED7CEB8AC0264BDE856484AFB33C54D12E8309597994CF491939D858087EB82C4C3C9D3C42D28F942C1AFC3CF1A1B9EDAAE6948DF6EEDA70D685E41
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!.....>...........[... ...`....... ............................../.....@..................................[..O....`...............F..8 ........................................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............D..............@..B.................[......H........W..............P ...7...........................................7.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....n.......PADPADP*......6%.mM....:..t..=.....-..+3..o.tc9...;......xm.rXk...i.....o!...z......................}.(......<...J..]p..n...n...A..........V5..(_..4M...\..................~.`.ip..J....).+6...Z.....Q.h.TSS.VSS.WSS.^P..Qx..

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\tr\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.3138951461728565
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:HMPlEC97vy0RzrTaumZSZucQZPMH7T1JUbO/dA46XzABZH2se:GKC97vy0JrTaumZSZmZP+JUK/O4gShVe
                                                                                                                                                                                                                      MD5:A59EDCB1D35B3F81712D666BB058C8DF
                                                                                                                                                                                                                      SHA1:25B3BB4C0CCA017D37747A0F1B4ECA933D7F525B
                                                                                                                                                                                                                      SHA-256:516B5CC2852EC3C8E4DC948EAC4ABC0972957272939FEBA59073C2153ABB0A28
                                                                                                                                                                                                                      SHA-512:F2A4844C6C167E71F1ED9C5FC441BD018A655163F81E47C04C4F1B7617DA3AF24E532FA5D7B473526385D7A017C2D4CE4657A1ED12750B13646F0C8866327D82
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... ..........." ..0..............5... ...@....... ..............................5U....@.................................p5..O....@............... ..h ...`......T5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ...............&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........r.....r....._...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.......................\.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uk\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21608
                                                                                                                                                                                                                      Entropy (8bit):6.099395145853058
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:B/syqXaMEfh04wdro2uauPZSZucQZPMH7T1JUbO/dARADMazOBZH7O8:9qXazwdFuauPZSZmZP+JUK/ORA4azEhl
                                                                                                                                                                                                                      MD5:598B902041E474F48DB0B427AD591938
                                                                                                                                                                                                                      SHA1:DB5A9B8AE8085FA46466DD1FD72D39260A33E75D
                                                                                                                                                                                                                      SHA-256:54BE25EDED7C106B3636F431F94C9092B0DF31F1691BB31AF8C3B14A5D7058C6
                                                                                                                                                                                                                      SHA-512:BBEBAC0D9A14EA9B5DD81414F57FDBCB24A3F010E88914BEAD51EF75ADA0C51925AB494002277BA65483FDD4C7A3F81A3FE20C356C2DDC982058B01233EB6322
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Kw..........." ..0..*..........ZI... ...`....... ..............................N%....@..................................I..O....`...............4..h ...........H............................................... ............... ..H............text...`)... ...*.................. ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................<I......H.......P ...............&..X"..lH......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uz-Cyrl-UZ\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.344300158852619
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:f0PXavyJg7Zeau5ZSZmZP+JUK/OXqe2shu:f+uECNuJ+JU152shu
                                                                                                                                                                                                                      MD5:F93DB11BFC92B70AEFDE315907EA642A
                                                                                                                                                                                                                      SHA1:51C9D1046C014BF5B1F59DC04E3711ACF4646394
                                                                                                                                                                                                                      SHA-256:EDE88335AC756A75EBF2ABC660B3B70565E4CE46E6E9F0F0E15BAA28F10C2283
                                                                                                                                                                                                                      SHA-512:90A470ACF66F3EB405B813C6280033910BE6812C847F6ECE4F96CD94E92C96D0537FB81C65648BDF155017CACEDCE4E700FEC3CD8EB9270666CA09217EB4B1E6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....EO..........." ..0.............*7... ...@....... ..............................n.....@..................................6..O....@..............."..h ...`.......6............................................... ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......P ..............$&......<6......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................7...........z.....z...!.g...........O.....O.....O...L.O...i.O.....O...5.O.................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\uz-Latn-UZ\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.3208676855079675
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:6Q4ZvyYRiX+VauzZSZmZP+JUK/OlbjjR+nlho:6Q8bRiOUuH+JU1V8lho
                                                                                                                                                                                                                      MD5:9A529EC654E911594CA35FC9C401339F
                                                                                                                                                                                                                      SHA1:6AF3D38FF4C6C31593A691E252CCC6409329670A
                                                                                                                                                                                                                      SHA-256:6C19BC1B40E788E667F02C9838549D14C40AFBD5CF35A9CFABE85DED7625ED94
                                                                                                                                                                                                                      SHA-512:A92D66CBD0928E45DE894BFCEE566B34C70AD3C2F8F64A77FE77E52C3F373524F2EC99F6C2B7444D8EABBFDD39F122D47D0829DD0770C1116EDCD6130FD47EAC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Fpt..........." ..0..............5... ...@....... ....................................@..................................5..O....@............... ..h ...`......l5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ..............$&.......4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................7...........z.....z...!.g...........O.....O.....O...L.O...i.O.....O...5.O.................a.....a.....a...).a...1.a...9.a...A.a...I.a...Q.a...Y.a.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\vi\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17000
                                                                                                                                                                                                                      Entropy (8bit):6.2480643742650575
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:MIB5vyJDT6etauSZSZmZP+JUK/O6X4hD6hYt:MIvEDT6esua+JU1S44hYt
                                                                                                                                                                                                                      MD5:1F81D18175CE005283CD5DBBC2EA238C
                                                                                                                                                                                                                      SHA1:B62694AD06629D1162096CC2AAE811005834579E
                                                                                                                                                                                                                      SHA-256:2E22CA18E5F91FD1B9AE6638C6EE9A178F663B60768BC33EFBBD0A70997BBD0F
                                                                                                                                                                                                                      SHA-512:384267C9C847C9835A83BC53E77EA9A1021569CE38FB0290FA7CF59EC48D11AC4E7978B511D3390B11F96962ABD410A1B886F2383505996C2EC65E580690043F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....%..........." ..0.............J6... ...@....... ....................................@..................................5..O....@..............."..h ...`.......5............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................,6......H.......P ...............&..H...\5......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3....................................../...........r.....r....._...........G.....G.....G...A.G...^.G.....G...*.G.................Y.....Y.....Y...).Y...1.Y...9.Y...A.Y...I.Y...Q.Y...Y.Y.......................#.....+.....3.G...;.....C.....K.....S.......................,.............

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x64\e_sqlite3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1307648
                                                                                                                                                                                                                      Entropy (8bit):6.531159957932716
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:0I4VLItEVK887MKl6hqwbasJ3E1Hp5TD01DCx0XYaRox3:0lVLqeK887MKl6UWaU3ipJ0oxyRo
                                                                                                                                                                                                                      MD5:AB8EF17AAD37D4E73B1E73AB10376E0A
                                                                                                                                                                                                                      SHA1:F1BD22E3365FA445708C0708A3B0B0F5E919B6B0
                                                                                                                                                                                                                      SHA-256:36007AA37E7F5BA90DBC3DC92F5A701D924DEDDE3778C12E68ED365D6551D7C9
                                                                                                                                                                                                                      SHA-512:0922ADF559C34F53D030DF323B91C497FC77AD3EAD91A0B0D2157F1D612758AE7B2FDCBDA37E2D8912CA0D54CDEC7ADC425D5DE18580D54BE96347CF32E889C7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.....I...I...I...I...IkhvI...If..I...If..I...If..I...IU..I...IU..I...IU..I...IU..I...IRich...I........................PE..d...pY.\.........." .................7.......................................P............`.............................................y ..<...(.... .......@...............0.......................................|..p............................................text............................... ..`.rdata..............................@..@.data...X........`..................@....pdata.......@......................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\x86\e_sqlite3.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1006080
                                                                                                                                                                                                                      Entropy (8bit):6.717081491258647
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:CF8G62QYfgiMKejezJxeT2075br9MnuZuqOa1kvMW5F993Hn5igL7o:CFT62QDitJzJYUuZzOOkvMWbP3Hzw
                                                                                                                                                                                                                      MD5:F9C90FD61FBDDAC7E92A351F0D7FCC92
                                                                                                                                                                                                                      SHA1:779981FA26EED2A59A1ED96A9ED807AD48592993
                                                                                                                                                                                                                      SHA-256:79BD3C98FC683919951755E9818C7C0CE595638A9A4CB8E8E75AC5CF6580249F
                                                                                                                                                                                                                      SHA-512:771B4D7758684B16C9B2C349262352C4D935AA4DEDE695399DB25B56603BC1CBEB793BAE9A75A18BFF9390F011F9CCC334B1177A9A9F460850515338030119D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............f...f...f...g...f.q.....f.|t....f.|t....f.|t...f.O^....f.O^....f.O^....f.O^....f.Rich..f.........PE..L...fY.\...........!.....(...P.......{.......@............................................@.............................y ..4...(....0.......................@...h..................................P...@............@...............................text...d'.......(.................. ..`.rdata..)q...@...r...,..............@..@.data...|i.......H..................@....rsrc........0......................@..@.reloc..Fq...@...r..................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-CN\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.3237825303803366
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:locThvyOKau3ZSZmZP+JUK/O7mhnJhD02:loc9Jxur+JU16FJhD02
                                                                                                                                                                                                                      MD5:FF6994B813EE7662072519F59BF632F7
                                                                                                                                                                                                                      SHA1:F580FCD93FE5541519D15D983FE55AEF53647363
                                                                                                                                                                                                                      SHA-256:CBF04E916148248724CB9732B4280B45E7EE747835A18D91A089BB264ACF138F
                                                                                                                                                                                                                      SHA-512:00BE5BCFEE78B35D7CA0A88FAB69CCE90A8D8AB67D6CB1D6CBFDC08C1A6AC1638B7728A61876F56B8FBE822DB0F8BD4AB8C33C466371B799AE1C6547D954F0CC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,............." ..0.............f5... ...@....... ....................................@..................................5..O....@............... ..h ...`.......4............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................H5......H.......P ...............&..`...x4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................2...........u.....u.....b...........J.....J.....J...G.J...d.J.....J...0.J.................\.....\.....\...).\...1.\...9.\...A.\...I.\...Q.\...Y.\.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-Hans\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.3245920886480835
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:664lECsYhvyOh4UauFZSZucQZPMH7T1JUbO/dAuDIXNqBZHNG:6nK7YhvyOuUauFZSZmZP+JUK/OuLhY
                                                                                                                                                                                                                      MD5:87E7C0814A3B0BDF10BBF66ED8CC3420
                                                                                                                                                                                                                      SHA1:940097D62567F56C0AFD30E2CAD85A0159C4E6EB
                                                                                                                                                                                                                      SHA-256:EFC62C3DC83680CFD2AA6218C94513E5E636E7AC8029A1200D2403A4BADC1BC8
                                                                                                                                                                                                                      SHA-512:F52C592856F627F80C094FDBE1A651BA4567F08F4C7F78943AED67308713BF6C823F8EB5AEEB5B5907B83A947AC29C07E33464686DF650968EBC12014AC62FAC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............j5... ...@....... ....................................@..................................5..O....@............... ..h ...`.......4............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L5......H.......P ...............&..`...|4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\zh-Hant\Humanizer.resources.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16488
                                                                                                                                                                                                                      Entropy (8bit):6.3296240449005134
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:O64lECslhvyOhwDtkEvk2JFWau4ZSZucQZPMH7T1JUbO/dAWeK2i0BZHiN46:OnK7lhvyO6Wau4ZSZmZP+JUK/OWehT6
                                                                                                                                                                                                                      MD5:BBCD2ADB360BFA1C38F0AFA82EF35351
                                                                                                                                                                                                                      SHA1:D2DC4EA5D2812BC3312E757751B1B20AFBD9FB33
                                                                                                                                                                                                                      SHA-256:D2F61C4AFBFD6553609EE43803C1088E850A71A2BC3BC67AAB594E8C9C039C6D
                                                                                                                                                                                                                      SHA-512:C8AF752EA46A24692C51E10D1491100DE19BF6A61D0293E0ECD5168925E8C6F08D3F582AD1498B480DFC2DD4A886B6BCAF15B171CAE45421D6CC40A3A4329BA2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Z............" ..0.............j5... ...@....... ....................................@..................................5..O....@............... ..h ...`.......4............................................... ............... ..H............text...p.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................L5......H.......P ...............&..`...|4......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID...........#Blob......................3......................................,...........o.....o.....\...........D.....D.....D...A.D...^.D.....D...*.D.................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V.......................#.....+.....3.G...;.....C.....K.....S.....................................

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\logs\bobcat.log.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4460
                                                                                                                                                                                                                      Entropy (8bit):5.285569802980904
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:LVE42H9KE8uKjSaEu+XFdFspFs+FMF3F5FRFaFjF0zAWbsx0zWbIuWbZ:J+oE8tkDWpW+KNfTgR8AoZzoIuoZ
                                                                                                                                                                                                                      MD5:AE24DCEE14B309F397709027D2C9B155
                                                                                                                                                                                                                      SHA1:10306B7122BBE9337F547D1E0E413844C029D1FD
                                                                                                                                                                                                                      SHA-256:7A6EBCAD294EC2ACCCA5B852F183FF31E014DB40032FA41C6E03DF4E6396CE30
                                                                                                                                                                                                                      SHA-512:28B9329FD1A19F4FFE7E2DC79068F4AD4D16A4BE74AD7C550157571EB6E3BB52DBBC1B16F182489A1849933C2DB3794D4E2AED6E1E6A78DCF5AFC05F40AE38DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..[08/10/2024 17:01:31] Installer::InitializeOperation`1.. Using the following files for initialization:.. - C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\CONFIG....[08/10/2024 17:01:31] Installer::CreateDirectoriesOperation`1.. Creating directory C:\Program Files (x86)\Procore Technologies\Procore Extracts.. Creating directory C:\Program Files (x86)\Procore Technologies\Procore Extracts\packages.. Creating directory C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1....[08/10/2024 17:01:31] Installer::CopyPackageFilesOperation`1.. Copying file C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Procore.Ditto.1.3.1.full.nupkg to C:\Program Files (x86)\Procore Technologies\Procore Extracts\packages\Procore.Ditto.1.3.1.full.nupkg....[08/10/2024 17:01:32] Installer::ExtractNupkgOperation`1.. Unzipping C:\Users\user\AppData\Lo

                                                                                                                                                                                                                      C:\Program Files (x86)\Procore Technologies\Procore Extracts\packages\Procore.Ditto.1.3.1.full.nupkg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11807036
                                                                                                                                                                                                                      Entropy (8bit):7.996746107573553
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:196608:fsgVU0NJ0+FoVNy3+bjlLitr8PywL3+0Wd56pvps+S8YJ/z2h7fydoGR:fsQXFoVNkW2V8KlZ6xps+VY12h7fsBR
                                                                                                                                                                                                                      MD5:F49076D22E5FFA34CBC129437AC86E65
                                                                                                                                                                                                                      SHA1:DB4DA2D467BAB1EADB804DDA032E8E617C699CC2
                                                                                                                                                                                                                      SHA-256:754F2ED579F850969F861BAA7BD1180644BD693A688B444824FB14926AD65433
                                                                                                                                                                                                                      SHA-512:44A52242CC48E8848B899D578686E1E461897DEC9E93AEB0A94A72A387D2E7A74486A921D0471523CAEF1BC832E99BFBEB2D4B7B2E2C60874A1C8E08DC74D3A7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:PK...........XW..U...O.......Procore.Ditto.nuspeclQKN.0..#q..k..6.)r.....b....4...=..l,8.W........{o<3_..r..7..|0v.h..%0h.....W.%...W.).V-.(.BE;Dw.y...*..ho.]!.....G".qQ.a..h....a...P5../..4....z`...J..TK..36f.....hp..3...+.A.?>...;..Q....vc[..<.Z.$9.....?.......{.vX?.^.v$..$O~.........T.5HI\go..M^d.r|'Vy1.Y..4.8.-. .(.1.V.!rJ.i..C....&....[GP......_W....G.....~.$...d:7.....PK...........XS6......O.......[Content_Types].xml..AN.0.E.H....%.,.BI..n...3I..x.D...-+$.........~..Z!.............E..A.w.W..'..\F..$B...`.\G.....l%?.h..;..k.{."..Tr..yM......Q/[.N....z:...N[............Rg.......V.W...;.L.b..RN.x.S.]<.N@..}.%8.o%8.c...>.......%<.L.......}. ..PK........$F!W.4......0@%.$...bobcat/Procore%20ExtractsService.exe.....E.?.S..s..&...^....iff7..$@......p.$.7.HCO..a....I.._..p.."".x...@8...P.....}.OUu.L6..~..d....z..z..w_.u.4....>3.;..o......_].]u......Y...}.YY.:.s...=...CW.rWw.vd..fU..U];.w....G...&'(.{.7.E..8....x.7D.&.7.L.a.%lxk.w..seXH..#x........5.l....

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                      Entropy (8bit):0.363788168458258
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
                                                                                                                                                                                                                      MD5:0E72F896C84F1457C62C0E20338FAC0D
                                                                                                                                                                                                                      SHA1:9C071CC3D15E5BD8BF603391AE447202BD9F8537
                                                                                                                                                                                                                      SHA-256:686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
                                                                                                                                                                                                                      SHA-512:AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1310720
                                                                                                                                                                                                                      Entropy (8bit):1.3108071756583959
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr3:KooCEYhgYEL0In
                                                                                                                                                                                                                      MD5:E5B49B95AFAE382D0F4A082DB33F1718
                                                                                                                                                                                                                      SHA1:E2B7C14109B9A8CF6C2C16E96069A3C948A727B0
                                                                                                                                                                                                                      SHA-256:7CA4250F22F66247865093E7A4FD709828A817597429C9651BE3B9893793F21D
                                                                                                                                                                                                                      SHA-512:29DEF3603EF9604142049ADF45BFF98AA7B90ED76DFF740592065CCCC2DD02079F61B4FF242A8F3EE244418A8AFE3411B19DF00425B431920BB67EF4EE4E2288
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:Extensible storage engine DataBase, version 0x620, checksum 0x7bf328c8, page size 16384, Windows version 10.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1310720
                                                                                                                                                                                                                      Entropy (8bit):0.42220024468398487
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:HSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Hazag03A2UrzJDO
                                                                                                                                                                                                                      MD5:F067AE00E4D32315352AADDE3AD18346
                                                                                                                                                                                                                      SHA1:8B584D861E6921FCA45B2C3050A48EAD7EB33120
                                                                                                                                                                                                                      SHA-256:03B2B34D47AF40D612E7F53AD13FF5DD07161A0F6F02DE3F05328787E0D8B575
                                                                                                                                                                                                                      SHA-512:1C71002AD187766E8887E5B26300F415045828A311A07B6CAEF2B1FE2A2E6D8A86E3B70FAC73F4EBFEADF29E997CD445FD18C2889E3E234DE148DFA81D6B697B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{.(.... .......Y.......X\...;...{......................n.%.....,....|.. ....|..h.#.....,....|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................A.H.,....|..................b.B.,....|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:COM executable for DOS
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16384
                                                                                                                                                                                                                      Entropy (8bit):0.07798571759154403
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:umllsetYeyzBCJmYKvXlTtKv58vMoCCvXlaO3vXlallOE/tlnl+/rTc:Lllzq9vmdMUOPApMP
                                                                                                                                                                                                                      MD5:AB23757E7B785F66B25703C177CEDAF4
                                                                                                                                                                                                                      SHA1:4ADA2B3148D8C4B95C26A3F8AF1D49728DF241F2
                                                                                                                                                                                                                      SHA-256:9E89D9A046711F16C33F1622B6F993E462B13D6D709A67C9406DFBF04603ECA2
                                                                                                                                                                                                                      SHA-512:A4A1F098EA8354030C5919869A3A649238C3A21A8BCBE0BC560217558FF04C6CBCB5994CEA05F463735E8098009D453D2587F644009275B27B68FFBBC7A6F82D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.-. .....................................;...{.. ....|..,....|..........,....|..,....|..3e.k,....|..................b.B.,....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Procore.Ditto.exe.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe
                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2115
                                                                                                                                                                                                                      Entropy (8bit):5.358655931162401
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:MxHKQwYHKGSI6ouHlJH/lEHuFKHKSqtHTHhAHKKkhHNpNHK/:iqbYqGSI6ou/fmOYqSqtzHeqKkhtpNq/
                                                                                                                                                                                                                      MD5:CBEFA68D95B6F62215E66592D20EF8D6
                                                                                                                                                                                                                      SHA1:01978C9457B5D8A88F31E942A849D2188BADEEFC
                                                                                                                                                                                                                      SHA-256:F7F243110635B6708DA5797A3845A6B7269406EA4B4C4350F52B067574D13FE6
                                                                                                                                                                                                                      SHA-512:507B019E2CDBD4C7C01290C960CFB4D629C52BA5E6D6C6AF2F79E9116948417DFB5E09D120554E799B80E6DCB52701211501EAA21828E2D9F5E43D2D9ABC9F91
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Procore ExtractsService.exe.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):2232
                                                                                                                                                                                                                      Entropy (8bit):5.358587650560351
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:MxHKlYHKh3oMHKcEmAHKzectHo6/HKU57UjHKtHKMRb8mHiIHoVnM7HKx1qHj:iqlYqh3oMqcERqzttI6/qU57UjqtqMRj
                                                                                                                                                                                                                      MD5:A5C8AF7F23C629C6A493FA22D22D8DB6
                                                                                                                                                                                                                      SHA1:87BC5E095C1B08D0C5E9C5D800D7EBFEFB4844B0
                                                                                                                                                                                                                      SHA-256:08AC1D16AE10B225914E15C70EA2A9BC5F014DC08EAB70D9DBF4101DFDEFC5B0
                                                                                                                                                                                                                      SHA-512:E502C758AAAB10D6D7A41B0707C03D562555B552D41174E634BDF0C2D5553F75875E43A5FF2287ED31A5FFDDDC48F84C385C7D27D27C97ABB7D4E186CDA56A13
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\7303aa806c500e4fa37f223dafb1ddcc\System.Xml.Linq.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Procore Technologies\Procore Extracts\logs\ProcoreExtracts-20241008.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):368
                                                                                                                                                                                                                      Entropy (8bit):5.0353143762247115
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:nAd7OFDbPMAdKITFDjNgkIMAdH5/FD3kBIgprizwF+MAd+IVhFDNA8xKLM+DO5iV:KOFyOde5/pk5BQ1Vh1yM+DO5QR
                                                                                                                                                                                                                      MD5:54881EF39111BF986D29FDFB0B643FA2
                                                                                                                                                                                                                      SHA1:9EB508337826771809D473984563005FE34FB99F
                                                                                                                                                                                                                      SHA-256:5F0B0CADA55362D4B2B81E2029D7E644A95D026E7AC909677213B645472C4352
                                                                                                                                                                                                                      SHA-512:3D5E780FA19B70F914431CBC75C96E6AA6F6E6DFEDC78A648E9AE3947E6C17183F5BF2D01B7FEBC0C01C999EF90359715643F94A370A8C3E8607906D441CCD4B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:2024-10-08 17:03:39.139 -04:00 [INFO] --------------------------------------------------..2024-10-08 17:03:39.248 -04:00 [INFO] App Class Created..2024-10-08 17:03:39.404 -04:00 [INFO] Manufacturer and Model: "yC22UnmpBzmtFkN/BgBGVBDB"..2024-10-08 17:03:39.420 -04:00 [INFO] User string: "ProcoreExtracts/1.3.1 (Windows NT 10.0.19045 X64) (yC22UnmpBzmtFkN/BgBGVBDB)"..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\bobcat.log.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6635
                                                                                                                                                                                                                      Entropy (8bit):5.388619825023626
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:NapAK4j/iRjjjd0sKH0sZ0sg0si0si0d0I0sd06bN00j9pVE42H9KE8uKjSaEu+u:fr9jL+oE8tkDWpW+KNfTgR8AoZzoZ
                                                                                                                                                                                                                      MD5:F4CCA150EB522247C8E1A5B57725FD79
                                                                                                                                                                                                                      SHA1:66D83563475334361BBBF01A2735AF3E184CBFA0
                                                                                                                                                                                                                      SHA-256:08169983F65B9198C774430FFE83700B083DB0E86C48FA19ECAC7B7B12D04AEB
                                                                                                                                                                                                                      SHA-512:D7716196C847D578196B71EBCDE23D0574595AB38756DE66B18F7D34C0FA745EC9A165E4895C56A2401C5802D19867878D498E133DBF3DDCC93886DB6D4B4A09
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[10/8/2024 5:01:29 PM] Setup.. FrameworkVersion....[10/8/2024 5:01:29 PM] Setup.. net471....[10/8/2024 5:01:29 PM] Setup.. Opening Zip file....[10/8/2024 5:01:29 PM] Setup.. Extracting to:....[10/8/2024 5:01:29 PM] Setup.. C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}....[10/8/2024 5:01:29 PM] Setup.. Extracting files:....[10/8/2024 5:01:29 PM] Setup.. C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\CONFIG....[10/8/2024 5:01:29 PM] Setup.. C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe....[10/8/2024 5:01:30 PM] Setup.. C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Procore.Ditto.1.3.1.full.nupkg....[10/8/2024 5:01:30 PM] Setup.. C:\Users\user\AppData\Local\Temp\Bobcat\Procore Techno

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\CONFIG

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):190
                                                                                                                                                                                                                      Entropy (8bit):4.784438217195675
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:3HVzjMKn9NyKGMt6sLR9Eo7WtQLHgJylyHf9XTK9IVn9XGaLih/IkhEKHL:3HtjMKn9GmLR9EoRcX/9XTK2GAeIkhE+
                                                                                                                                                                                                                      MD5:C0F953C1E6630672A18FD01DCF79FC6B
                                                                                                                                                                                                                      SHA1:5DB9FE931017EC442F203A97DAD9F9645ECFA424
                                                                                                                                                                                                                      SHA-256:D5AA8C4B50DBF0FE39CBA5495DEBE40C34ADFC31CA244BA638FD499B3A7659F6
                                                                                                                                                                                                                      SHA-512:E3245162B590DC224B81A953D231F8A49A9480D2669FEE22643E1C1F538A1DFFCC1344C8A220022B85CA2519A9CBBAA90F0740F287061981A3FF390BC2A6CC9D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{.. "releasesFileSourceLocation": "https://procore-ditto.s3.amazonaws.com/RELEASES",.. "product": "Procore Extracts",.. "company": "Procore Technologies",.. "appName": "Procore.Ditto"..}

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2201656
                                                                                                                                                                                                                      Entropy (8bit):5.872139829530433
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:HIVLPXfj1wKDWOi2mkFTUIUHyOWyi8VrkdoQ+SGOFa:c71TUxZdQ+SG
                                                                                                                                                                                                                      MD5:E73E328086CD27F5DABE17802ACF2AF8
                                                                                                                                                                                                                      SHA1:4D02733317079654190BF2E7268783F287CFEF92
                                                                                                                                                                                                                      SHA-256:557C81F449D20E9314518AB31DE1FEF4E740A0439BE3F2363E7E4F79823CFA8C
                                                                                                                                                                                                                      SHA-512:3A4477754161FD0C0FE42F246E04B04B224BB8F03C559AA5245F72A67230F843B3B159691C6D09104DB45F52769CBA5A43BB126F8F57C49F6978E1E24A7DA4A0
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe, Author: Joe Security
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..d.................n!...........!.. ........@.. ........................!......."...@..................................!.W.....!..............x!.8 ....!.....L.!.............................................. ............... ..H............text...$m!.. ...n!................. ..`.rsrc.........!......p!.............@..@.reloc........!......v!.............@..B..................!.....H.........................................................................{....*..{....*V.(......}......}....*...0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....*.*.*.... ..f. )UU.Z(.....{....o....X )UU.Z(.....{....o....X*....0..b........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(....*....r;..p(...........s....(...+(...+*..0...........(....o.....~.....(...+*.......%.r?..p.%.rI..p.%.rU..p.%.r_..p......*...

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Procore.Ditto.1.3.1.full.nupkg

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11807036
                                                                                                                                                                                                                      Entropy (8bit):7.996746107573553
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:196608:fsgVU0NJ0+FoVNy3+bjlLitr8PywL3+0Wd56pvps+S8YJ/z2h7fydoGR:fsQXFoVNkW2V8KlZ6xps+VY12h7fsBR
                                                                                                                                                                                                                      MD5:F49076D22E5FFA34CBC129437AC86E65
                                                                                                                                                                                                                      SHA1:DB4DA2D467BAB1EADB804DDA032E8E617C699CC2
                                                                                                                                                                                                                      SHA-256:754F2ED579F850969F861BAA7BD1180644BD693A688B444824FB14926AD65433
                                                                                                                                                                                                                      SHA-512:44A52242CC48E8848B899D578686E1E461897DEC9E93AEB0A94A72A387D2E7A74486A921D0471523CAEF1BC832E99BFBEB2D4B7B2E2C60874A1C8E08DC74D3A7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:PK...........XW..U...O.......Procore.Ditto.nuspeclQKN.0..#q..k..6.)r.....b....4...=..l,8.W........{o<3_..r..7..|0v.h..%0h.....W.%...W.).V-.(.BE;Dw.y...*..ho.]!.....G".qQ.a..h....a...P5../..4....z`...J..TK..36f.....hp..3...+.A.?>...;..Q....vc[..<.Z.$9.....?.......{.vX?.^.v$..$O~.........T.5HI\go..M^d.r|'Vy1.Y..4.8.-. .(.1.V.!rJ.i..C....&....[GP......_W....G.....~.$...d:7.....PK...........XS6......O.......[Content_Types].xml..AN.0.E.H....%.,.BI..n...3I..x.D...-+$.........~..Z!.............E..A.w.W..'..\F..$B...`.\G.....l%?.h..;..k.{."..Tr..yM......Q/[.N....z:...N[............Rg.......V.W...;.L.b..RN.x.S.]<.N@..}.%8.o%8.c...>.......%<.L.......}. ..PK........$F!W.4......0@%.$...bobcat/Procore%20ExtractsService.exe.....E.?.S..s..&...^....iff7..$@......p.$.7.HCO..a....I.._..p.."".x...@8...P.....}.OUu.L6..~..d....z..z..w_.u.4....>3.;..o......_].]u......Y...}.YY.:.s...=...CW.rWw.vd..fU..U];.w....G...&'(.{.7.E..8....x.7D.&.7.L.a.%lxk.w..seXH..#x........5.l....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Service.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2441264
                                                                                                                                                                                                                      Entropy (8bit):5.884379569865019
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:2rvQ1Mm1BLqNz7PXedmmybXf2h8gJmH1Wa2BQ+dZxGYnfC1iX:rFq5DLoHQ+dZxGeX
                                                                                                                                                                                                                      MD5:0DDB141358F21523C480BE734334B61B
                                                                                                                                                                                                                      SHA1:39436C3E35557F259B233C00FB73F6069E27B7EE
                                                                                                                                                                                                                      SHA-256:80744AF72D0D40A3BE6B1D51D7FECB81EDA52B7D40198507B4B98DBF2A04D3AD
                                                                                                                                                                                                                      SHA-512:2EFD861741A80A805F4F3B19EE6CC8D448DEACF7F703E566E4EE269ABBAA53C2AC5FC2A44508B98D1D6E28CADDEE1E8E9E915C3D5BFA823E383CD14E12947A5C
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Service.exe, Author: Joe Security
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w..d..................%..........4%.. ........@.. ........................%.....4-&...@..................................4%.S....@%.............. %.0 ...`%.....44%.............................................. ............... ..H............text.....%.. ....%................. ..`.rsrc........@%.......%.............@..@.reloc.......`%.......%.............@..B.................4%.....H...........|............................................................0..H.......(d... ....(.....(....,....r...po....,.s....(....&+.s....(....&..(e.....*........@@......R.,..(...+,.......*.*.....(....*.0..c.......~....-...(....~....o....r...p(....~....o....o....o.....+..o....o....o....(.....o....-....,..o.....*.......7.!X......J~....,.~....o....*.:.(......(....*..0..P..................(..........s.........~.....!...(....s....r...ps.....o....s....o....&*.0..t.......sw...%.o

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1961520
                                                                                                                                                                                                                      Entropy (8bit):5.847733337748195
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:60Z+/z0mjEGOYkJuVOwrUo0kUPSosFD5L2zml0/Q4iGWoxU4j:5mAXxwIo0pOLYmEQ4iGb
                                                                                                                                                                                                                      MD5:53D0D21CA5DE8B18483377F44709EB47
                                                                                                                                                                                                                      SHA1:69E83960B27273627060ECEBB3C0889FF5C2C284
                                                                                                                                                                                                                      SHA-256:628F5A5ED91E7A119C1EB843EE0BF51564F068197EB20F991569D1DE574771CE
                                                                                                                                                                                                                      SHA-512:8E285618FCAC6E8BBF01621F0703A68B99818A1BFA6106A262C11BE8A57CBB6790A3E1560AD49F61C240440594C9BB509CB1CF8C3A55BD46C429A5C45FB93D94
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Uninstaller.exe, Author: Joe Security
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y..d............................^.... ........@.. .......................@...........@.....................................O.......................0 ... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H........a..................`............................................0../....... ....(....s.....(.............s....o....&..&..*.........++..+....0..C........r...p(....,%.u....%-.r...ps....zo....s....(....&*(....s....(....&*..(....o....(....~....o....,.(....*..:(v...,.*(....*..0..!.......(....(....&...rI..p.s....z.(....*....................s....%ro..po....%(....o....o....*....(....*..{....*"..}....*....~....*...(....*..{....*"..}....*.....(....*.0..t..............%.sM....%

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2543672
                                                                                                                                                                                                                      Entropy (8bit):5.894906011979179
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:cszGmCek56vCOTxb0m0Ec5EeQBy7ErrJAQ+0aGU8VR:zK56vDTKmxe3IrWQ+0aG
                                                                                                                                                                                                                      MD5:A78AA05082048DC88CA3BA1E223E8753
                                                                                                                                                                                                                      SHA1:0173D94EF734A3A0098DB4C6DFA2793CCCABDD2B
                                                                                                                                                                                                                      SHA-256:752C4FB21A0D4BF84DE33AC08A708DCE2CC328A4EEB150D006C313D73AEF14A6
                                                                                                                                                                                                                      SHA-512:BD43CC7011BA8060A512825DCB23B03B141C6D0E400EEE1E3259A93DBE4A89963D2EDF5901A9D8995DA811F05827F8953F2AF5411742CA0DB78888F5FFD6A371
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Yara Hits:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Updater.exe, Author: Joe Security
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...{..d..................&.........~.&.. ........@.. ....................... '.....0.'...@.................................(.&.S.....&...............&.8 ....'.......&.............................................. ............... ..H............text.....&.. ....&................. ..`.rsrc.........&.......&.............@..@.reloc........'.......&.............@..B................`.&.....H...................#...8j...............................................0...........(......o=...}......o>...}......o?...}......o@...}......oA...}......(....(....}......o8...}......oB...}......oC...}......(....(....}....*.....{....*..{....*..{....*..{....*..{....*..{....*..{....*..{....*^.(.....(....(....(....*..{....*F.(....o....o....*..F.(....~M...(....*..^.(.....(....(....(....*..(.....(....o....o....~V...(....*....(....~W....(....~R...(....(....*..:.{....(......*.b.(.....

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\procore_ditto_installation.gif

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File Type:GIF image data, version 89a, 500 x 500
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):132097
                                                                                                                                                                                                                      Entropy (8bit):7.881180984409393
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:9MSKCJRDrki8Wy5wS3DiCbxZINrkU9zOkW2OTCduh:9MSFJR/5Fyj3DjxZMRzjhOTCd4
                                                                                                                                                                                                                      MD5:C5D119C5E519560AD6F72968B1A7EC27
                                                                                                                                                                                                                      SHA1:9312621F641F8278AEB1986284FE733C4141A75B
                                                                                                                                                                                                                      SHA-256:9C3F85A5AA2CF3F72B67C1210B7D02882BE80A42DE06C4AFA12A73D6A1CBF3FB
                                                                                                                                                                                                                      SHA-512:67BF44F0D07707D67EAC4F2C01830956B98220983587D141A24EE5646E1EDFD750992F0C0AFA005470B519240349562F7815145C28507D55FF2F40A36D64423F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:GIF89a.........|..........[tqr.............................r.4..y..M.*.:...........856.....MJKmjl...............<9;......]Z[.....TPR..A.....ebc...FBD...@<>..a...614...q`........i...:68.......UB>@............zxy=:;412..JD@B.....D..........KGJ........d................u..P...1.0.....pno..S....lGDF.....o..................X.........0,...C?A,)+.|~..>HFF..f.........635yvwvtu.....ZWY......gef......WTV..w..........._\^OKM{yz;7:...rop}z{QNP........F.........................^..........E..H.............jgi..................C15>.....:<D..I............c`a.......D.......?........./...301.....F..G.....D.......................................................H..G.......F............[Y]e..F....../16..Feeh.....X97<..........|R........FCE......!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

                                                                                                                                                                                                                      C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):55
                                                                                                                                                                                                                      Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                      MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                      SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                      SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                      SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                      C:\Windows\Temp\bobcat\Procore Technologies\Procore Extracts\bobcat.log.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):326
                                                                                                                                                                                                                      Entropy (8bit):5.051469662004926
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:t+Ls9QIg0QobymFt5ddzGAz7zTh7qYO2AeyIg6gHQvczzErxZJ77jpy:tIs9QIRddzfPz1+jnHI7vwWd73py
                                                                                                                                                                                                                      MD5:A31D318FC08CA91E9FE6AE0E4AA96AD7
                                                                                                                                                                                                                      SHA1:2539EA0044A3183CE95EB28E19746DB6C2BDF7DA
                                                                                                                                                                                                                      SHA-256:26D01AE0BA47640518D8E883E1C4E8A72541E028D261E4D9043E6593AA70B7CA
                                                                                                                                                                                                                      SHA-512:3CBE1BBB87CAA522A9BFF6DF048E3EBB62E1ED153C0134F1168C0E6FBB71F76F3F97E7FD301F5F8DCCED770A33A91B33B11FD348D12A3125EF2482E019CAD41B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..[08/10/2024 17:02:37] Service::InitializeOperation.. Using the following files for initialization:.. - C:\Program Files (x86)\Procore Technologies\Procore Extracts\CONFIG....[08/10/2024 17:02:38] Service::SetupServiceOperation.. Attempting to setup the service on endpoint net.pipe://localhost/ProcoreExtractsUpdaterSvc..

                                                                                                                                                                                                                      \Device\ConDrv

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):974
                                                                                                                                                                                                                      Entropy (8bit):5.090161354381335
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:hs9xRddzzUs9xRddzzUnojbunojb3Ql3yBHFBHoWBNe:693Z93cWbeWb3Ql3SHnHlbe
                                                                                                                                                                                                                      MD5:9AE288CFFEEFE5DF33403A23288B5020
                                                                                                                                                                                                                      SHA1:721FD847818F675AA6FBD471E5C22A616D3FF4C3
                                                                                                                                                                                                                      SHA-256:9E29A9854DC69DE8F89DB1227797D454297CAB0360A1075435841E8FC5894F83
                                                                                                                                                                                                                      SHA-512:FC192869C428B9F5E3146534379729FCE1AA814C96CD3FB220AAC0F43D8729FED8EA4AB878655D85CB5F5F298928CC8EB2B0F215DCA905E92ADB3C54BC95E520
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[08/10/2024 17:02:37] Service::InitializeOperation.. Using the following files for initialization:.. - C:\Program Files (x86)\Procore Technologies\Procore Extracts\CONFIG..[08/10/2024 17:02:37] Service::InitializeOperation.. Using the following files for initialization:.. - C:\Program Files (x86)\Procore Technologies\Procore Extracts\CONFIG..[08/10/2024 17:02:37] Service::SetupServiceOperation.. Attempting to setup the service on endpoint net.pipe://localhost/ProcoreExtractsUpdaterSvc..[08/10/2024 17:02:37] Service::SetupServiceOperation.. Attempting to setup the service on endpoint net.pipe://localhost/ProcoreExtractsUpdaterSvc..Configuration Result:.[Success] Name ProcoreExtractsUpdaterSvc..[Success] DisplayName Procore Extracts Updater Service..[Success] Description Procore Extracts Updater Service..[Success] ServiceName ProcoreExtractsUpdaterSvc..Topshelf v2.2.11.0, .NET Framework v4.0.30319.42000..The ProcoreExtractsUpdaterSvc service was started...

                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Entropy (8bit):7.992835716559646
                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                      File name:ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      File size:15'481'400 bytes
                                                                                                                                                                                                                      MD5:01168c885557c38b6c067614371bb5bf
                                                                                                                                                                                                                      SHA1:ad7563bc3e9a0123d7d197b41fe60d588971ffe3
                                                                                                                                                                                                                      SHA256:9934c1be5b0c04809ee7ba63c62f0602028dec10766da99c2d89199b63f982e6
                                                                                                                                                                                                                      SHA512:d810f0976e046cf8dfdf93c9f173049b06a77503b1856f591d8c678a88d0f3ef313608291f54989a5f8246bbe16075464891ba10599706d286dbbeb9bfafd123
                                                                                                                                                                                                                      SSDEEP:393216:vSuvExSqrZEs757wOS8sD1siikTPlFccI0wFxK3g:FQSUWK7wZFD1wkTtBIPjc
                                                                                                                                                                                                                      TLSH:1BF63319AABF9413E597E0315DD4667288FDEEDC1CE9418F92408E3B6AF1760810E73B
                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........N.h.N.h.N.h...k.C.h...m...h...l.m.h...k.[.h...m...h...l.V.h...n.O.h...i.[.h.N.i...h...a.H.h.....O.h.N...O.h...j.O.h.RichN.h

                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                      Icon Hash:072b2b2e45231706

                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Entrypoint:0x40e1af
                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                      Time Stamp:0x64F1A57C [Fri Sep 1 08:49:00 2023 UTC]
                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                      Import Hash:e05b008729b1f6ea10ac89acf5860e37

                                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                                      Signature Issuer:CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
                                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                                      • 19/01/2023 00:00:00 18/01/2026 23:59:59
                                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                                      • CN=Procore Technologies Inc, O=Procore Technologies Inc, L=Carpinteria, S=California, C=US
                                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                                      Thumbprint MD5:548C27AF58990DD5AD1593F78F4C1462
                                                                                                                                                                                                                      Thumbprint SHA-1:E67690ECE4D319A2E149F4EA8A6E540E57A58461
                                                                                                                                                                                                                      Thumbprint SHA-256:C781EC757760B02DA59369EEB2BB28FE8647D529218E764D572A5A2FFB4C02F5
                                                                                                                                                                                                                      Serial:032C9CA4BFB37EB0AEEE166604C31CD2

                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                      call 00007FA83C9F6E69h
                                                                                                                                                                                                                      jmp 00007FA83C9F67FFh
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                      push dword ptr [ebp+08h]
                                                                                                                                                                                                                      mov esi, ecx
                                                                                                                                                                                                                      call 00007FA83C9EE657h
                                                                                                                                                                                                                      mov dword ptr [esi], 00430398h
                                                                                                                                                                                                                      mov eax, esi
                                                                                                                                                                                                                      pop esi
                                                                                                                                                                                                                      pop ebp
                                                                                                                                                                                                                      retn 0004h
                                                                                                                                                                                                                      and dword ptr [ecx+04h], 00000000h
                                                                                                                                                                                                                      mov eax, ecx
                                                                                                                                                                                                                      and dword ptr [ecx+08h], 00000000h
                                                                                                                                                                                                                      mov dword ptr [ecx+04h], 004303A0h
                                                                                                                                                                                                                      mov dword ptr [ecx], 00430398h
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                      push dword ptr [ebp+08h]
                                                                                                                                                                                                                      mov esi, ecx
                                                                                                                                                                                                                      call 00007FA83C9EE624h
                                                                                                                                                                                                                      mov dword ptr [esi], 004303B4h
                                                                                                                                                                                                                      mov eax, esi
                                                                                                                                                                                                                      pop esi
                                                                                                                                                                                                                      pop ebp
                                                                                                                                                                                                                      retn 0004h
                                                                                                                                                                                                                      and dword ptr [ecx+04h], 00000000h
                                                                                                                                                                                                                      mov eax, ecx
                                                                                                                                                                                                                      and dword ptr [ecx+08h], 00000000h
                                                                                                                                                                                                                      mov dword ptr [ecx+04h], 004303BCh
                                                                                                                                                                                                                      mov dword ptr [ecx], 004303B4h
                                                                                                                                                                                                                      ret
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      sub esp, 0Ch
                                                                                                                                                                                                                      lea ecx, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                      call 00007FA83C9F692Ch
                                                                                                                                                                                                                      push 00441374h
                                                                                                                                                                                                                      lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                      push eax
                                                                                                                                                                                                                      call 00007FA83C9F9261h
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      sub esp, 0Ch
                                                                                                                                                                                                                      lea ecx, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                      call 00007FA83C9F6942h
                                                                                                                                                                                                                      push 004413ACh
                                                                                                                                                                                                                      lea eax, dword ptr [ebp-0Ch]
                                                                                                                                                                                                                      push eax
                                                                                                                                                                                                                      call 00007FA83C9F9244h
                                                                                                                                                                                                                      int3
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                      and dword ptr [004445B0h], 00000000h
                                                                                                                                                                                                                      sub esp, 24h
                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                      xor ebx, ebx
                                                                                                                                                                                                                      inc ebx
                                                                                                                                                                                                                      or dword ptr [0044300Ch], ebx
                                                                                                                                                                                                                      push 0000000Ah
                                                                                                                                                                                                                      call 00007FA83CA1644Ch

                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x41dc00xc8.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000xe7c7c4.rsrc
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0xec1a000x2038
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xec30000x28b8.reloc
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x3f3800x70.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3f3f00x40.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x300000x24c.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                      .text0x10000x2e24d0x2e400d4e005c5b3899c361821898c04c0b143False0.5769847972972973data6.649834850930477IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .rdata0x300000x12b1e0x12c00f6d9b7acdb0e6608483f0aaf6396af32False0.46529947916666664data5.298298848933733IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .data0x430000x21c00x1400a10a4e92775c1367275a6ccc3ac890c3False0.2076171875data3.350467928697211IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .rsrc0x460000xe7c7c40xe7c8006b1d5c7af460161c1f8b2919acdc8a37unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .reloc0xec30000x28b80x2a007cec886005b132770086e063f1235063False0.6874069940476191data6.508857573665581IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                      DATA0x4651c0xe55a44Zip archive data, at least v2.0 to extract, compression method=deflateEnglishUnited States0.995793342590332
                                                                                                                                                                                                                      FLAGS0xe9bf600xedataEnglishUnited States1.5714285714285714
                                                                                                                                                                                                                      RUNASADMIN0xe9bf700xadataEnglishUnited States1.8
                                                                                                                                                                                                                      RT_ICON0xe9bf7c0x41b3PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9847791188536774
                                                                                                                                                                                                                      RT_ICON0xea01300x10828Device independent bitmap graphic, 128 x 256 x 32, image size 131072EnglishUnited States0.08285519933751331
                                                                                                                                                                                                                      RT_ICON0xeb09580x4c28Device independent bitmap graphic, 128 x 256 x 8, image size 32768EnglishUnited States0.3061653672548215
                                                                                                                                                                                                                      RT_ICON0xeb55800x4228Device independent bitmap graphic, 64 x 128 x 32, image size 32768EnglishUnited States0.12942843646669816
                                                                                                                                                                                                                      RT_ICON0xeb97a80x1628Device independent bitmap graphic, 64 x 128 x 8, image size 8192EnglishUnited States0.49576868829337095
                                                                                                                                                                                                                      RT_ICON0xebadd00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 18432EnglishUnited States0.16068464730290458
                                                                                                                                                                                                                      RT_ICON0xebd3780xea8Device independent bitmap graphic, 48 x 96 x 8, image size 4608EnglishUnited States0.5818230277185501
                                                                                                                                                                                                                      RT_ICON0xebe2200x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 8192EnglishUnited States0.20942776735459662
                                                                                                                                                                                                                      RT_ICON0xebf2c80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 2048EnglishUnited States0.6814079422382672
                                                                                                                                                                                                                      RT_ICON0xebfb700x988Device independent bitmap graphic, 24 x 48 x 32, image size 4608EnglishUnited States0.24508196721311476
                                                                                                                                                                                                                      RT_ICON0xec04f80x6c8Device independent bitmap graphic, 24 x 48 x 8, image size 1152EnglishUnited States0.6273041474654378
                                                                                                                                                                                                                      RT_ICON0xec0bc00x468Device independent bitmap graphic, 16 x 32 x 32, image size 2048EnglishUnited States0.3466312056737589
                                                                                                                                                                                                                      RT_ICON0xec10280x568Device independent bitmap graphic, 16 x 32 x 8, image size 512EnglishUnited States0.49421965317919075
                                                                                                                                                                                                                      RT_STRING0xec15900x3c6dataEnglishUnited States0.3385093167701863
                                                                                                                                                                                                                      RT_STRING0xec19580x696dataEnglishUnited States0.25741399762752076
                                                                                                                                                                                                                      RT_GROUP_ICON0xec1ff00xbcdataEnglishUnited States0.6117021276595744
                                                                                                                                                                                                                      RT_GROUP_ICON0xec20ac0x22dataEnglishUnited States1.088235294117647
                                                                                                                                                                                                                      RT_VERSION0xec20d00x30cdataEnglishUnited States0.45
                                                                                                                                                                                                                      RT_MANIFEST0xec23dc0x3e7XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (939), with CRLF line terminatorsEnglishUnited States0.5145145145145145

                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                      KERNEL32.dllFreeLibrary, InitializeCriticalSectionEx, CreateFileW, SetFilePointer, ReadFile, SystemTimeToFileTime, GetCurrentDirectoryW, MultiByteToWideChar, LocalFileTimeToFileTime, WideCharToMultiByte, GetFileAttributesW, CreateDirectoryW, WriteFile, SetFileTime, FreeResource, SizeofResource, LockResource, CreateProcessW, RemoveDirectoryW, GetLocalTime, lstrcmpiW, LeaveCriticalSection, RaiseException, EnterCriticalSection, LoadLibraryExW, GetCurrentThreadId, DecodePointer, WriteConsoleW, LoadLibraryW, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCurrentProcess, GetModuleFileNameW, DeleteFileW, CloseHandle, GetExitCodeProcess, WaitForSingleObject, MoveFileW, GetTempFileNameW, GetLastError, GetTempPathW, DeleteCriticalSection, GetModuleHandleW, GetProcAddress, lstrlenW, FindResourceW, LoadResource, VerSetConditionMask, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, HeapReAlloc, HeapSize, ReadConsoleW, GetConsoleMode, GetConsoleOutputCP, SetEndOfFile, FlushFileBuffers, SetFilePointerEx, GetFileSizeEx, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetFileType, HeapAlloc, HeapFree, SetStdHandle, VerifyVersionInfoW, GetStdHandle, GetModuleHandleExW, ExitProcess, IsDebuggerPresent, OutputDebugStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, GetStringTypeW, EncodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LCMapStringW, GetLocaleInfoW, GetCPInfo, RtlUnwind
                                                                                                                                                                                                                      USER32.dllLoadStringW, GetActiveWindow, wsprintfW, CharNextW, MessageBoxW, DestroyWindow, ExitWindowsEx
                                                                                                                                                                                                                      ADVAPI32.dllRegOpenKeyExW, RegDeleteValueW, RegCreateKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, RegCloseKey, GetTokenInformation, AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValueW, RegSetValueExW, RegQueryValueExW
                                                                                                                                                                                                                      SHELL32.dllShellExecuteW, SHGetFolderPathW, ShellExecuteExW
                                                                                                                                                                                                                      ole32.dllCoCreateGuid, StringFromCLSID, CoTaskMemFree, CoTaskMemRealloc, CoInitialize, CoTaskMemAlloc, CoCreateInstance, CoUninitialize
                                                                                                                                                                                                                      OLEAUT32.dllVarUI4FromStr
                                                                                                                                                                                                                      urlmon.dllURLDownloadToFileW
                                                                                                                                                                                                                      COMCTL32.dllInitCommonControlsEx
                                                                                                                                                                                                                      VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW

                                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.923976898 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.924086094 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.924175024 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.958839893 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.958877087 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.432925940 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.433132887 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.438208103 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.438261986 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.438693047 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.489226103 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.507810116 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.555445910 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.871896982 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.883483887 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:33.883544922 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:34.038924932 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:34.039159060 CEST4434973435.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:34.039319992 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:34.146663904 CEST49734443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.324413061 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.324460983 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.324532986 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.339868069 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.339885950 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.837913990 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.837987900 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.840389967 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.840401888 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.840723991 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.881623030 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.897408009 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:38.939435005 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.058093071 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.058495998 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.058526039 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.223153114 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.223294973 CEST4434973835.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.223364115 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:01:39.225794077 CEST49738443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:38.881949902 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:38.882033110 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:38.882524967 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:38.889456987 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:38.889533043 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.207690001 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.207771063 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.207880974 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.223936081 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.223972082 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.353218079 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.353440046 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.367331028 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.367409945 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.368324041 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.407701015 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.451435089 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.565690041 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.577958107 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.578018904 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.885245085 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.885541916 CEST4434984135.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.886156082 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.887944937 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.888024092 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.899435043 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.899477005 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.899789095 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.934053898 CEST49841443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.944680929 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:39.977519035 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.019488096 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.136540890 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.151511908 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.151572943 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.305851936 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.306355000 CEST4434984335.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.306415081 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:02:40.308291912 CEST49843443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.034517050 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.034578085 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.034666061 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.057636976 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.057719946 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.551635981 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.551804066 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.555347919 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.555381060 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.555732012 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.601627111 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.617475033 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.659406900 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.777095079 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.780415058 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.780477047 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.939544916 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.939733028 CEST4435001635.190.88.7192.168.2.4
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.939790964 CEST50016443192.168.2.435.190.88.7
                                                                                                                                                                                                                      Oct 8, 2024 23:03:41.951466084 CEST50016443192.168.2.435.190.88.7

                                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.896732092 CEST5175753192.168.2.41.1.1.1
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.904632092 CEST53517571.1.1.1192.168.2.4

                                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.896732092 CEST192.168.2.41.1.1.10x74aeStandard query (0)sessions.bugsnag.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Oct 8, 2024 23:01:32.904632092 CEST1.1.1.1192.168.2.40x74aeNo error (0)sessions.bugsnag.com35.190.88.7A (IP address)IN (0x0001)false

                                                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                                                      • sessions.bugsnag.com

                                                                                                                                                                                                                      HTTPS Proxied Packets

                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      0192.168.2.44973435.190.88.74436532C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-08 21:01:33 UTC269OUTPOST / HTTP/1.1
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Bugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3e
                                                                                                                                                                                                                      Bugsnag-Payload-Version: 1.0
                                                                                                                                                                                                                      Bugsnag-Sent-At: 2024-10-08T21:01:31.6130775Z
                                                                                                                                                                                                                      Host: sessions.bugsnag.com
                                                                                                                                                                                                                      Content-Length: 423
                                                                                                                                                                                                                      Expect: 100-continue
                                                                                                                                                                                                                      Connection: Close
                                                                                                                                                                                                                      2024-10-08 21:01:33 UTC25INHTTP/1.1 100 Continue
                                                                                                                                                                                                                      2024-10-08 21:01:33 UTC423OUTData Raw: 7b 22 6e 6f 74 69 66 69 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 2e 4e 45 54 20 42 75 67 73 6e 61 67 20 4e 6f 74 69 66 69 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 32 2e 31 31 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 62 75 67 73 6e 61 67 2f 62 75 67 73 6e 61 67 2d 6e 65 74 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 43 48 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 28 55 54 43 2d 30 35 3a 30 30 29 20 45 61 73 74 65 72 6e 20 54 69 6d 65 20 28 55 53 20 26 20 43 61 6e 61 64 61 29 22 2c 22 6f 73 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 2e 39 32 30 30 2e 30 22 2c
                                                                                                                                                                                                                      Data Ascii: {"notifier":{"name":".NET Bugsnag Notifier","version":"2.2.11","url":"https://github.com/bugsnag/bugsnag-net"},"device":{"hostname":"user-PC","locale":"en-CH","timezone":"(UTC-05:00) Eastern Time (US & Canada)","osName":"Microsoft Windows NT 6.2.9200.0",
                                                                                                                                                                                                                      2024-10-08 21:01:34 UTC320INHTTP/1.1 202 Accepted
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Bugsnag-Session-Uuid: 1e826a90-ed92-4986-8b47-3728996a9a35
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Date: Tue, 08 Oct 2024 21:01:33 GMT
                                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                                      Via: 1.1 google
                                                                                                                                                                                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      {"status":"accepted"}


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      1192.168.2.44973835.190.88.74436048C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-08 21:01:38 UTC269OUTPOST / HTTP/1.1
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Bugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3e
                                                                                                                                                                                                                      Bugsnag-Payload-Version: 1.0
                                                                                                                                                                                                                      Bugsnag-Sent-At: 2024-10-08T21:01:37.0536863Z
                                                                                                                                                                                                                      Host: sessions.bugsnag.com
                                                                                                                                                                                                                      Content-Length: 423
                                                                                                                                                                                                                      Expect: 100-continue
                                                                                                                                                                                                                      Connection: Close
                                                                                                                                                                                                                      2024-10-08 21:01:39 UTC25INHTTP/1.1 100 Continue
                                                                                                                                                                                                                      2024-10-08 21:01:39 UTC423OUTData Raw: 7b 22 6e 6f 74 69 66 69 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 2e 4e 45 54 20 42 75 67 73 6e 61 67 20 4e 6f 74 69 66 69 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 32 2e 31 31 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 62 75 67 73 6e 61 67 2f 62 75 67 73 6e 61 67 2d 6e 65 74 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 43 48 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 28 55 54 43 2d 30 35 3a 30 30 29 20 45 61 73 74 65 72 6e 20 54 69 6d 65 20 28 55 53 20 26 20 43 61 6e 61 64 61 29 22 2c 22 6f 73 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 2e 39 32 30 30 2e 30 22 2c
                                                                                                                                                                                                                      Data Ascii: {"notifier":{"name":".NET Bugsnag Notifier","version":"2.2.11","url":"https://github.com/bugsnag/bugsnag-net"},"device":{"hostname":"user-PC","locale":"en-CH","timezone":"(UTC-05:00) Eastern Time (US & Canada)","osName":"Microsoft Windows NT 6.2.9200.0",
                                                                                                                                                                                                                      2024-10-08 21:01:39 UTC320INHTTP/1.1 202 Accepted
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Bugsnag-Session-Uuid: 15a7034e-fd84-4ebd-bc9e-f7daaa9b71f3
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Date: Tue, 08 Oct 2024 21:01:39 GMT
                                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                                      Via: 1.1 google
                                                                                                                                                                                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      {"status":"accepted"}


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      2192.168.2.44984135.190.88.74431748C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC269OUTPOST / HTTP/1.1
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Bugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3e
                                                                                                                                                                                                                      Bugsnag-Payload-Version: 1.0
                                                                                                                                                                                                                      Bugsnag-Sent-At: 2024-10-08T21:02:37.6169102Z
                                                                                                                                                                                                                      Host: sessions.bugsnag.com
                                                                                                                                                                                                                      Content-Length: 423
                                                                                                                                                                                                                      Expect: 100-continue
                                                                                                                                                                                                                      Connection: Close
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC25INHTTP/1.1 100 Continue
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC423OUTData Raw: 7b 22 6e 6f 74 69 66 69 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 2e 4e 45 54 20 42 75 67 73 6e 61 67 20 4e 6f 74 69 66 69 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 32 2e 31 31 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 62 75 67 73 6e 61 67 2f 62 75 67 73 6e 61 67 2d 6e 65 74 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 43 48 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 28 55 54 43 2d 30 35 3a 30 30 29 20 45 61 73 74 65 72 6e 20 54 69 6d 65 20 28 55 53 20 26 20 43 61 6e 61 64 61 29 22 2c 22 6f 73 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 2e 39 32 30 30 2e 30 22 2c
                                                                                                                                                                                                                      Data Ascii: {"notifier":{"name":".NET Bugsnag Notifier","version":"2.2.11","url":"https://github.com/bugsnag/bugsnag-net"},"device":{"hostname":"user-PC","locale":"en-CH","timezone":"(UTC-05:00) Eastern Time (US & Canada)","osName":"Microsoft Windows NT 6.2.9200.0",
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC299INHTTP/1.1 202 Accepted
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Bugsnag-Session-Uuid: 4a748371-faf4-43f1-be26-e288fd31466d
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Date: Tue, 08 Oct 2024 21:02:39 GMT
                                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                                      Via: 1.1 google
                                                                                                                                                                                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC21INData Raw: 7b 22 73 74 61 74 75 73 22 3a 22 61 63 63 65 70 74 65 64 22 7d
                                                                                                                                                                                                                      Data Ascii: {"status":"accepted"}


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      3192.168.2.44984335.190.88.74434324C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-08 21:02:39 UTC269OUTPOST / HTTP/1.1
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Bugsnag-Api-Key: e8b374197eb864f506acc5bbd2dcbc3e
                                                                                                                                                                                                                      Bugsnag-Payload-Version: 1.0
                                                                                                                                                                                                                      Bugsnag-Sent-At: 2024-10-08T21:02:37.9298881Z
                                                                                                                                                                                                                      Host: sessions.bugsnag.com
                                                                                                                                                                                                                      Content-Length: 423
                                                                                                                                                                                                                      Expect: 100-continue
                                                                                                                                                                                                                      Connection: Close
                                                                                                                                                                                                                      2024-10-08 21:02:40 UTC25INHTTP/1.1 100 Continue
                                                                                                                                                                                                                      2024-10-08 21:02:40 UTC423OUTData Raw: 7b 22 6e 6f 74 69 66 69 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 2e 4e 45 54 20 42 75 67 73 6e 61 67 20 4e 6f 74 69 66 69 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 32 2e 32 2e 31 31 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 62 75 67 73 6e 61 67 2f 62 75 67 73 6e 61 67 2d 6e 65 74 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 43 48 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 28 55 54 43 2d 30 35 3a 30 30 29 20 45 61 73 74 65 72 6e 20 54 69 6d 65 20 28 55 53 20 26 20 43 61 6e 61 64 61 29 22 2c 22 6f 73 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 2e 39 32 30 30 2e 30 22 2c
                                                                                                                                                                                                                      Data Ascii: {"notifier":{"name":".NET Bugsnag Notifier","version":"2.2.11","url":"https://github.com/bugsnag/bugsnag-net"},"device":{"hostname":"user-PC","locale":"en-CH","timezone":"(UTC-05:00) Eastern Time (US & Canada)","osName":"Microsoft Windows NT 6.2.9200.0",
                                                                                                                                                                                                                      2024-10-08 21:02:40 UTC320INHTTP/1.1 202 Accepted
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Bugsnag-Session-Uuid: 235302ed-f0e9-46d1-a47f-7b0787468d61
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Date: Tue, 08 Oct 2024 21:02:40 GMT
                                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                                      Via: 1.1 google
                                                                                                                                                                                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      {"status":"accepted"}


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      4192.168.2.45001635.190.88.74433716C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-08 21:03:41 UTC269OUTPOST / HTTP/1.1
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Bugsnag-Api-Key: a7aa9e13b7225d9c99432a4d24614565
                                                                                                                                                                                                                      Bugsnag-Payload-Version: 1.0
                                                                                                                                                                                                                      Bugsnag-Sent-At: 2024-10-08T21:03:39.5921676Z
                                                                                                                                                                                                                      Host: sessions.bugsnag.com
                                                                                                                                                                                                                      Content-Length: 421
                                                                                                                                                                                                                      Expect: 100-continue
                                                                                                                                                                                                                      Connection: Close
                                                                                                                                                                                                                      2024-10-08 21:03:41 UTC25INHTTP/1.1 100 Continue
                                                                                                                                                                                                                      2024-10-08 21:03:41 UTC421OUTData Raw: 7b 22 6e 6f 74 69 66 69 65 72 22 3a 7b 22 6e 61 6d 65 22 3a 22 2e 4e 45 54 20 42 75 67 73 6e 61 67 20 4e 6f 74 69 66 69 65 72 22 2c 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 31 2e 30 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 62 75 67 73 6e 61 67 2f 62 75 67 73 6e 61 67 2d 6e 65 74 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 68 6f 73 74 6e 61 6d 65 22 3a 22 4a 4f 4e 45 53 2d 50 43 22 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 43 48 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 28 55 54 43 2d 30 35 3a 30 30 29 20 45 61 73 74 65 72 6e 20 54 69 6d 65 20 28 55 53 20 26 20 43 61 6e 61 64 61 29 22 2c 22 6f 73 4e 61 6d 65 22 3a 22 4d 69 63 72 6f 73 6f 66 74 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 32 2e 39 32 30 30 2e 30 22 2c 22
                                                                                                                                                                                                                      Data Ascii: {"notifier":{"name":".NET Bugsnag Notifier","version":"3.1.0","url":"https://github.com/bugsnag/bugsnag-net"},"device":{"hostname":"user-PC","locale":"en-CH","timezone":"(UTC-05:00) Eastern Time (US & Canada)","osName":"Microsoft Windows NT 6.2.9200.0","
                                                                                                                                                                                                                      2024-10-08 21:03:41 UTC299INHTTP/1.1 202 Accepted
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Bugsnag-Session-Uuid: c7218cac-8d4e-44ff-9c66-f9447a2e162c
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Date: Tue, 08 Oct 2024 21:03:41 GMT
                                                                                                                                                                                                                      Content-Length: 21
                                                                                                                                                                                                                      Via: 1.1 google
                                                                                                                                                                                                                      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      2024-10-08 21:03:41 UTC21INData Raw: 7b 22 73 74 61 74 75 73 22 3a 22 61 63 63 65 70 74 65 64 22 7d
                                                                                                                                                                                                                      Data Ascii: {"status":"accepted"}


                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                      Start time:17:01:29
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\ProcoreExtractsSetup.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\ProcoreExtractsSetup.exe"
                                                                                                                                                                                                                      Imagebase:0x510000
                                                                                                                                                                                                                      File size:15'481'400 bytes
                                                                                                                                                                                                                      MD5 hash:01168C885557C38B6C067614371BB5BF
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                                      Start time:17:01:30
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe"
                                                                                                                                                                                                                      Imagebase:0x2a0000
                                                                                                                                                                                                                      File size:2'201'656 bytes
                                                                                                                                                                                                                      MD5 hash:E73E328086CD27F5DABE17802ACF2AF8
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Bobcat\Procore Technologies\Procore Extracts\{358817B7-2092-449A-B283-F61AA1499B65}\Installer.exe, Author: Joe Security
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                      Start time:17:01:32
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                      Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                      Start time:17:01:36
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" install
                                                                                                                                                                                                                      Imagebase:0x610000
                                                                                                                                                                                                                      File size:2'441'264 bytes
                                                                                                                                                                                                                      MD5 hash:0DDB141358F21523C480BE734334B61B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Yara matches:
                                                                                                                                                                                                                      • Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe, Author: Joe Security
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:4
                                                                                                                                                                                                                      Start time:17:01:36
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                                      Start time:17:02:37
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" start
                                                                                                                                                                                                                      Imagebase:0x9b0000
                                                                                                                                                                                                                      File size:2'441'264 bytes
                                                                                                                                                                                                                      MD5 hash:0DDB141358F21523C480BE734334B61B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                                      Start time:17:02:37
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                      Start time:17:02:37
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\Procore Technologies\Procore Extracts\Procore ExtractsService.exe" -displayname "Procore Extracts Updater Service" -servicename "ProcoreExtractsUpdaterSvc"
                                                                                                                                                                                                                      Imagebase:0xe20000
                                                                                                                                                                                                                      File size:2'441'264 bytes
                                                                                                                                                                                                                      MD5 hash:0DDB141358F21523C480BE734334B61B
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                                      Start time:17:03:38
                                                                                                                                                                                                                      Start date:08/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\Procore Technologies\Procore Extracts\app-1.3.1\Procore.Ditto.exe" install
                                                                                                                                                                                                                      Imagebase:0x1d05c040000
                                                                                                                                                                                                                      File size:655'928 bytes
                                                                                                                                                                                                                      MD5 hash:CF0914DE88C49370CF951FFEEA446102
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                      ⊘No disassembly