Analysis
-
max time kernel
301s -
max time network
312s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-02-2024 04:54
Static task
static1
Behavioral task
behavioral1
Sample
VSCodeUserSetup-x64-1.86.1.exe
Resource
win11-20240214-en
General
-
Target
VSCodeUserSetup-x64-1.86.1.exe
-
Size
94.4MB
-
MD5
b7769f93443d5f37584e53d144b6695a
-
SHA1
835255454aabbe85779a867aceeda4ea94b2a5ad
-
SHA256
c9ae013071ad44f1881c0702bb536f34e676c997b62a6573856a5bd22bae0b79
-
SHA512
96041312c17c99b70dadcc109f6964f46ae3c1e4be536191810ac7181ba07ea90d10d57c80c6e57d160927b2e2e780d91dc653da8e856684dedcc30f177ead57
-
SSDEEP
1572864:OBr+bZ0LCXIExG47WEd16QCzVYAumXiEblQNZNx9Yu/N8TKW7mLfO/L9FFZGZkB:2CGLCDGHw1j0YpFE5QNZJr/N8TKW7gf8
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1440 icacls.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_01cf530faf2f1752\display.PNF Code.exe File created \??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_01cf530faf2f1752\display.PNF Code.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp Code.exe -
Executes dropped EXE 11 IoCs
pid Process 3128 VSCodeUserSetup-x64-1.86.1.tmp 292 Code.exe 3988 Code.exe 3888 Code.exe 3424 Code.exe 4372 Code.exe 3496 Code.exe 2420 Code.exe 2856 Code.exe 5092 code-tunnel.exe 3380 Code.exe -
Loads dropped DLL 24 IoCs
pid Process 292 Code.exe 3988 Code.exe 3888 Code.exe 3988 Code.exe 3988 Code.exe 3988 Code.exe 3988 Code.exe 292 Code.exe 292 Code.exe 292 Code.exe 292 Code.exe 292 Code.exe 292 Code.exe 292 Code.exe 3424 Code.exe 4372 Code.exe 3496 Code.exe 2420 Code.exe 2856 Code.exe 3496 Code.exe 2420 Code.exe 292 Code.exe 3380 Code.exe 3380 Code.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Code.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Code.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Code.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Code.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Code.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Code.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Code.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.gitignore\shell\open VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCodeSourceFile\ = "Visual Studio Code Source File" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.cpp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\resources\\win32\\cpp.ico" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.js\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.r\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\"" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.rb\ = "Ruby Source File" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.cljx\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.fs VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.plist\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\"" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.c++\shell\open VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.hh\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.jscsrc\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.mdwn\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.clojure VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.log\shell VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.r\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.jade\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.cpp VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.cpp\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\"" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.eyml\shell\open VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.gitconfig\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.phtml\ = "PHP HTML Source File" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.pl\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.cmake\OpenWithProgids\VSCode.cmake VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.gitconfig\OpenWithProgids\VSCode.gitconfig VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.jade VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.plist\OpenWithProgids\VSCode.plist VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.fsx\shell\open VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.c\OpenWithProgids\VSCode.c VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.editorconfig\shell VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.edn\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.jsp VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.npmignore\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.psd1\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.tex\shell\open VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.bash\shell VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\Applications\Code.exe\DefaultIcon VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.vb\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.gradle VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.js\shell VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.pod\ = "Perl POD Source File" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.xaml\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\"" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.fsi VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\Applications\Code.exe\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\resources\\win32\\default.ico" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.wxi\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.ml\ = "OCaml Source File" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.h\OpenWithProgids\VSCode.h VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.php\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\"" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.pm6\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\"" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.cshtml\OpenWithProgids\VSCode.cshtml VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.containerfile\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.erb\shell\open VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.eyaml VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.gitconfig\shell VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.jshtm\AppUserModelID = "Microsoft.VisualStudioCode" VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.mdoc VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.mdwn VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.c++\shell\open\command VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\vscode Code.exe Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.plist\DefaultIcon VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\.csproj\OpenWithProgids VSCodeUserSetup-x64-1.86.1.tmp Key created \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.jsx\DefaultIcon VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.h++\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\"" VSCodeUserSetup-x64-1.86.1.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1118208250-2584473247-1767544961-1000_Classes\VSCode.ps1\ = "PowerShell Source File" VSCodeUserSetup-x64-1.86.1.tmp -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4812 powershell.exe 4812 powershell.exe 3128 VSCodeUserSetup-x64-1.86.1.tmp 3128 VSCodeUserSetup-x64-1.86.1.tmp 3380 Code.exe 3380 Code.exe 3380 Code.exe 3380 Code.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4812 powershell.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe Token: SeCreatePagefilePrivilege 292 Code.exe Token: SeShutdownPrivilege 292 Code.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3128 VSCodeUserSetup-x64-1.86.1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3128 3420 VSCodeUserSetup-x64-1.86.1.exe 78 PID 3420 wrote to memory of 3128 3420 VSCodeUserSetup-x64-1.86.1.exe 78 PID 3420 wrote to memory of 3128 3420 VSCodeUserSetup-x64-1.86.1.exe 78 PID 3128 wrote to memory of 4812 3128 VSCodeUserSetup-x64-1.86.1.tmp 79 PID 3128 wrote to memory of 4812 3128 VSCodeUserSetup-x64-1.86.1.tmp 79 PID 3128 wrote to memory of 4812 3128 VSCodeUserSetup-x64-1.86.1.tmp 79 PID 3128 wrote to memory of 1440 3128 VSCodeUserSetup-x64-1.86.1.tmp 82 PID 3128 wrote to memory of 1440 3128 VSCodeUserSetup-x64-1.86.1.tmp 82 PID 3128 wrote to memory of 292 3128 VSCodeUserSetup-x64-1.86.1.tmp 85 PID 3128 wrote to memory of 292 3128 VSCodeUserSetup-x64-1.86.1.tmp 85 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3988 292 Code.exe 86 PID 292 wrote to memory of 3888 292 Code.exe 87 PID 292 wrote to memory of 3888 292 Code.exe 87 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88 PID 292 wrote to memory of 3424 292 Code.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.86.1.exe"C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.86.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\is-AG5DI.tmp\VSCodeUserSetup-x64-1.86.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-AG5DI.tmp\VSCodeUserSetup-x64-1.86.1.tmp" /SL5="$A0072,97919822,828416,C:\Users\Admin\AppData\Local\Temp\VSCodeUserSetup-x64-1.86.1.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"3⤵
- Modifies file permissions
PID:1440
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"3⤵
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1624 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3988
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --mojo-platform-channel-handle=1660 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3888
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2864 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:7a3e8b77-640d-488e-a5d3-6476d7834480 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3424
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --mojo-platform-channel-handle=3508 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3496
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --mojo-platform-channel-handle=3528 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4372 -
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status5⤵
- Executes dropped EXE
PID:5092
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --mojo-platform-channel-handle=3668 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵PID:4012
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3884 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --vscode-window-config=vscode:7a3e8b77-640d-488e-a5d3-6476d7834480 /prefetch:14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856
-
-
C:\Windows\System32\wsl.exeC:\Windows\System32\wsl.exe --status4⤵PID:4456
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2488 --field-trial-handle=1628,i,2031634246428899547,15439270226763816559,262144 --disable-features=CalculateNativeWinOcclusion,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
798B
MD5428cbead5ec5e4c283ee842da2da8300
SHA14d5ba903abea8a51371a365f62f0e6ef9933fae4
SHA2562c78ce0aee720711e9862e69f92c7938c107314ec4131cc20f21337592e8bc67
SHA512cefa078b48ca5fb94af604cf1e743c6e9ef1f94b149c9cf292c6b6e0f8522f6a78824cad2856673b2a4a25754d0b3bccbd669aa5faed2656d732151449d8d809
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
64KB
MD52289a379848a217df07c9f25a3dcdd8c
SHA19239804a5563664cd1d84d0e46175fd604cde53c
SHA2566f405385c5584477790ba35a73a011c5e33c4bcf3dd0333a3ae81c1465bdece0
SHA512665c1d7c7b164a43158f09c4506b454f4faf2c2c770bc88275e80b8bede0e874b51999c9be9d3f13a929387fc317c11674bf342dd072748937aaa9299ecc827e
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
1024B
MD5ea5c6d80a22408ab2596fcd5cbd12d50
SHA1e9578c50b92b481da509fc6b203691bd2ed8b1b2
SHA25633ee617cf3ffe65c788b710fb5bb30ab6a221994a47cbd085311458e7e2447f3
SHA51277a55b93ef305d620f8cf20af5256ae62b86d27d9ae486202ba8c644c8062889956430b7a21df15acfe4725507afe37f146e572e517c1ca7169a2c540448d283
-
Filesize
9.9MB
MD56c700493b4bd2526267f1f04da502467
SHA1682d1ba9db4b9bc42ae3b6ecfb91fdd7c39db018
SHA256647bbf1c87658f3056fb71cd0c334f896264b2602f4d58dba2f518de876bab54
SHA512f4882ff978b2816e388c0580e0ab31fc8a4d161640644d9f0991246c30bbdcb8fdb454121499b7fe9ee0e2febafec49e8491ff0306f8d24219d633eb5d47211d
-
Filesize
10.3MB
MD55963e6cf0bac3ea5bbb4187967fc4b37
SHA1d8cdc287a6e39c90dc9091f53675ce58f6630403
SHA256c49764b6b6d208943d0b59b145a866ab66a461b003bdbf2886482772362ea3ea
SHA512c160c2979302121e8523cc85bff88ca9297d7e854f50a95213adcd835bfd1ad7758c8c21a6d75e73860e1c727d6de3f9472bdf2b09dd1f513ec3772b8aa83ec0
-
Filesize
2.8MB
MD59cbe281399c4063acbe40068a7ac5cca
SHA1482b0e63d4fd7ead2cf4806f9d0991ce59381010
SHA256c58fcadd977aa560c6d900074d6fffd6dae7ee4343b1989cc9ca550841373ea5
SHA5128224a19abeeb289c746a78a9714ede8867eaeef0d0bf637b53d8956fe39a34d4c34061e87e8bff7bd9136eb8f5c5155058f0a9169a1991bf4e4bb40e5b7af1e3
-
Filesize
384KB
MD534d8b4eb3e7f6051cf970b275c3878da
SHA19f9419bc75f86bb5da52fe20d055a00d1f0744af
SHA25672bad7fc3f2210670d5de8bd3dce97d9c31db8433a8e97bcc350816146ce80ab
SHA512925b6de811759fc7fddc60178be35ab7c2ec3ba70f411f1d4f5618654c74a1af4b6297167b18eb3849c63dd6bc8cfca5d5cfcda486921acd795679cd9c633c75
-
Filesize
2.4MB
MD535e990528a2c0e5cfcff9c75c4fb23cf
SHA19ddbaf6f598ac2433c01f42ab10540412bdcea4b
SHA2566d1760ae1eb359e026ab46fb3ef94a35414d48b001335bb2500ad13411c3f21b
SHA5128151b2b9c849271dc717ca49b197b2808131a5f541c24a31d8e0130e700561351bd06b55b740e4002cab2e997419ca6e4ffe01b9a6a4fe98aa577d28e61f52bc
-
Filesize
3.8MB
MD5b4ea5ce158addaa7cec147b53694bce1
SHA180d606c924ec7d3b196563333c532353fe9190ca
SHA256e5c1b1fa93a6006c3da8bcbc54ddf7addddd98203b3cccc2acd45a5b584076af
SHA51228ce7ba062525961725ead69e8c29aadc41f7623477ed917121e461fcd918baa148a9318372680619f949516c7d027cdb8b250761bd2d6db64cfd5982a080eff
-
Filesize
4.5MB
MD530bdd999e144e02fbd478faa082c1361
SHA18c3eb1c0954c36ab7bebe47f3a8d27ff78eb3f9c
SHA256742f48d0d1d15557d1fdf4e57035dab13f4bcabd5fa2ebbe51d38ce66e750e9d
SHA512f680909076c9352b0a3e34bd7cba0b5c9d2a1bd9a279827a67273606d56dbd1cfbee75a1eb200774aa4a5b552eb0c2a10485e5cccac15f6341d449f78ef156e1
-
Filesize
132KB
MD5a0e681fdd4613e0fff6fb8bf33a00ef1
SHA16789bacfe0b244ab6872bd3acc1e92030276011e
SHA25686f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
SHA5126f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
-
Filesize
190KB
MD5c37bd7a6b677a37313b7ecc4ff01b6f5
SHA179db970c44347bd3566cefb6cabd1995e8e173df
SHA2568c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
SHA512a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
-
Filesize
2.2MB
MD5c3022327f60befe669ac335192b90baa
SHA19945eede4653dff9de8f0f5125776ec19adb00a0
SHA256745ec0c0af1fba3cf229ce673bcfe789e42a55bae025282235e5fc712b43d683
SHA512418fc982248d8dd1d2f44153faffa41fdd15ba17642fa957fa73c99130f05b2be2ed5d41050adf84a856a162c749d2c98797797b90af9137fef87d6795e9da13
-
Filesize
2.4MB
MD5b9bdec38e3dd43910e2ffce22c79ab03
SHA1702c7a99ad9da676e746cf9854c6c8909a8a091a
SHA2568e41af5022df86cf708f926abac56707c33129ce3b7e1c4469da80a6271cb571
SHA512e63cd93b5aad52a51f90604795c0e1d54f8f8a2e25dcc1c85d2149204ddada2171c873501e3f9d4a919ea2188194d0ee6133e0d36bd5cd7e54811f02171c4c2a
-
Filesize
320KB
MD5db8225716cc2b6c4abec1bc7a2902896
SHA191042b984463ea61fb088e87c37bc5affa0fa740
SHA256140e8a5de81d86463147411b76e21a605a7c2707ede1bb30bee905393e8f3bdb
SHA5127b442a4f2528e91368dc25ae018a13103f6f7782f241cec459141035f8c9b6a2460ef32e3e76e62c26a8ba98f22eda966cc4e3df97f404885d88a7a44f764304
-
Filesize
3.9MB
MD54b83ed583c5b146c32fe1edb62eb905a
SHA11748a88d9a4563ca6d62566936b3e92e244e6ed6
SHA256fcd31d2efaa080921e2ecf10b2f238bfc8fccfd28b03eb5c5102a36783d71ff5
SHA512c91cc4231955e9a5d88d383607a8ee0e9015507faf4b1999f8bb32c76ba3b0c2229c3eb3c0cb8d02eb4c17d6a0114a6236430dbe0f99047c52059b19153b0bfb
-
Filesize
115KB
MD541b7e9d2801440166cb8ddf8139ae9e0
SHA19f128da378671ea2c77a39b98bf77029c2848c0e
SHA2560f68b003d37397356e0dbde376b090d6c974c74134a3476085a1508b91ba871e
SHA512d84ddd7f5f76489772a014997c4cd28dbc0531e34566c4e5912cee766b76a65b1fb5b196271317396fab41c7f7f9a7d125aa1b7a9c2d81ce5d5aeb2c64f261b9
-
Filesize
2.1MB
MD589ef9a739b772663773142d7e25bc4c9
SHA184bd2a3c9894eb6b741710ecf0b61d5152c9d6ea
SHA256921538d30aea255c3751000766863b76a61d260ad2c141c092a1d0bb0e719ea1
SHA51279e469914116090124bb0b8aa0f6d5ea100ed1cd81f19bba172701435d9d5c7157f95e1687633151631fcdee6eba80344f8417fec310a247ade9b11fe3b9658a
-
Filesize
2.2MB
MD59471fb9a33059c78ebaffd84b266c908
SHA17d7494364a434b0dcd1a33d3f7e6ff558e27a137
SHA256a8087914d45eb6c5d766a29cbdd339be24901f4494a2d0fff1448ef98a484379
SHA5122dfa13ec931e1fa8d24963416991cd5d980b8d35458825079b97bc281521d2970757405b5be8ee130cd6df23819a85d96918ef5a28ec7877524e91b6d0305001
-
Filesize
405KB
MD5807e696d8e9c2f2b9c496d2ee8597765
SHA1b3dfc5c31d31eba4027c22b46b1c16620cb1db47
SHA25651c83234f1092346c044d2414c3f66f7b907ac5a0043ac6e0553d1e952e8b887
SHA512ce1b18093eafa36ee87c7eaf12e6fed6eccb1b604df77ff027fcaf85013d21a481b33f971a16f2a17d8012cbd20b31b25c3a608be2765b7272c9aceb480db373
-
Filesize
704KB
MD5879736b41262af04d799c2e1e060e260
SHA1b0e12a11c8578fd1fcacbd28d81632455f2357aa
SHA256aeac4f877dd9a8e3f87108e99f96255a2e611cd43f00ade992559d29008b7df0
SHA512287b3c6ff51bffa0f24fd82ff755f7035d2cb23b9caabb1cb7478c49613fa96d9bc8792a48c17164491d8d055f14df30fb50599b67f7731d98abc20b4565f2a2
-
Filesize
179KB
MD5575506a8774d119bc036fc34a0a3b08a
SHA187864ccab15ab97a8698c1bdaa7db88d7a8dbcdf
SHA256a8e9fd8d817925e0457587f9252dfd977bf17a4155a7ea67bf230d3283036a79
SHA51239f515f5f7da39fd6e026cc3f7bbb269a60c635a51338073cf752352635936834280a68c1deb46fdfb263293716bafdc31ef569663175b0bea6385acbc36e24c
-
Filesize
6.8MB
MD5837d8cbabf80ff5987e273a41da8cedb
SHA1c4b2ec517b670c992d6e8b71cfbec7ae4a02570c
SHA25673e774bd16ec83c5e62de64e61e18ef3f6da9fb81886e623813e143d391e385a
SHA512a95a3da3152715435db683164cdc2035da27be6c5068b5c3068ab40229e6a6a27096bffc7348961a17e62857104518d9121c57929b3de180af15cc680b2a8985
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\@vscode\policy-watcher\build\Release\vscode-policy-watcher.node
Filesize164KB
MD5cb7a2e98a4e6cc10e2d8d0b134f19c0b
SHA1940a0553adb26cbb398fae49a0fa789105365bd0
SHA2567b992e5dfdb07c38ae4b048f699b501216eda28ca83c41076a4e0bf714103213
SHA5120bd557cb109553b5576a57f0aa579933173b9b05f693e20cdd695e2f0eed05adc8db9aab019a44b0dee3065748b27328e29b125b38acb65d6171e46f7674c9a8
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\@vscode\spdlog\build\Release\spdlog.node
Filesize557KB
MD59ba08e17744496bf0f1432da1f48b6e4
SHA1501962fbfc07513252de0b7fd1e1b358d3c908e4
SHA25674f3c36800ee6d00f13b5ea0c7106eb9417d784e8e76e52c82058fdf50a4ca72
SHA5127ed1a5b260203f55cdb5eecb29ce039d8a04db316840f4c7f8b7bf369aa4840abdd499075885a8dc26968f3d49f25893b5b311764b33f4cba12d2fbf9e275cb0
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\@vscode\sqlite3\build\Release\vscode-sqlite3.node
Filesize1.6MB
MD5ba0aa66c9ac4e42bf0582d2ec8fac76b
SHA1dc0459b8838fb1d2015d9aab8c7a826a6a6ffaef
SHA256bfcc5cf6de9831bd89d5d78b8bcc3b6e070ab07f39b5a724fcdff7489bf04a00
SHA512df26e909af7845f90ab4a39e41f46647e477334cd78aa10ea28fa25b1cee82d520054213101d9d69a63eebae05e04badf3beb4bcdd83275d53d2b864d76364a0
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\@vscode\windows-mutex\build\Release\CreateMutex.node
Filesize167KB
MD5391fde92c1da2928e955e79d825b2048
SHA1b1d68be4db35006742d8ce9c1f782ac93ec262ad
SHA2561f2751302f19473c51e41c8c6585eb3e800c6ba261bfbeb0080540dca7cac885
SHA51200fa39dfb2847f5e93989969f8f92b41ad41ebfd2bc0d4c37891d2d1bc890079eba372a1c919d92b0b762823829a0fe5345282d7cd8d2498fe129261682c6b0a
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\@vscode\windows-registry\build\Release\winregistry.node
Filesize124KB
MD5e45922765869db5c286bda7aef59228f
SHA19e20711484adca1b2a1e60ff8fabced049bb9f97
SHA256b03e4acedcc3a55b7019e45b49ee42556dde7138e07c72f9ba80317e69b759e4
SHA512f60060bf09f6ba7d8053c38ea7f51bb6ed70b7a8f822b99e1f1b8b1205c56bfe52936dac09462e1ab0af509c4482a99254ffd8dc4735bb3b99d1e341ea95d6fe
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\native-is-elevated\build\Release\iselevated.node
Filesize118KB
MD58435feadb09783a6ed36ab2797a2440a
SHA1a3ab4434f728681f2772f04943329ce134595b4a
SHA2568ec9e0d85c24598e33a3993535353148405e4119088da02fe2d708c69546aae9
SHA512b0ed50de75335ce0daf203b388b5046b80b91a0e6b65d29b34a598279f612f22b1223adcf56e38a0a03f15092ee92df8df6d8907de265e4974138ccc0f98c413
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules.asar.unpacked\native-keymap\build\Release\keymapping.node
Filesize169KB
MD533e72ad5051b3538cb9695c69868faa0
SHA14d8b06bdabcc01e775e56d540778e0145c8c28f1
SHA256c4a727551b1f93926b363a8f5e217121b1246fe21b2fb47668ce3ad0dba4961c
SHA5129e26e08775ed1d8aaa3a263731595c2c71dd0e34ac99d21c2c87c5bc682cb40b2e7b137499d2ba2296f6a8923eb78098371094b4c2f54b922544451f3cf52dad
-
Filesize
54KB
MD55d7f3a5d51c4d27299c76f65392439a6
SHA10c33d1c69e6c91053757a4f494012718ce9a4585
SHA2565f4099cc46acbea7ddde6193b7d6e1cb8eb1e485b84baa5e4edd61cf95a6ba42
SHA512173922466c03beac761f4bd2022602a9ba941cbbfa96bf7dcd738b2d73bcf81f07e133fa7180069f9d5e62fc54eb8421e18b60a0879c3cbb3cbcfc1ea84c6cb8
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\base\browser\ui\codicons\codicon\codicon.ttf
Filesize77KB
MD58129e5752396eec0a208afb9808b69cb
SHA11841988bc7e5445294734a1f727f6fd06c79a62b
SHA2566008eb49dd68b294e4e14b6b292dab9180dc063cd7934fe696921a0958e2957b
SHA512308f7f312e66b25d92f97181e1891bc95550676faa2307e953d2cb216b6bc5b6f52a2a7b76c865d08be8fb11756ce493d49f9921117e15cef1f419e17bc7eb86
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\code\electron-main\main.js
Filesize115KB
MD5c303e846125fd4003748ab490258ec95
SHA1a08302332d52deaa7c0f4ce5d82e8c0f3b98a7b4
SHA2568c6521a629d32151cdbefd99b6c100506c5bd6eda20e1bc9cc810772d6dfe151
SHA512f9de0bcefb141644e45e507c3e0a041fb292d2f2506fadcda3f3aa590dc5fac0b64a06129027f393d3f8f5d9bc94e19d73f02b4f432403288bc75dfb839cb45d
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\code\electron-main\main.nls.js
Filesize22KB
MD5606b67ff3bb6a7f54f9b75d941bf39d3
SHA13d5f276514006a04adcdd86b39655bb2740302ab
SHA25682a5d1226d0e9a1e2bdb359d1a2b932851330de8bdc55be9eaeb0cafd9d7a688
SHA512d022222ba90a5bcd8224cd6648e0dc380eb0b78ece77dbcb24f30e3faf8b6ad53ba593cabd1063823a1ba69796a07c3c8a181ca11b580e8ba826c58810cdc57a
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\code\electron-sandbox\workbench\workbench.html
Filesize1KB
MD5758fc1e6066d814b937747d70fadd2d0
SHA1bf94b3bbe56c113236a0bd4f5214e5f4e63a95e7
SHA25630e1df1ecb88f822f89cfc320108ee14202316898d7a9faf72f8cbd2c2c395bc
SHA51206a91dce84c3125fd47e88d119cd4249de1d3ff9557a246a4748629f00986d6f13ab22a6a2c9f2aa0529ba07b4379af03e171c26c5d681a773fc13b5e90e127e
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\code\electron-sandbox\workbench\workbench.js
Filesize42KB
MD500259f0beb9f09d36ae674dcaf6e388c
SHA1b02cc6fc098e3949836fe4d3d21f4a7ab64b607a
SHA256aa27248aea8e5a0aae5dad3a548735352dd77a8bde4f368b3ae46bf6911acaf0
SHA512b6f66e94d574824b49dc1dd47a1ed4a5b6fc068e73962f3a6009ac0f2bc6db9714e945841da14a5c187cf061da36eff724129e2b2ae9a68df5e2b14ddd32b6b2
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\workbench.desktop.main.css
Filesize271KB
MD57c1e6d997deb818334c89e06690d5d9f
SHA165f9929098479ccdff6b91e581e32d111306ef15
SHA256ee6e137996fbbf509d2335e40a03174c0453913d7cc20592dd8956ce1cdd7aca
SHA512a4fa775870e33c07a5b3bd50343809c52ac9cc8b73fcd71947f15e975280957262e8d434bf966f05989336ce4bad1e6ee66a23bdb4a22be944f3297778708d45
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\workbench.desktop.main.js
Filesize320KB
MD5fd303ac55b5f8279825a37b0a4912cfc
SHA1089e22775ac61e965dc15642a7c4deb0ade034fa
SHA256f0dece20f857599bf6de5b237b072365479b603b1daef4981122098f2f74f268
SHA512cfe61381339ed027f142b5fd8019a7c4870bc54a860c09b3dd7117062b56057b91aeef0fe9ad78c03bd42e01da7148c23ed7a3f9419034a60a1de4d6a367b37c
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\workbench.desktop.main.nls.js
Filesize320KB
MD54dbeeac4cbc01e5ae8e46f837e4c98f0
SHA1cc25382a41e882c3e6ed0aaca97df2a461aac7fd
SHA2568a9ef833aadb11031c8d41e956a1acc0bb2c3ad51d119312de80a77380df6b75
SHA5122324014bcc269c725390e5cdc8b66a34e5410cc3f9cc192305688796c3dcec66ab4edc0489fbaf07cc0e68159be6e6a397b08c31487e4162b04b5fb2cb4da341
-
Filesize
9KB
MD591ba0da4075ca3ed7d52e078d43f4a81
SHA11ccf048245b6577af8d04e9a2593da559535c98f
SHA2566d04cf1e4e169f981ca3f3d73866073b5a30f8c1fa304b18422bc3cfe393912e
SHA5126de64e51fe905b1ac5da567c180c106635720a785e4ed4c0dd727074d2125a50f161575ff5644655e6986b7782734fa5dd524297b566aac33aa99559b06a1052
-
Filesize
52KB
MD55b6a3e5c519df3ca5c351b56f0d40b55
SHA18c76d1cbccbf77fa697b472d79c59e3c4720f169
SHA256390e570aa87692e6d3c7c4242084dda61cc3c1bfee581690ce9705f851f73854
SHA51294b2c7b800bb0be4e443429be839b64fcdc90546316b192e2b058eaca8bcc8144d3b048b267bda5fd9ad63eac8faf3c8b0a3e7920eb1ed6509905fb571fac9fb
-
Filesize
611KB
MD5c888aa7c2d1e7cd35a4389875e0e5224
SHA13933ba3765305e6bca6b5d21b612b4f298a777f5
SHA256af3c29a83e8ddbd359c8800ba4271780258cd2461ae795d2defb6ed1b02cad26
SHA512ade89280958aa38403b9f5eeb14915490294d168509f9438d5b19193990dbeb3660bc9af3295416679089deb1c86742b4aa52138a59fee8daf69d173f1ab0698
-
Filesize
115KB
MD52cb43cb55db577c98b59c3a1493f0704
SHA12b3c39760b9a97382a3de3cfbcb27fd3b65e64db
SHA256965a61056a0fa3b3ea99754b26d4a964d5d462db2b7dce1f3c55e36de0779a53
SHA51297cf361a3b46e1e84d60b7cfaa8cb9c6fc446f62dee24df7d0811610be2aca0dd1be645ef49db0d2046210e9329f8f0c0440990c745aab94e143069e426c3fb4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.5MB
MD5efc3ead7bff055bc8a2848b2797a43fa
SHA17c142eb210b64f9929c6401deee0d949bfbb44ac
SHA2560edcd77a94e57840c0a83bfed5ea29130e9da5ff7d3abc4220017cec96eea6e9
SHA5128a630279628bb988e2c4c25e6cef210fe15f616a06d0d6da6ad37f7e97c18970cd123b575e472fa4390bdb2b90388ee76a53394425579b1d4985fa922536da57
-
C:\Users\Admin\AppData\Roaming\Code\CachedData\31c37ee8f63491495ac49e43b8544550fbae4533\chrome\js\index-dir\the-real-index
Filesize48B
MD5485732c0fe23547e2e715f0cd1585107
SHA181621d26cd493b27e54ec1dcc9d8062baef8fd92
SHA2568184523c0849a1063a683a17013fec25fb9cc79c2285ab4152922c95053b9227
SHA5127f32b63ec5ca7bcb9048b263aa1aa727d10bb3ff64e54e9dd3865db51ab0c292d0b492b72126aea6e459576b1bd197de9fa9045989ec58b6755b24299b244529
-
C:\Users\Admin\AppData\Roaming\Code\CachedData\31c37ee8f63491495ac49e43b8544550fbae4533\chrome\js\index-dir\the-real-index
Filesize144B
MD5b346e25a73e2de5b568965ca06735149
SHA1d8119d9cf67f17d36daaa443a4685a9e1ef3a7ff
SHA25688f322abf65632642024e5073cb633d09e351bc3eec8eec88344ada0263d59e0
SHA512a5bc89d82e2abe78680ff015f208bdf6c559aec6c82b403805489a9a8002edcc5b52ceb9285c8d5ede817b70925d64c84bf0ca5e0f89916a0c86daa72651c830
-
C:\Users\Admin\AppData\Roaming\Code\CachedData\31c37ee8f63491495ac49e43b8544550fbae4533\chrome\js\index-dir\the-real-index
Filesize216B
MD5803f10f23f56170ac56520f02bf39fff
SHA1e6774656de1602706efdfc20643beaae324719a6
SHA25649152c8fe30ccb837a31fbec397241905710d61786c32cc65d6f63e42ed1ec4d
SHA512c80860872513643c3a628a1a980e9625787dea22f9a0cefbe43ef1d8fac606ea228406c71eb852d8657aa3fbd1e3b01e96907c9e665e215c6aadb28a5eb34fdf
-
Filesize
649B
MD5f49c9bfad99f602ce4b4348e055a791c
SHA17a190e46943058e09e63a79ab79db867f7de0283
SHA256227361548eadd542ad2558dbb12fb2178f5ddf236be85942e24a193bb2062e1f
SHA51285cae9b4a07c91a4a3aca4f348f0e7e0ed525857c241b56747062afad935dfe56558e15d7410acefa26784cc61282efdd658b65f9a09b3ad81432d356f70a69a
-
Filesize
618B
MD510b2444e62c71310c9dc42dfad8ca194
SHA149eb23596dbae9c79ac1c4910cf742b60730fcfb
SHA25648c242f08c98a7e2283953fad61c948e0b634605238c8fec6e1ce3546129f86b
SHA5126820fe1d569fb2250f7ca31d4e180b1fae993c1535b47a32ce45b7b0600ed4166f661bff2bfc0b22aad3e8c660b422d6681bf304972cbdc6a4bbef8606a3e40d
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
524B
MD5906bc8763698140d7f74f71904267bdd
SHA1f9f5edaef75831e023d827a06c5667412a5ced51
SHA256183ac3d2f1a864d4f4ec47b9e0950bab8020c65dcadb9c1150a40f538c4dc20b
SHA51243ec2f66d3ff126ef7e772d37bc400579d642f0445369b254a7c3bb486ed262fc766a5ba9d33cf3dcdea34237ffc0baaf3c1657176d4fc693d470a9c83728779
-
Filesize
188B
MD53853cfcb9e769baad582209af5bd9385
SHA1bc3c8741451d3d94d6aa3d801347119f8357ce70
SHA256e0bb46f91cc38cc4a8adea53aa24a5cac3972903f7cf635d46df197156a49baa
SHA51222e21686faf2f5787e2de491f397bcceaeebd5c28c17f78c5d71ccb27e77b02656a1a3daee2e8da8059e5a4be13f1eaaa41873b3b2d0b82870bfe3ad688ca975
-
C:\Users\Admin\AppData\Roaming\Code\Service Worker\CacheStorage\2889d27dbd4d7ab04fe47b6701530d9aad6045bb\029c398c-9dc9-4235-b8a6-29311699ce99\index-dir\the-real-index
Filesize144B
MD5e3479fd3be6b65410b6d92264c82d0dc
SHA1a11f6bf1341350a8dd6cb2fa219f83c00e882c26
SHA2563b015885a6e4e6cd28d5881182fab35d3ee85c887416196fe4442d17effe2d43
SHA512e73c059a8c3d487e3c0098a2d2e8d96f8edea0fcd476699aeb7017c7d2fa3b3b26a247c8d08b7d3d5c0ef1f1c7c9686b9250332be55ede958148d6e340147da3
-
C:\Users\Admin\AppData\Roaming\Code\Service Worker\CacheStorage\2889d27dbd4d7ab04fe47b6701530d9aad6045bb\029c398c-9dc9-4235-b8a6-29311699ce99\index-dir\the-real-index~RFe5a1975.TMP
Filesize48B
MD5e3f17c0252f6b8f8fa5dab5e80838df2
SHA15324be59eea02df0d4c606f3318ef454afdc4337
SHA256a024c4d734f1b8e60536bb14bc2c29ce0692e84a1590ba305849d6d02b67f128
SHA5128a7ddc45e3eeb9b713982bcd734319335b17d391f77e8fca09c2c5e7d1e60d323fe5a1d3944b348708cffb03bb937729c0272fc42672c6ad0b34d4ee1ef15925
-
C:\Users\Admin\AppData\Roaming\Code\Service Worker\CacheStorage\2889d27dbd4d7ab04fe47b6701530d9aad6045bb\index.txt
Filesize221B
MD5429e08938032dbf20d864c73f61e1e79
SHA1fa888ecacdc6d6a82fb9fc5fcf9ba8effa9afbe3
SHA2564ee9fc4be2362301c972e81eb19abe96deda4f988931dcce31b24391b1349a90
SHA512b13b2e31f060550a41e130120e7e39a47926dd315213897fb06906f1a6635025d04927334ed22c4ae996940091bc486a4574ecba716dbe2eb8410049cc5c52cc
-
C:\Users\Admin\AppData\Roaming\Code\Service Worker\CacheStorage\2889d27dbd4d7ab04fe47b6701530d9aad6045bb\index.txt~RFe5a19a4.TMP
Filesize226B
MD5e0d7391048c9f191975611e5c4c2f555
SHA10c3f619dd25f4f4b5a98e00aa8c79f65e8075e98
SHA2564f331e7cd04ef5e6a680421b8a5c7dcabfc4aa917bc16266cb7a6ed6baa02fe9
SHA5122d02433ac9e2fb66230436e80258688bc98a204d53a1a064dc169cd17131281e1b76ac4bff40b0914f4ced84f6dc47604f2574da5d2ba80086d72d597617867d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
72B
MD5b7be2ed7c124189125afaa8e17871882
SHA1b910f30d5c87a13ac2699d277044d04853fbb0ce
SHA2561fdf8b4f0709ec40ca659ecb82d0bc8013085770ec7b1a9c947da7253b0aec36
SHA5124a254a530797d7416a9018d8e11119580e9237d492f24620985f777cc8c8d94c349d6852cb095e1f62d9f9f73267b9c32fc35d914b6e94fdd56eab0e33b21f8d
-
C:\Users\Admin\AppData\Roaming\Code\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a18d9.TMP
Filesize72B
MD58fc6e8455859151eb571674b476f1463
SHA1d0d53740247096510d8fc78e8fd298fc5df31122
SHA256c6d6b4f8bd2ac62e1524f1fb00042771bd0b6017a99bc56aa709b08973fdbbfb
SHA512f750a82c6db2cd9daddbbf91789f04d13fcf0bbc43ed61a7b2c365f86b8eca216b2cd456a38459bb0ca508f67e0d91c95b54f5b5fbaa0c6b7170de3d84c01c1c
-
Filesize
172B
MD5c75c19e02f4cd28970abc6590c916c67
SHA1316f580e859556c359b6d40ba7fac630597b8502
SHA2565d818be1e0e819c2c882a6123457f2dad1197f97da6b3069f76d389c642577b5
SHA5120a728d6fccd7eb8ffeaf8d85d8d77e6ba7b6410070a7a3c9309fb376c30b5de674e2485af483b72c5d923af268a92b1fb8ae4279657cd658fe91b15c6a8b774e
-
Filesize
618B
MD52c7eec76c6d307b1c30d98ef6f4bb218
SHA17565e5011cffe228b67e75da6b0b5e4ea24900be
SHA25663f39f387c2e62d35108321debd00ed37c971eb871a4e105ec174f6064422f30
SHA5125bd9b669759152fd81c6bfd4936f3c3c6ed72fbd60596a3aef8302938b73574b5222495c3293f9bb4d6583d5a7a8879b9bef39dc20eeb57f459354311f8f1236
-
Filesize
587B
MD5f653a30d01d5b742e32b8ebc1d7101ef
SHA1e9923794805dad70de96a140cb634491f01db191
SHA256df6dd7ae2f5660e0fe3d76f8e83a89dddb8ebc8d816d4e5dd9e559e0c2256679
SHA51294ff4032020fce3e2535c5b7e3b7d36df151cdfb2249d25c56bec08b066007a92645469a485d8c2d0f1c918615cc0380b07acd8601f08b31747fd83430c7d6dd
-
Filesize
1KB
MD5b144db9e6efedfa3905b8a6cd763e113
SHA1f9a4c6a15298b78d4a06a01d82f98799cfc2a280
SHA256368ee18746aeca12c2ac183847e9137b0f841ffbc58842eda37d967b8efeec4c
SHA512b1ec3209aedb951f01df99a00a55a49211df0dac715c5854fe257ca43271e3f09cad56ef532f1866e7647c12e673adca6b3ddc66a70205f141fa361bf9d3755d
-
Filesize
1KB
MD56de442fc851c02b125a8b83b16a4bb24
SHA1fe4e65f3d3939be7321fba448e6d3c2325e92286
SHA256c9fe6eb5adf2aac58d3c82061a0de4c58809b9990ac69313e2c34e570ece4ed9
SHA51290c2b625a84627e45e3af2a0c7d5cf36dff237bbaead575b19dd113de42712bbc31d75cd3f541d60c702658e1f2498a282e7bc2952d42e8e2b21db18e14e6978
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\bat\package.json
Filesize771B
MD51e22094fafab2866f78cd1b8bb73d064
SHA1fac617fe1d76d60213fd2b80c0f1439e8601342f
SHA25642c92eb0bbba2d51399d75efe2fa103e07a4adc63fa55ce71a07485f772be40f
SHA512a9b798b984d7931faa865b62df571ff4d3579a7e3bcee1054cfc00821a85ce53e469a2ae16c6ad69c0d975d4d80e01c1900c516ae9cee9dc2bdef05b6c0f425e
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\clojure\package.json
Filesize811B
MD525e6ef69ede839e0c3d07e7c9bfc773a
SHA1a5d12534ef9789161b85e149e4f29fbe7707283b
SHA256e841f4905101662239dad6063ded97ba4c00b221db48a3abd1ac3c1b14abe169
SHA512cb1488ec9719d46a4b088f74d0ed944362e5915aad95d7a5743467977e24ff33cf250d2c8f63843b0a669c546e0bb1c41cd2ed39bb33aeae25cb73e10d3894ff
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\coffeescript\package.json
Filesize979B
MD599429503e8cbcf7b356110bf52617cf2
SHA11b50c39a3f8383c5b5c5da89a03b4f9f46130163
SHA256c1f3a57e987368ab64badd7317920906a48129c32de3dea0fdcf0a6156d6b9d8
SHA512f11e5ee749ec8dbe3e05a538e08a5434e5422fec5cd971aafb9f10fca064e03e334a06d4011e6d25815c341b77938c42d4f5275214b6f03b0eb288c6a400caad
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\configuration-editing\package.json
Filesize3KB
MD5f5d7afc0e5768020c9ec5bba5ff8e5f3
SHA1e5ac6d60df1f78274c7f99bb424c13a3e1cff6cc
SHA256ae498e632f7cddbc62faf8fff91825d1eb9e02272a229646ed5efb65345feb53
SHA512105bdd700a22599f5f58c7b490faee68a362fe10b336b76ad2a8c847896a021f28475ea9b03c7da6be4ccaed06bb6fd64ea4ab2ce502c0c5d34c793dc69b6759
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\cpp\package.json
Filesize1KB
MD51c43e53ed97e54614f03fa469dbd5cce
SHA120e41e6ba99028455f24cd797ba6963df07255c3
SHA256dc8411f965bad0323a3ab19aaefd9d1776c56d7f8beb02fcee51ad97fa93b086
SHA51236175e37c68dc1ce0cb50d1d3a196d2689016e860f7452977a73b0564df5cc113407c365e8e747cffe0bacb23e228fac6ba8fed98e4ebcb2212f6107dcf71597
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\csharp\package.json
Filesize855B
MD50d80ef098430da05bf642cb5f02149c8
SHA17b4f2e1d6219fddd5b3d607cacefb78cc7f12cf5
SHA25634dd3c20a8f3e6cc3801716c12bdb8efa1a02d3504d120f25e380a2c9ab64419
SHA512975c61d9fcb82cffbb58c028facf6ac094a8e21ff6e99597a9e16d744b9719b5eb4718fcf8e3f973f4d80b57af162cabf71b9683e503d1423edbcbd3176f0c1c
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\css-language-features\package.json
Filesize16KB
MD503c26015c9eee9a2a01322b27b169d1f
SHA1c87a5d2a244e5f9f1e59791793e8afbe424214a2
SHA256dfb1b5600d806c8ff192ac2046b1d486143f4216892277ba0838e95f546dfb90
SHA512843352c36d3987e7a24fd90d493267f1424419c8ed1ace576659c6900da6dfbc78829497bfab4823b2517480801d446806ab9b991e529124f25b8d1af7b6fe01
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\css\package.json
Filesize739B
MD56e4ba5ea1287ef4a0049fc58d44687c6
SHA13706e2656f5cdc7d4ef4094bb512a9fbcc257c5f
SHA256a56810c715aa462cec304dd9b7d1c21422dc2c711776461a2a8d394bb5f0434a
SHA51255feb495e27cc250eeb9f969c48cb991696c44fc3cad180138a56bc45784bc18fbd20c5acb8d08158f3c7386c34bdb8d7e1c0ffa1208d2992246d183c60a97a4
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\dart\package.json
Filesize595B
MD54b6b4faf4d7a577d4b59b52d7f73e399
SHA1d1c2561acf2befd365d07c5325c307355859289d
SHA2563152275d736be77861f04e1734cdbb969efb15725dc590c33dc564d1551bdc1c
SHA512fa945c732ed23385d559c7feeb785dfcdeebd73e9bac92a19859469bf5d20dd825542483124b6969a3aa984c638731aacdc4180c4b72f232f7ae35bf51d9d95d
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\base\parts\sandbox\electron-sandbox\preload.js
Filesize2KB
MD53ace1766a590b852b65f0e461c27ca75
SHA1585e4e0a7ab17a1ff8be4064c764e2212ab87863
SHA2560e823ea45a83ed792b196ad7a57d0e7cfd028c012263ff040281acf6b98b7a25
SHA512671827517f3ca8f2682c843c9b0003b158fb56f4935b707909d44f8e17bf3629e4fe762c74661ba9c20921dfe1c9cb50b5c55444349b65599e8ad830f313c2c9