Analysis
- max time kernel
929s - max time network
930s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250113-en - resource tags
- submitted
16/01/2025, 18:46
General
- Target Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne.zip
- Size 528KB
- Sample250116-xe2xestmf1
- SHA256 6b375c48ad15457b59515cb32a1654772fb18d7f1f5b2921c359975150bd89ef
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 10 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 46 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Network Service Discovery 1 TTPs 8 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Detected potential entity reuse from brand MICROSOFT.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 64 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 46 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Kills process with taskkill 64 IoCs
- Modifies data under HKEY_USERS 62 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of SetWindowsHookEx 26 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne.zip"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8daec4e0-ca89-41f8-84ab-b79782eba184} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2372 -parentBuildID 20240401114208 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {130ebdc2-fd12-4a6b-8f07-a4dba811f9dd} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2964 -childID 1 -isForBrowser -prefsHandle 2988 -prefMapHandle 3000 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d4a906d-0b98-4a27-9bfc-55128e1bd8ab} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4016 -childID 2 -isForBrowser -prefsHandle 4008 -prefMapHandle 4004 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8365e695-80d1-4256-a0c1-0399832017fc} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4948 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4944 -prefMapHandle 4936 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {428f68d1-2b85-4d58-af2f-6a3e82280793} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4032 -childID 3 -isForBrowser -prefsHandle 2784 -prefMapHandle 1384 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2c1eedc-42a8-4d4e-93c1-56291eeefe4f} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 4 -isForBrowser -prefsHandle 1540 -prefMapHandle 1408 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58b6782f-ed1f-4fd3-a5a0-3a98343089b4} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5828 -childID 5 -isForBrowser -prefsHandle 5836 -prefMapHandle 5844 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0225fd5-909e-42fb-af47-f1ead562fb7a} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5696 -childID 6 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94d28896-4440-4e72-be54-32b949750d55} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6068 -parentBuildID 20240401114208 -prefsHandle 6220 -prefMapHandle 5624 -prefsLen 32642 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e8af98c-24cf-4aed-9bf4-02249d925bb4} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 5588 -prefMapHandle 5628 -prefsLen 32642 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd125c3c-7598-4ba3-8b3a-d4e659291efb} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5552 -childID 7 -isForBrowser -prefsHandle 6332 -prefMapHandle 5592 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68aaad07-d5f5-46a9-b917-57943c669e0a} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5988 -childID 8 -isForBrowser -prefsHandle 5688 -prefMapHandle 6036 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd6a8ecd-60ca-4a31-8f96-3dac481cae1f} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 9 -isForBrowser -prefsHandle 6608 -prefMapHandle 6616 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1a6d836-0e11-4d0f-927b-b410443fc609} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6808 -childID 10 -isForBrowser -prefsHandle 6636 -prefMapHandle 6640 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {37b54e92-b820-4a74-901e-7785017de243} 1200 "\\.\pipe\gecko-crash-server-pipe.1200" tab3⤵
-
-
C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.96.3.exe"C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.96.3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-NR1FU.tmp\VSCodeUserSetup-x64-1.96.3.tmp"C:\Users\Admin\AppData\Local\Temp\is-NR1FU.tmp\VSCodeUserSetup-x64-1.96.3.tmp" /SL5="$B0264,103871940,828416,C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.96.3.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1816,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2000,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:36⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3320,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3316 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3796,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:86⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.vscode-dotnet-runtime-2.2.5 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.vscode-dotnet-runtime-2.2.5.sigzip7⤵
- Executes dropped EXE
- System Time Discovery
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.vscode-jupyter-cell-tags-0.1.9 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.vscode-jupyter-cell-tags-0.1.9.sigzip7⤵
- Executes dropped EXE
- Modifies system certificate store
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-keymap-1.1.2 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-keymap-1.1.2.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.vscode-dotnet-pack-1.0.13 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.vscode-dotnet-pack-1.0.13.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.dotnet-interactive-vscode-1.0.5568010 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.dotnet-interactive-vscode-1.0.5568010.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.vscode-jupyter-slideshow-0.1.6 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.vscode-jupyter-slideshow-0.1.6.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-renderers-1.0.21 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-renderers-1.0.21.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-2024.11.0-win32-x64 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-toolsai.jupyter-2024.11.0-win32-x64.sigzip7⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ionide.ionide-fsharp-7.22.0 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ionide.ionide-fsharp-7.22.0.sigzip7⤵
- Executes dropped EXE
- Network Service Discovery
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.csharp-2.61.28-win32-x64 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.csharp-2.61.28-win32-x64.sigzip7⤵
- Executes dropped EXE
- Network Service Discovery
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.csdevkit-1.15.34-win32-x64 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\ms-dotnettools.csdevkit-1.15.34-win32-x64.sigzip7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3828,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3924,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:86⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "dotnet --info"7⤵
-
C:\Program Files\dotnet\dotnet.exedotnet --info8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "dotnet --list-runtimes"7⤵
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"7⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9072 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"7⤵
-
C:\Windows\system32\where.exewhere where8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11236 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"7⤵
-
C:\Windows\system32\where.exewhere dotnet8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 12056 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8960 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8176 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6172 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9744 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7268 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9940 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10056 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"7⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10156 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"7⤵
-
C:\Windows\system32\where.exewhere where8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10168 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"7⤵
-
C:\Windows\system32\where.exewhere dotnet8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10956 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7204 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7624 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7344 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8432 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7076 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4800 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8200 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11944 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11832 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path"7⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11880 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5248 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4440 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11148 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10484 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10784 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10560 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3012 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"7⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5620 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"7⤵
-
C:\Windows\system32\where.exewhere where8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10716 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"7⤵
-
C:\Windows\system32\where.exewhere dotnet8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5640 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 12008 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10452 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7940 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8676 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4880 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6968 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7092 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"7⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6364 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"7⤵
-
C:\Windows\system32\where.exewhere where8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1416 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"7⤵
-
C:\Windows\system32\where.exewhere dotnet8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6624 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7664 /f /t7⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8888 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9056 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9544 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4824 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8660 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7576 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9704 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7948 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path"7⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9924 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10020 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9996 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10224 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes8⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10936 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"7⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5988 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7276 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks8⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7260 /f /t7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"7⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"7⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"7⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11816 /f /t7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -command $ExecutionContext.SessionState.LanguageMode"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command $ExecutionContext.SessionState.LanguageMode8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -NoLogo -ExecutionPolicy unrestricted -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; & 'c:\Users\Admin\.vscode\extensions\ms-dotnettools.vscode-dotnet-runtime-2.2.5\dist\install scripts\dotnet-install.ps1' -InstallDir 'c:\Users\Admin\AppData\Roaming\Code\User\globalStorage\ms-dotnettools.vscode-dotnet-runtime\.dotnet\8.0.12~x64' -Version 8.0.12 -Verbose -Runtime dotnet -Architecture x64 }""7⤵
- System Time Discovery
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -NoLogo -ExecutionPolicy unrestricted -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; & 'c:\Users\Admin\.vscode\extensions\ms-dotnettools.vscode-dotnet-runtime-2.2.5\dist\install scripts\dotnet-install.ps1' -InstallDir 'c:\Users\Admin\AppData\Roaming\Code\User\globalStorage\ms-dotnettools.vscode-dotnet-runtime\.dotnet\8.0.12~x64' -Version 8.0.12 -Verbose -Runtime dotnet -Architecture x64 }"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exe --logLevel Information --razorSourceGenerator c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Microsoft.CodeAnalysis.Razor.Compiler.dll --razorDesignTimePath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --devKitDependencyPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslynDevKit\Microsoft.VisualStudio.LanguageServices.DevKit.dll --sessionId 3646b101-cc8a-4644-9088-c7e64f0364ab1737053303318 --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.dll --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.Diagnostics.dll --telemetryLevel all --extensionLogDirectory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T184821\window1\exthost\ms-dotnettools.csharp7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SYSTEM32\getmac.exe"getmac"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=43327⤵
- Executes dropped EXE
-
-
C:\Program Files\dotnet\dotnet.exedotnet --info7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"6⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4072,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4080 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4412,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4416 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4008,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3888 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"6⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q7⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4048,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4108 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4000,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3984 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4108,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:86⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3976,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4444 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4912,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4908 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4444,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4640 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://marketplace.visualstudio.com/items?itemName=ms-dotnettools.csdevkit6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffb70be46f8,0x7ffb70be4708,0x7ffb70be47187⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17525615422706978323,14299705920869106469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17525615422706978323,14299705920869106469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17525615422706978323,14299705920869106469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17525615422706978323,14299705920869106469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17525615422706978323,14299705920869106469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:17⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"6⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q7⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4560,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4460 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5044,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4448 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://marketplace.visualstudio.com/_apis/public/gallery/publishers/ms-dotnettools/vsextensions/vscode-dotnet-pack/1.0.13/vspackage6⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffb70be46f8,0x7ffb70be4708,0x7ffb70be47187⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:37⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3040 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5756 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,12594766186304029984,8215065265703533909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4988,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=5024 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"6⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q7⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4608,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4676 --vscode-window-config=vscode:2d436cb0-1c2b-4f6b-8f62-9242d5c94014 /prefetch:16⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=5004,i,7572927676434762253,4390245065614849917,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:86⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Downloads\ms-dotnettools.vscode-dotnet-pack-1.0.13.vsix"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=ef6f41dd-eeff-4493-850f-f698dd9de73c&iid=ef6f41dd-eeff-4493-850f-f698dd9de73c&sid=ef6f41dd-eeff-4493-850f-f698dd9de73c --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.96.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=32.2.6 --initial-client-data=0x48c,0x490,0x494,0x488,0x498,0x7ff7a38060b8,0x7ff7a38060c4,0x7ff7a38060d03⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1832,i,2210030981294759295,11176676617823758961,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2360,i,2210030981294759295,11176676617823758961,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:33⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne\Fableborne-Robot.sln"1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=ef6f41dd-eeff-4493-850f-f698dd9de73c&iid=ef6f41dd-eeff-4493-850f-f698dd9de73c&sid=ef6f41dd-eeff-4493-850f-f698dd9de73c --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.96.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=32.2.6 --initial-client-data=0x474,0x478,0x47c,0x470,0x480,0x7ff7a38060b8,0x7ff7a38060c4,0x7ff7a38060d02⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1848,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:22⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2364,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3184,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3180 --vscode-window-config=vscode:1b32411e-8e39-4e46-9049-ed4722a54b49 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2640,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3900,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3952,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3820,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4008,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.fs -g **/*.fsproj -g **/*.fsx -g **/*.sln -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.csproj -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{csproj,csx,cake} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6492 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11340 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6864 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6724 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 2052 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7116 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6816 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11208 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7644 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9044 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9100 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7828 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6708 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11592 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9804 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10516 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9916 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9972 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10180 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10992 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10936 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7640 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path"3⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1612 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10044 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7708 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3052 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7340 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9980 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5916 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5344 /f /t3⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3268 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5424 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3776 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6360 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6472 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8512 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3916 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9284 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10368 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 2092 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10540 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10912 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 2632 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5548 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11912 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1744 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6048 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9300 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8172 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8228 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9828 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8296 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path"3⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\dotnet\Setup\InstalledVersions\x64\sharedhost /v Path4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4240 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8468 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8560 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6584 /f /t3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6344 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 2052 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6276 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-sdks"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7492 /f /t3⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{csproj} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules/** --no-ignore --follow --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.sln -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,obj,bin}/** --no-ignore --follow --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
C:\Program Files\dotnet\dotnet.exedotnet --info3⤵
-
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes3⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exe --logLevel Information --razorSourceGenerator c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Microsoft.CodeAnalysis.Razor.Compiler.dll --razorDesignTimePath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --devKitDependencyPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslynDevKit\Microsoft.VisualStudio.LanguageServices.DevKit.dll --sessionId 9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438 --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.dll --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.Diagnostics.dll --telemetryLevel all --extensionLogDirectory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185204\window1\exthost\ms-dotnettools.csharp3⤵
- Checks computer location settings
- Executes dropped EXE
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{cshtml,razor} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\markdown-language-features\dist\serverWorkerMain" --node-ipc --clientProcessId=19163⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10060 /f /t3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -command $ExecutionContext.SessionState.LanguageMode"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command $ExecutionContext.SessionState.LanguageMode4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -NonInteractive -NoLogo -ExecutionPolicy unrestricted -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; & 'c:\Users\Admin\.vscode\extensions\ms-dotnettools.vscode-dotnet-runtime-2.2.5\dist\install scripts\dotnet-install.ps1' -InstallDir 'c:\Users\Admin\AppData\Roaming\Code\User\globalStorage\ms-dotnettools.vscode-dotnet-runtime\.dotnet\8.0.12~x64~aspnetcore' -Version 8.0.12 -Verbose -Runtime aspnetcore -Architecture x64 }""3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -NoLogo -ExecutionPolicy unrestricted -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; & 'c:\Users\Admin\.vscode\extensions\ms-dotnettools.vscode-dotnet-runtime-2.2.5\dist\install scripts\dotnet-install.ps1' -InstallDir 'c:\Users\Admin\AppData\Roaming\Code\User\globalStorage\ms-dotnettools.vscode-dotnet-runtime\.dotnet\8.0.12~x64~aspnetcore' -Version 8.0.12 -Verbose -Runtime aspnetcore -Architecture x64 }"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\where.exewhere.exe dotnet3⤵
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server --serviceHubConfigPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\servicehub\servicehub.config.json --pipe \\.\pipe\2bf281ac-5446-43ed-a68d-9ce39f7deb6f --pipe-server \\.\pipe\fed0dacc-daa3-464d-bea0-afcdfb64bdb9 --log-directory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185204\window1\exthost\ms-dotnettools.csdevkit --log-verbosity Information --vscodeSessionId 9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438 --vscodeTelemetryLevel all --cache-directory c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\cache --component c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\msbuild-dependencies.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost-rpc.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system\node_modules\@microsoft\microsoft.visualstudio.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.templateengine c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\roslyn-visualstudio-languageservices-devkit\node_modules\@microsoft\visualstudio-languageservices-devkit c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-code-coverage\platforms\win32-x64\node_modules\@microsoft\coverage-services.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-samples-sayhello.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-shared.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSDebugCore\platforms\win32-x64\node_modules\@microsoft\visualstudio-debugger-devkit.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSUnitTesting\platforms\win32-x64\node_modules\@microsoft\visualstudio-testwindow-vscode-service.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\WebTools\node_modules\@microsoft\vscode.webtools3⤵
- Executes dropped EXE
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server" --serviceHubConfigPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\servicehub\servicehub.config.json --pipe \\.\pipe\2bf281ac-5446-43ed-a68d-9ce39f7deb6f --pipe-server \\.\pipe\fed0dacc-daa3-464d-bea0-afcdfb64bdb9 --log-directory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185204\window1\exthost\ms-dotnettools.csdevkit --log-verbosity Information --vscodeSessionId 9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438 --vscodeTelemetryLevel all --cache-directory c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\cache --component c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\msbuild-dependencies.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost-rpc.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system\node_modules\@microsoft\microsoft.visualstudio.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.templateengine c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\roslyn-visualstudio-languageservices-devkit\node_modules\@microsoft\visualstudio-languageservices-devkit c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-code-coverage\platforms\win32-x64\node_modules\@microsoft\coverage-services.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-samples-sayhello.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-shared.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSDebugCore\platforms\win32-x64\node_modules\@microsoft\visualstudio-debugger-devkit.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSUnitTesting\platforms\win32-x64\node_modules\@microsoft\visualstudio-testwindow-vscode-service.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\WebTools\node_modules\@microsoft\vscode.webtools4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64\Microsoft.ServiceHub.Controller.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64/Microsoft.ServiceHub.Controller" f1d0e2dbe5ea1a180173a4f84a22fe1c533b71a2bbc0f0f92e4d51096612bfd0 /ControllerCooldownTimeout:30000 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438\",\"ProcessStartTime\":133815271790900961,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Checks computer location settings
- Executes dropped EXE
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe" dotnet.projectSystem$C94B8CFE-E3FD-4BAF-A941-2866DBB566FE net.pipe://8716D13DE4DDA0BAB84A189C34255ECD2DA4 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438\",\"ProcessStartTime\":133815271790900961,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"6⤵
- Checks computer location settings
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" "c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64/Microsoft.VisualStudio.ProjectSystem.Server.BuildHost.dll"7⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info7⤵
-
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64/Microsoft.VisualStudio.Code.ServiceHost.exe" dotnet$C94B8CFE-E3FD-4BAF-A941-2866DBB566FE net.pipe://8716D13DE4DDA0BAB84A189C34255ECD2DA4 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438\",\"ProcessStartTime\":133815271790900961,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"6⤵
- Checks computer location settings
- System Time Discovery
-
-
-
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor --vscodeSessionId 9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438 --vscodeTelemetryLevel all3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor" --vscodeSessionId 9e95c7c2-ab25-40da-89f7-aa01dbafe4dc1737053559438 --vscodeTelemetryLevel all4⤵
- Checks computer location settings
-
-
-
C:\Program Files\dotnet\dotnet.exedotnet.exe restore C:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne\Fableborne-Robot.sln --interactive3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/tsconfig*.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.*}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.vscode-test}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Program Files\dotnet\dotnet.exedotnet build C:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne\Fableborne-Robot.sln /property:GenerateFullPaths=true /consoleloggerparameters:NoSummary /p:Configuration=Debug "/p:Platform=\"Any CPU\""3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/tsconfig*.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.*}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4436,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4452 --vscode-window-config=vscode:1b32411e-8e39-4e46-9049-ed4722a54b49 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=4752,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4360,i,1042497478286513560,8234979831247775611,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet/download2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffb70be46f8,0x7ffb70be4708,0x7ffb70be47183⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5304 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\dotnet-sdk-9.0.102-win-x64.exe"C:\Users\Admin\Downloads\dotnet-sdk-9.0.102-win-x64.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{C76C9967-95C7-4E1A-81BA-FB9CF4076616}\.cr\dotnet-sdk-9.0.102-win-x64.exe"C:\Windows\Temp\{C76C9967-95C7-4E1A-81BA-FB9CF4076616}\.cr\dotnet-sdk-9.0.102-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\dotnet-sdk-9.0.102-win-x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=5004⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{D00420EB-9A84-412B-A58E-CCBAFDE0F80F}\.be\dotnet-sdk-9.0.102-win-x64.exe"C:\Windows\Temp\{D00420EB-9A84-412B-A58E-CCBAFDE0F80F}\.be\dotnet-sdk-9.0.102-win-x64.exe" -q -burn.elevated BurnPipe.{2969173D-1D64-423B-AE79-E907F364A2E3} {F052F49D-FA0A-4DEB-81E6-270F93C5891D} 14925⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16657411992022038372,6370228117836545291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:23⤵
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 72B9124EF7CED516E38B6AA94F13F75F2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D93269F856F7B277EDF69AF0DD73BCBB2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7EE25D1D90E8BB9DBE528350A81B62392⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 12559B101258385DF9F7937439283FB22⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 99865285809EE1501519ED8ACA2EF05C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8A7D82856301CDEDC17D818516117BA92⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6A6300A0808A917CCB6F9AF2A95CF2742⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4318803266D79A6E7661DC908F4A48B62⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9651C7C2C688DA4DE79615E9D9136CDD2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BF1289525978A129474451A00B0DF9902⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3F88C186AA9E62367092838E0C4B1ADA2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F192D3C765F29729FE92688F23C5C732⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 83F2E4762C890AC9B45516599F4BE0F02⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F7636DB0CFC89B3B8EAC6204B64926D2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F500DECB950D162EAB6DE22B2ACC59B72⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 603C2EF58B4E8265F4BE7BB0F6F572042⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 68ED09DA42E7A458A51E3D25BF3EF9532⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FB5034CE12566DB80140335F287A9A762⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4193D50B7D890B95CBAC2538CAEB0FA42⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C64D44727CD089F6290C8FB9C24E455B2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D7E58702746C28CF94DE5684E14E6C4C2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C31F45232F9D6C74867AC4F360FAF72B2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F4A963C051003617399BB52A71996912⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CCE3635E1D09AA20DA1BC910D5F5AE092⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E04455F88F02C596DC337DD5B733D4B2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 130A251B6BC745448031A7FBF3B5D7442⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38ED7F03E9185D28598A17C785FB0B032⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8E94389EDB8E208EE77654862CEBA7B62⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE83FC267CF34D5D93BEBFD10680DE8D E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\\dotnet.exe" exec "C:\Program Files\dotnet\\sdk\9.0.102\dotnet.dll" internal-reportinstallsuccess "C:\Users\Admin\Downloads\dotnet-sdk-9.0.102-win-x64.exe"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
C:\Windows\system32\getmac.exe"C:\Windows\system32\getmac.exe"4⤵
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 961923394E51AB519BE911B4B520FDF52⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "C:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=ef6f41dd-eeff-4493-850f-f698dd9de73c&iid=ef6f41dd-eeff-4493-850f-f698dd9de73c&sid=ef6f41dd-eeff-4493-850f-f698dd9de73c --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.96.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=32.2.6 --initial-client-data=0x474,0x478,0x47c,0x470,0x480,0x7ff7a38060b8,0x7ff7a38060c4,0x7ff7a38060d02⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1864,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=2096,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:32⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=3200,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3196 --vscode-window-config=vscode:3152b197-90a5-4f1d-8232-65aacd30a896 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3840,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:82⤵
- Checks computer location settings
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.fs -g **/*.fsproj -g **/*.fsx -g **/*.sln -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.csproj -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{csproj,csx,cake} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 2828 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 3028 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6200 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7100 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8636 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1536 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7972 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 396 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1476 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10604 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9052 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11232 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 4352 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1616 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9688 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7176 /f /t3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version3⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" c:\Users\Admin\.vscode\extensions\ionide.ionide-fsharp-7.22.0\bin\net9.0\fsautocomplete.dll --state-directory c:\Users\Admin\AppData\Roaming\Code\User\workspaceStorage\8db0ad62c8bee7cc17490750f532a1bc\Ionide.Ionide-fsharp3⤵
- Network Service Discovery
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exe --logLevel Information --razorSourceGenerator c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Microsoft.CodeAnalysis.Razor.Compiler.dll --razorDesignTimePath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --devKitDependencyPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslynDevKit\Microsoft.VisualStudio.LanguageServices.DevKit.dll --sessionId 4be5313b-637a-4f04-a4bd-9153435a30a41737053817515 --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.dll --extension c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.xamlTools\Microsoft.VisualStudio.DesignTools.CodeAnalysis.Diagnostics.dll --telemetryLevel all --extensionLogDirectory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185657\window1\exthost\ms-dotnettools.csharp3⤵
- Checks computer location settings
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Program Files\dotnet\dotnet.exedotnet --info3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{cshtml,razor} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes3⤵
- System Time Discovery
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"3⤵
-
-
C:\Windows\system32\where.exewhere.exe dotnet3⤵
-
-
C:\Program Files\dotnet\dotnet.exedotnet --version3⤵
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server --serviceHubConfigPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\servicehub\servicehub.config.json --pipe \\.\pipe\4e944285-1d7d-433d-868b-2be64032305d --pipe-server \\.\pipe\9c5f8f76-c8d6-4eb6-93ab-be356dd3b200 --log-directory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185657\window1\exthost\ms-dotnettools.csdevkit --log-verbosity Information --vscodeSessionId 4be5313b-637a-4f04-a4bd-9153435a30a41737053817515 --vscodeTelemetryLevel all --cache-directory c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\cache --component c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\msbuild-dependencies.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost-rpc.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system\node_modules\@microsoft\microsoft.visualstudio.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.templateengine c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\roslyn-visualstudio-languageservices-devkit\node_modules\@microsoft\visualstudio-languageservices-devkit c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-code-coverage\platforms\win32-x64\node_modules\@microsoft\coverage-services.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-samples-sayhello.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-shared.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSDebugCore\platforms\win32-x64\node_modules\@microsoft\visualstudio-debugger-devkit.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSUnitTesting\platforms\win32-x64\node_modules\@microsoft\visualstudio-testwindow-vscode-service.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\WebTools\node_modules\@microsoft\vscode.webtools3⤵
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64\Microsoft.VisualStudio.Code.Server" --serviceHubConfigPath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\servicehub\servicehub.config.json --pipe \\.\pipe\4e944285-1d7d-433d-868b-2be64032305d --pipe-server \\.\pipe\9c5f8f76-c8d6-4eb6-93ab-be356dd3b200 --log-directory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185657\window1\exthost\ms-dotnettools.csdevkit --log-verbosity Information --vscodeSessionId 4be5313b-637a-4f04-a4bd-9153435a30a41737053817515 --vscodeTelemetryLevel all --cache-directory c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\cache --component c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\msbuild-dependencies.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost-rpc.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system\node_modules\@microsoft\microsoft.visualstudio.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.projectsystem.managed c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\dotnet-project-system-vscode\node_modules\@microsoft\vscode.templateengine c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\roslyn-visualstudio-languageservices-devkit\node_modules\@microsoft\visualstudio-languageservices-devkit c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-code-coverage\platforms\win32-x64\node_modules\@microsoft\coverage-services.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-samples-sayhello.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server-shared.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-server.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSDebugCore\platforms\win32-x64\node_modules\@microsoft\visualstudio-debugger-devkit.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\VSUnitTesting\platforms\win32-x64\node_modules\@microsoft\visualstudio-testwindow-vscode-service.win32-x64 c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\WebTools\node_modules\@microsoft\vscode.webtools4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64\Microsoft.ServiceHub.Controller.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\servicehub-controller-net60.win32-x64/Microsoft.ServiceHub.Controller" e3bcfd8c8500394baa9c5cd50ae10c1ba6c4d693f051152b806e622f689309e4 /ControllerCooldownTimeout:30000 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"4be5313b-637a-4f04-a4bd-9153435a30a41737053817515\",\"ProcessStartTime\":133815274254652010,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"5⤵
- Checks computer location settings
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64/Microsoft.VisualStudio.Code.ServiceHost.exe" dotnet$C94B8CFE-E3FD-4BAF-A941-2866DBB566FE net.pipe://2924DEC2C82EA48F3F6FEA3DDA779E2C71A2 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"4be5313b-637a-4f04-a4bd-9153435a30a41737053817515\",\"ProcessStartTime\":133815274254652010,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"6⤵
- Checks computer location settings
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-servicehost.win32-x64\Microsoft.VisualStudio.Code.ServiceHost.exe" dotnet.projectSystem$C94B8CFE-E3FD-4BAF-A941-2866DBB566FE net.pipe://2924DEC2C82EA48F3F6FEA3DDA779E2C71A2 "/TelemetrySession:{\"TelemetryLevel\":\"all\",\"IsOptedIn\":false,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":null,\"AsimovInstrumentationKey\":null,\"CollectorApiKey\":\"0c6ae279ed8443289764825290e4f9e2-1a736e7c-1324-4338-be46-fc2a58ae4d14-7255\",\"AppId\":1010,\"UserId\":\"4bcc34a8-75ff-4e4e-aad4-a4700fb1a713\",\"Id\":\"4be5313b-637a-4f04-a4bd-9153435a30a41737053817515\",\"ProcessStartTime\":133815274254652010,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[],\"BucketFiltersToAddDumpsToFaults\":[]}"6⤵
- Checks computer location settings
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" "c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\CPS\platforms\win32-x64\node_modules\@microsoft\visualstudio-projectsystem-buildhost.win32-x64/Microsoft.VisualStudio.ProjectSystem.Server.BuildHost.dll"7⤵
-
-
-
-
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-code-launcher.win32-x64\escape-node-job c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor --vscodeSessionId 4be5313b-637a-4f04-a4bd-9153435a30a41737053817515 --vscodeTelemetryLevel all3⤵
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csdevkit-1.15.34-win32-x64\components\vs-green-server\platforms\win32-x64\node_modules\@microsoft\visualstudio-reliability-monitor.win32-x64\Microsoft.VisualStudio.Reliability.Monitor" --vscodeSessionId 4be5313b-637a-4f04-a4bd-9153435a30a41737053817515 --vscodeTelemetryLevel all4⤵
- Checks computer location settings
-
-
-
C:\Program Files\dotnet\dotnet.exedotnet.exe restore C:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne\Fableborne-Robot.sln --interactive3⤵
- Checks computer location settings
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=44243⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3852,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:82⤵
- Checks computer location settings
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=3952,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4040,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:82⤵
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 89 --height 11 --signal 0x3c8 --server 0x3c03⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\node-pty\lib\conpty_console_list_agent" 93163⤵
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --width 98 --height 11 --signal 0x454 --server 0x4503⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -command "try { . \"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\out\vs\workbench\contrib\terminal\common\scripts\shellIntegration.ps1\" } catch {}"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\conhost.exe\\?\C:\Windows\system32\conhost.exe --headless --inheritcursor --width 80 --height 11 --signal 0x380 --server 0x47c3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command & 'C:\Program Files\dotnet\dotnet.exe' build Fableborne-Robot.sln3⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" build Fableborne-Robot.sln4⤵
- Checks computer location settings
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --inspect-port=0 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4436,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:82⤵
- Checks computer location settings
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.fs -g **/*.fsproj -g **/*.fsx -g **/*.sln -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.csproj -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{csproj,csx,cake} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules -g !**/bower_components -g !**/*.code-search --no-ignore-parent --follow --quiet --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6188 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 10408 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6648 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7116 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 11180 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1556 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1988 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8332 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %PATH%"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6868 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where where"3⤵
-
C:\Windows\system32\where.exewhere where4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 6600 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "where dotnet"3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9144 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 8908 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 1708 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 9476 /f /t3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001 | "C:\Program Files\dotnet\dotnet.exe" --list-runtimes"3⤵
- System Time Discovery
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 7872 /f /t3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\dotnet\dotnet.exe" --info"3⤵
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --info4⤵
-
-
-
C:\Windows\system32\taskkill.exetaskkill /pid 5992 /f /t3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.{cshtml,razor} -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exec:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\Microsoft.CodeAnalysis.LanguageServer.exe --logLevel Information --razorSourceGenerator c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Microsoft.CodeAnalysis.Razor.Compiler.dll --razorDesignTimePath c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --telemetryLevel all --extensionLogDirectory c:\Users\Admin\AppData\Roaming\Code\logs\20250116T185657\window1\exthost\ms-dotnettools.csharp3⤵
- Checks computer location settings
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exe"dotnet.exe" --roll-forward LatestMajor c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\BuildHost-netcore\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.dll --pipe 5657e72d-95df-4dee-8cf5-d451fd0c08dd --property RazorDesignTimeTargets=c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --locale en-US4⤵
- System Time Discovery
-
-
C:\Program Files\dotnet\dotnet.exe"dotnet.exe" --roll-forward LatestMajor c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\BuildHost-netcore\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.dll --pipe fc454f10-90c0-46e3-8cec-4b3bd1c1e0ba --property RazorDesignTimeTargets=c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --locale en-US4⤵
- System Time Discovery
-
-
\??\c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\BuildHost-net472\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.exe"c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\BuildHost-net472\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.exe" --pipe 032ba277-ed02-4554-8933-b419940fe69f --property RazorDesignTimeTargets=c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --locale en-US4⤵
- System Time Discovery
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" restore c:\Users\Admin\Desktop\Fableborne-Crypto-Bot-Crypto-Game-Auto-Farm-Clicker-Cheat-Token-Hack-Api-fableborne\Fableborne-AutoPlay\Form11\Form1.csproj4⤵
- Checks computer location settings
-
-
C:\Program Files\dotnet\dotnet.exe"dotnet.exe" --roll-forward LatestMajor c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.roslyn\BuildHost-netcore\Microsoft.CodeAnalysis.Workspaces.MSBuild.BuildHost.dll --pipe 902fa847-3897-4231-ae51-7454ab351b6f --property RazorDesignTimeTargets=c:\Users\Admin\.vscode\extensions\ms-dotnettools.csharp-2.61.28-win32-x64\.razor\Targets\Microsoft.NET.Sdk.Razor.DesignTime.targets --locale en-US4⤵
- Network Service Discovery
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version3⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" c:\Users\Admin\.vscode\extensions\ionide.ionide-fsharp-7.22.0\bin\net9.0\fsautocomplete.dll --state-directory c:\Users\Admin\AppData\Roaming\Code\User\workspaceStorage\8db0ad62c8bee7cc17490750f532a1bc\Ionide.Ionide-fsharp3⤵
- Network Service Discovery
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --version4⤵
-
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\dotnet.exe" --list-sdks4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/*.sln -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/node_modules/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "dotnet --info"3⤵
-
C:\Program Files\dotnet\dotnet.exedotnet --info4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "dotnet --list-runtimes"3⤵
- System Time Discovery
-
C:\Program Files\dotnet\dotnet.exedotnet --list-runtimes4⤵
- System Time Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"3⤵
-
C:\Windows\System32\reg.exeC:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/tsconfig*.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.*}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/package.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.vscode-test}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/tsconfig*.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.*}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
C:\Windows\system32\cmd.execmd /C where dotnet3⤵
-
C:\Windows\system32\where.exewhere dotnet4⤵
-
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules\@vscode\ripgrep\bin\rg.exe" --files --hidden --case-sensitive --no-require-git -g **/tsconfig*.json -g !**/.git -g !**/.svn -g !**/.hg -g !**/CVS -g !**/.DS_Store -g !**/Thumbs.db -g !**/{node_modules,.*}/** --no-ignore --follow --no-config --no-ignore-global3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=4600,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3992,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3740,i,1472132166568719020,17995705908167431790,262144 --disable-features=CalculateNativeWinOcclusion,PlzDedicatedWorker,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3744 --vscode-window-config=vscode:3152b197-90a5-4f1d-8232-65aacd30a896 /prefetch:12⤵
- Checks computer location settings
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e5f95b4.rbs
e5f95b9.rbs
e5f95be.rbs
e5f95c5.rbs
e5f95ca.rbs
e5f95cf.rbs
e5f95d4.rbs
e5f95d9.rbs
e5f95de.rbs
e5f95e3.rbs
e5f95e8.rbs
e5f95ed.rbs
e5f95f2.rbs
e5f95f7.rbs
e5f95fc.rbs
e5f9601.rbs
e5f9606.rbs
e5f960b.rbs
e5f9610.rbs
e5f9615.rbs
e5f961a.rbs
e5f961f.rbs
e5f9624.rbs
e5f9629.rbs
e5f962e.rbs
e5f9633.rbs
e5f9638.rbs
e5f963d.rbs
e5f9642.rbs
ThirdPartyNotices.txt
dotnet.exe
dotnet-dev-certs.runtimeconfig.json
System.Buffers.dll
System.Numerics.Vectors.dll
Humanizer.dll
Microsoft.Build.Locator.dll
System.Collections.Immutable.dll
System.ValueTuple.dll
System.Collections.Immutable.dll
System.Memory.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Threading.Tasks.Extensions.dll
LICENSE.txt
Microsoft.SourceLink.Bitbucket.Git.targets
Microsoft.SourceLink.Common.props
Microsoft.SourceLink.GitHub.dll.config
testhost.net48.arm64.exe.config
Microsoft.DiaSymReader.Native.amd64.dll
20250116185642_ceb138a3b9764de794b35e04f8e7b395.trn
20250116185708_104da1c772f54955a840ef7956bd6c75.trn
20250116185708_5cd9980901c04f469d62bb4d1c05c1c1.trn
20250116185734_53180f02e88648df8b7dd19ea307e631.trn
20250116185734_d219669a349e4633addb7b60d4f1af63.trn
20250116185759_1918beb0b5114507bf1fc3b862353fba.trn
20250116185759_564e37041e124a618a33c94cc1f37530.trn
argv.json
optional.js
package.json
package.json
package.json
package.json
package.json
package.json
System.Diagnostics.EventLog.Messages.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Validation.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
Microsoft.VisualStudio.Validation.resources.dll
package.json
.vscodeignore.linux-x64
.gitignore
launch.json
tasks.json
SUPPORT.md
ThirdPartyNotices.txt
azure-pipeline.stable.yml
icon.png
extension-node.js
package.json
json.ts
tsconfig.json
types.js
index.js
nil.js
regex.js
validate.js
parse.js
v3.js
v5.js
md5-browser.js
nil.js
parse.js
sha1-browser.js
v3.js
v5.js
package.json
SECURITY.md
package.json
SECURITY.md
package.json
.obsolete
.obsolete
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json.vsctmp
extensions.json.vsctmp
package.nls.json
package.nls.json
package.nls.json
package.nls.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
9baaccc9-eccd-4e21-8ab1-9c443af309c5.tmp
f_000001
the-real-index
the-real-index
the-real-index
the-real-index~RFe5af137.TMP
Edge Profile.ico
data_0
data_1
data_2
data_3
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
CURRENT
CURRENT
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
20250116185330_c97bb05f39ee42088c2e2cf905f4b90f.jtrn
activity-stream.discovery_stream.json.tmp
45D2BCA059128F0CC470D173E39D9CE4BDA59A95
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
is-5P1Q6.tmp
is-O09UF.tmp
is-9RMPQ.tmp
is-J59LV.tmp
is-7F64A.tmp
is-G7DIR.tmp
devdeviceid.js
index.js
package.json
is-573K1.tmp
is-SRAC4.tmp
vscode-policy-watcher.node
index.js
package.json
rg.exe
spdlog.node
index.js
package.json
winregistry.node
index.js
package.json
bindings.js
package.json
index.js
package.json
is-EMG4M.tmp
is-1MA2P.tmp
is-B9G96.tmp
is-PDGJP.tmp
is-05A9D.tmp
is-T34HO.tmp
is-7RIHO.tmp
is-BBL9M.tmp
is-SUFUB.tmp
index.js
find-made.js
mkdirp-manual.js
mkdirp-native.js
opts-arg.js
path-arg.js
use-native.js
package.json
is-BK6OM.tmp
is-3VFAO.tmp
index.js
regex.js
rng.js
stringify.js
v1.js
validate.js
package.json
is-ELN50.tmp
is-ONEME.tmp
main.js
nls.messages.json
package.json
product.json
v8_context_snapshot.bin
vk_swiftshader.dll
Tmp9A11.tmp
__PSScriptPolicyTest_ansixtb3.x1q.ps1
VSCodeUserSetup-x64-1.96.3.tmp
tmpaddon
tmpaddon-1
f_000001
f_000003
f_000007
f_00000f
configuration.json
0469ccd2b2a1118a_0
c0f1ab47673ee020_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.user.cache
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe59ae76.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe58f298.TMP
the-real-index
the-real-index~RFe65020f.TMP
index
mscordaccore.dll
msquic.dll
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
settings.json.vsctmp
settings.json.vsctmp
a21f9507-e867-4421-8f67-8ba95a23f312.tmp
DotNetAcquisition-ms-dotnettools.vscode-dotnet-runtime-1737053331284.txt
DotNetAcquisition-ms-dotnettools.vscode-dotnet-runtime-1737053561622.txt
DotNetAcquisition-ms-dotnettools.vscode-dotnet-runtime-1737053820827.txt
default.dic
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
1ced32d74a95c7bc.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
66971856-2c6d-4d2b-a005-702484c590d1
9976e8a8-8525-4202-a8aa-c7d62920168c
b4e3a698-6464-427f-8115-da5be67d8b91
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
NuGet.Config
settings.json
940347bd-326b-4d91-8e2b-4264e4a2218b.tmp
MSI9F69.tmp
MSID10A.tmp
e5f95b5.msi
e5f95c2.msi
e5f95df.msi
e5f95ee.msi
e5f9643.msi
bg.png
dotnet-sdk-9.0.102-win-x64.exe
aspnetcore_targeting_pack_9.0.1_rtm.24610.9_win_x64.msi
memory/2120-5775-0x00007FFB76860000-0x00007FFB76861000-memory.dmp
memory/2120-5776-0x00007FFB77140000-0x00007FFB77141000-memory.dmp
memory/4880-1054-0x0000000000401000-0x00000000004B7000-memory.dmp
memory/4880-1052-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4880-1065-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4880-5793-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/4944-1091-0x0000000007340000-0x00000000073D6000-memory.dmp
memory/4944-1093-0x0000000007310000-0x0000000007332000-memory.dmp
memory/4944-1095-0x00000000085C0000-0x0000000008C3A000-memory.dmp
memory/4944-1094-0x0000000007990000-0x0000000007F36000-memory.dmp
memory/4944-1074-0x0000000004B50000-0x0000000004B86000-memory.dmp
memory/4944-1075-0x00000000053C0000-0x0000000005A8A000-memory.dmp
memory/4944-1076-0x0000000005310000-0x0000000005332000-memory.dmp
memory/4944-1077-0x0000000005A90000-0x0000000005AF6000-memory.dmp
memory/4944-1078-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/4944-1088-0x0000000005CE0000-0x0000000006037000-memory.dmp
memory/4944-1089-0x0000000006150000-0x000000000616E000-memory.dmp
memory/4944-1090-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/4944-1092-0x00000000072C0000-0x00000000072DA000-memory.dmp
memory/5916-1059-0x0000000000400000-0x000000000068E000-memory.dmp
memory/5916-1073-0x0000000000400000-0x000000000068E000-memory.dmp
memory/5916-1184-0x0000000000400000-0x000000000068E000-memory.dmp
memory/5916-5652-0x0000000000400000-0x000000000068E000-memory.dmp
memory/5916-5792-0x0000000000400000-0x000000000068E000-memory.dmp
memory/5916-1072-0x0000000000400000-0x000000000068E000-memory.dmp
memory/8296-17782-0x00007FF6AF110000-0x00007FF6AF137000-memory.dmp
memory/8832-17864-0x0000020D2D540000-0x0000020D2D541000-memory.dmp
memory/8832-17867-0x0000020D2D540000-0x0000020D2D541000-memory.dmp
memory/8832-17868-0x0000020D2D540000-0x0000020D2D541000-memory.dmp
memory/8832-17865-0x0000020D2D540000-0x0000020D2D541000-memory.dmp
memory/8832-17863-0x0000020D2D540000-0x0000020D2D541000-memory.dmp
memory/9456-17792-0x00007FF6AF110000-0x00007FF6AF137000-memory.dmp
memory/10484-15968-0x000002BFF1CB0000-0x000002BFF1CC2000-memory.dmp
memory/10484-15967-0x000002BFF19A0000-0x000002BFF19AA000-memory.dmp
memory/10484-15965-0x000002BFF2170000-0x000002BFF2916000-memory.dmp
memory/10648-12934-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12932-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12926-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12927-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12931-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12925-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12937-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12936-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12935-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10648-12933-0x000001EECCB00000-0x000001EECCB01000-memory.dmp
memory/10820-25061-0x00000299BCC60000-0x00000299BCCA2000-memory.dmp
memory/10820-25063-0x00000299BCC10000-0x00000299BCC18000-memory.dmp
memory/10820-25060-0x00000299BCBF0000-0x00000299BCC0A000-memory.dmp
memory/10820-25070-0x00000299BCC50000-0x00000299BCC5C000-memory.dmp
memory/10820-25062-0x00000299BCCE0000-0x00000299BCD06000-memory.dmp
memory/10820-25064-0x00000299BCF20000-0x00000299BCFD2000-memory.dmp
memory/10820-25069-0x00000299BCC40000-0x00000299BCC4A000-memory.dmp
memory/10820-25059-0x00000299A2C00000-0x00000299A2C28000-memory.dmp
memory/10820-25058-0x00000299A27D0000-0x00000299A2840000-memory.dmp
memory/11444-17771-0x00007FF738D60000-0x00007FF738D87000-memory.dmp
memory/12184-15789-0x0000013F41D60000-0x0000013F41DA4000-memory.dmp
memory/12184-15790-0x0000013F421F0000-0x0000013F42266000-memory.dmp
memory/12184-15779-0x0000013F41BC0000-0x0000013F41BE2000-memory.dmp