Analysis
- geolocation tags
- user interaction
yes - max time kernel
486s - max time network
487s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 14:28
General
- Target http://google.com
- Sample260416-rtatlaa12q
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 23 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 52 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x244,0x248,0x24c,0x240,0x218,0x7ff9ab8ec188,0x7ff9ab8ec194,0x7ff9ab8ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,16976911631761885122,16904457266611938400,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,6079182049668949012,2121277625627693464,262144 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,17188451069914823776,8112675907854418741,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10965042726397386154,1340739569054318481,2097152 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6320374029780064421,567477752797704383,2097152 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,4052304931317934728,5009709186589405070,2097152 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,1774826956588545303,6006269791176986799,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,3413486048127508660,5105581652437025053,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,10549204318656485217,8935760020247676287,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3248,i,15480521748592658229,8375883077104666924,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,49181287400679467,3882831560604905799,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,8302063635365755680,15827381910434724836,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15395173160406651988,12840752271148845333,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15395173160406651988,12840752271148845333,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18320101715164612062,3198718545153107717,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16249536202581980994,1727763412363016065,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4549575221360395687,9313090410441627629,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,11844460027440898630,13725422763032884586,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,12815580952540548203,4078791909638828633,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11328748649019705750,8190063393232746463,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,9518830645933068961,3072738273232830907,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3248,i,12405886338511770940,12650873207979348303,262144 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5769161254917288621,3370542424566756982,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,16293222772919102519,3901274223909891569,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,7160450624619581674,5463562336205646284,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8748277819894659971,9729303579744945144,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4706006509940783510,13655342124009642143,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,5673027651172166787,6745455435217757857,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12271876913199729360,12512453938542507867,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4897986832947754283,7641634357652589928,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7775428122878798374,5632057929146207826,524288 --field-trial-handle=2064,i,5999346968709223710,16462641103120315216,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9887cc728,0x7ff9887cc734,0x7ff9887cc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,12846292340186198218,17156744975193031446,262144 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,8700218717719688946,3698104390370132446,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2216 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,7931194368911856761,13330418176509832246,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2412 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3268,i,10836327504734285792,4143496435462563273,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,11366746625039142433,5196114473074137556,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3388 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,791509871627670026,1637211892018581380,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4284 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4652,i,4173423396399420334,16119835675451171500,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,123817853436369214,16380437590395455486,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5464 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5708,i,2846223820415616347,15803651669417285665,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,3275883447484522817,14639042994934809900,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5516 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3868,i,3393112089483139381,9969475185372625179,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4572 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5860,i,2729710259893923137,181170111511295030,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5792,i,17673530635990167753,646366493638580543,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3588 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,2155135667668692,12921747530164008358,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3444 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3456,i,1903842190825213345,4192727728645717495,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5740,i,8467931847814186766,9412024387479026574,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5796,i,63164419931346123,14056637400995704643,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=1276,i,9489218453477183598,1521544730785714551,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5864,i,15733048002697765307,16816329801044559420,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3588,i,6124754962699589478,14261470201858553949,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3628 /prefetch:122⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5996,i,7392531601735728119,4206733461299535841,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3364 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6200,i,5442739200841823097,5418467397253937474,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6368,i,9366143458854944271,10767384403282525050,262144 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6328 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,14864049944926256657,10636652639551261820,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6392 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.116.0.exe"C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.116.0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-VLN3Q.tmp\VSCodeUserSetup-x64-1.116.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-VLN3Q.tmp\VSCodeUserSetup-x64-1.116.0.tmp" /SL5="$B0104,156624778,841216,C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.116.0.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"4⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-AppxPackage -Name 'Microsoft.VisualStudioCode' | Select-Object -ExpandProperty PackageFullName"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-AppxPackage -Name 'Microsoft.VisualStudioCode' | Select-Object -ExpandProperty PackageFullName"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-AppxPackage -Path 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\appx\code_x64.appx' -ExternalLocation 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\appx'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\tools\inno_updater.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\tools\inno_updater.exe" "--gc" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "560a9dba96" "Code.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1788 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1976 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776349237590049 --launch-time-ticks=749714228 --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3240 --vscode-window-config=vscode:06e1e0b1-2d43-4d2b-9255-b38dee1d8186 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3436 /prefetch:145⤵
- Executes dropped EXE
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel status6⤵
- Executes dropped EXE
-
-
\??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe"c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\resources\app\node_modules\@vscode\vsce-sign\bin\vsce-sign.exe" verify --package c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\nilssoderman.batch-runner-1.4.0 --signaturearchive c:\Users\Admin\AppData\Roaming\Code\CachedExtensionVSIXs\nilssoderman.batch-runner-1.4.0.sigzip6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3432 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3468 /prefetch:145⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
-
C:\Windows\System32\wsl.exeC:\Windows\System32\wsl.exe --status5⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\560a9dba96\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1776349237590049 --launch-time-ticks=780841857 --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3972 --vscode-window-config=vscode:06e1e0b1-2d43-4d2b-9255-b38dee1d8186 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4308 /prefetch:105⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file --cors-schemes=vscode-webview,vscode-file --fetch-schemes=vscode-webview,vscode-file --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1792,i,4003512471160892358,1412949869054262336,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EnableTransparentHwndEnlargement,EstablishGpuChannelAsync --disable-features=CalculateNativeWinOcclusion,LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4268 /prefetch:145⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,12194277887810259966,15789503559382245293,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5804 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7152,i,18232929618422470889,17609942139929690993,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7184,i,2926875607454672795,765051037726840467,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7192,i,18025016306908398865,13768311468714920230,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6476,i,14238305329323830804,3359550567952215387,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7076,i,6370257907155841282,579106840586038083,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7136,i,8401386654104917834,13738876825847164119,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6292,i,7690344704228049792,14100300336014749080,2097152 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7616,i,3656019388496282239,5983447225607395983,524288 --field-trial-handle=1988,i,14230466851194669499,14554207973680455897,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7624 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
argv.json
package.json
extensions.json
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000007
f_00000e
f_000010
f_000011
f_000014
f_00001b
f_00001c
f_000036
f_00005c
f_000063
f_000075
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5f5349.TMP
5e09b4b53edb26a2_0
the-real-index
the-real-index~RFe5edbc7.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5e7f11.TMP
the-real-index
the-real-index
the-real-index~RFe58d31a.TMP
e1238f010e98a2c1_0
the-real-index
512.png
512.png
16.png
index.txt
index.txt
index.txt~RFe5a9154.TMP
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
powershell.exe.log
powershell.exe.log
97a134ab-c2d2-44e9-98f4-1824b7ebfa04.tmp
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
LOG.old
BrowsingTopicsState
the-real-index
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5ca187.TMP
index.txt
the-real-index
sync_diagnostic.log
CURRENT
MANIFEST-000001
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
is-PEDRK.tmp
is-JEFBC.tmp
is-Q0PPE.tmp
is-MD8TV.tmp
is-9DJD0.tmp
is-QHGQO.tmp
is-K86SQ.tmp
is-70RU0.tmp
is-3P5TB.tmp
is-1E2QB.tmp
is-QG7CJ.tmp
is-99L33.tmp
is-C4MI4.tmp
is-JJ7CJ.tmp
is-33J27.tmp
is-4HQR3.tmp
is-4IMBV.tmp
is-H02JS.tmp
is-IASI8.tmp
is-P1C78.tmp
is-PL9OD.tmp
is-S2OEU.tmp
is-SLQ6V.tmp
is-VTBGV.tmp
is-8B4GI.tmp
is-OCTQC.tmp
is-N1FAF.tmp
is-U4QCM.tmp
is-JOURV.tmp
is-DJ0M7.tmp
is-EME6H.tmp
is-FT6BN.tmp
is-0KF8I.tmp
is-RT0H4.tmp
is-98H0S.tmp
is-V57KG.tmp
is-9GI9H.tmp
is-UK6MB.tmp
is-44CVD.tmp
is-C5HO1.tmp
is-U5UJL.tmp
is-PQM6K.tmp
is-4MH0N.tmp
is-FRBK6.tmp
is-2S8KG.tmp
is-TPF1L.tmp
is-7TM6E.tmp
is-5SN64.tmp
is-4E18H.tmp
is-8KCK8.tmp
is-JQ7M6.tmp
is-F5F0L.tmp
is-5K7B6.tmp
is-6J6H2.tmp
is-GVJ1S.tmp
is-5A148.tmp
is-G2AIG.tmp
is-S070S.tmp
is-DGK8U.tmp
is-9D798.tmp
is-DM3FT.tmp
is-5SHJD.tmp
is-KJL7K.tmp
is-CRLPS.tmp
is-HA4SK.tmp
is-5E550.tmp
is-U07B5.tmp
is-2BLI9.tmp
is-BJD81.tmp
is-8PLF5.tmp
is-H9U5F.tmp
is-0RHR6.tmp
is-AUTD9.tmp
is-4F6NO.tmp
is-7P74B.tmp
inno_updater.exe
__PSScriptPolicyTest_lqsyqmhq.ckj.ps1
VSCodeUserSetup-x64-1.116.0.tmp
configuration.json
index
the-real-index
the-real-index
the-real-index
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe5ce47c.TMP
state.vscdb.backup
storage.json
storage.json
storage.json
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
state.json
state.vscdb
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
Download.htm
Download.htm:Zone.Identifier
VSCodeUserSetup-x64-1.116.0.exe:Zone.Identifier
manifest.json
manifest.json
manifest.json
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
edge_checkout_page_validator.js
manifest.json
memory/1164-16023-0x00000283F5690000-0x00000283F582A000-memory.dmp
memory/1508-14874-0x0000000000EE0000-0x0000000000F2A000-memory.dmp
memory/1508-1370-0x0000000000EE0000-0x0000000000F2A000-memory.dmp
memory/1508-10604-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-14731-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-14873-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-1304-0x0000000000EE0000-0x0000000000F2A000-memory.dmp
memory/1508-1303-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-14991-0x0000000000EE0000-0x0000000000F2A000-memory.dmp
memory/1508-1369-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-14990-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/1508-3613-0x00000000007A0000-0x0000000000B03000-memory.dmp
memory/2520-160-0x000001ABFC3B0000-0x000001ABFC54A000-memory.dmp
memory/2920-3570-0x00000000013D0000-0x000000000144B000-memory.dmp
memory/3276-6237-0x0000024AD1720000-0x0000024AD18BA000-memory.dmp
memory/3296-14809-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14808-0x000001931A1B0000-0x000001931A1C0000-memory.dmp
memory/3296-14862-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14806-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14811-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14807-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14860-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14812-0x00007FF978D30000-0x00007FF978D40000-memory.dmp
memory/3296-14864-0x000001935A1C0000-0x000001935A35A000-memory.dmp
memory/3296-14861-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14863-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3296-14813-0x000001931A1F0000-0x000001931A200000-memory.dmp
memory/3296-14814-0x00007FF978D30000-0x00007FF978D40000-memory.dmp
memory/3296-14805-0x00007FF97A830000-0x00007FF97A840000-memory.dmp
memory/3852-16017-0x0000012775710000-0x00000127758AA000-memory.dmp
memory/3920-1324-0x0000000005740000-0x00000000057A6000-memory.dmp
memory/3920-1344-0x00000000062F0000-0x000000000630A000-memory.dmp
memory/3920-1322-0x0000000004FF0000-0x000000000561A000-memory.dmp
memory/3920-1325-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/3920-1321-0x0000000004880000-0x00000000048B6000-memory.dmp
memory/3920-1332-0x0000000005950000-0x0000000005CA7000-memory.dmp
memory/3920-1333-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/3920-1334-0x0000000005E30000-0x0000000005E7C000-memory.dmp
memory/3920-1343-0x0000000006DC0000-0x0000000006E56000-memory.dmp
memory/3920-1323-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/3920-1345-0x0000000006350000-0x0000000006372000-memory.dmp
memory/3920-1346-0x0000000007410000-0x00000000079B6000-memory.dmp
memory/3920-1350-0x0000000004E10000-0x0000000004ED1000-memory.dmp
memory/3920-1347-0x0000000008040000-0x00000000086BA000-memory.dmp
memory/4756-14994-0x0000000000520000-0x00000000005FC000-memory.dmp
memory/4756-1302-0x0000000001580000-0x00000000015FB000-memory.dmp
memory/4756-1301-0x0000000000520000-0x00000000005FC000-memory.dmp
memory/4756-1219-0x0000000000520000-0x00000000005FC000-memory.dmp
memory/4756-14995-0x0000000001580000-0x00000000015FB000-memory.dmp
memory/5484-676-0x000001CB6D490000-0x000001CB6D62A000-memory.dmp
memory/5576-16425-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16431-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16430-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16429-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16428-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16426-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16427-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16432-0x0000014DAD050000-0x0000014DAD1EA000-memory.dmp
memory/5576-16419-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16420-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/5576-16421-0x0000014DAFC30000-0x0000014DAFC31000-memory.dmp
memory/6172-14843-0x0000000001250000-0x00000000012CB000-memory.dmp
memory/6392-14952-0x00007FF9BA2E0000-0x00007FF9BA2E1000-memory.dmp
memory/6392-14953-0x00007FF9B92F0000-0x00007FF9B92F1000-memory.dmp
memory/6444-15139-0x00000178C30B0000-0x00000178C324A000-memory.dmp
memory/6500-14751-0x00000176FB1E0000-0x00000176FB202000-memory.dmp
memory/6500-14765-0x00000176FB2A0000-0x00000176FB2BC000-memory.dmp
memory/6500-14766-0x00000176FB520000-0x00000176FB5D3000-memory.dmp
memory/6500-14767-0x00000176FB2E0000-0x00000176FB2FC000-memory.dmp
memory/6500-14768-0x00000176FB2A0000-0x00000176FB2AA000-memory.dmp
memory/6500-14769-0x00000176FB750000-0x00000176FB776000-memory.dmp
memory/6500-14772-0x00000176F91B0000-0x00000176F934A000-memory.dmp
memory/6500-14773-0x00000176FB010000-0x00000176FB022000-memory.dmp
memory/6620-16022-0x00000354F0250000-0x00000354F03EA000-memory.dmp
memory/6620-16461-0x00000354F0250000-0x00000354F03EA000-memory.dmp
memory/6776-14804-0x00000000060C0000-0x000000000610C000-memory.dmp
memory/6776-14823-0x0000000007210000-0x000000000722E000-memory.dmp
memory/6776-14802-0x0000000005910000-0x0000000005C67000-memory.dmp
memory/6776-14833-0x0000000005DA0000-0x0000000005E61000-memory.dmp
memory/6776-14815-0x00000000071D0000-0x0000000007204000-memory.dmp
memory/6776-14827-0x0000000007220000-0x000000000722A000-memory.dmp
memory/6776-14816-0x000000006F290000-0x000000006F2DC000-memory.dmp
memory/6776-14826-0x0000000007570000-0x000000000758C000-memory.dmp
memory/6776-14824-0x0000000007230000-0x00000000072D4000-memory.dmp
memory/6856-14794-0x000002547EAE0000-0x000002547EAF2000-memory.dmp
memory/6908-16021-0x0000021DF0540000-0x0000021DF06DA000-memory.dmp
memory/6908-16460-0x0000021DF0540000-0x0000021DF06DA000-memory.dmp
memory/6936-16324-0x00000261BEF40000-0x00000261BF0DA000-memory.dmp
memory/6936-16009-0x00000261BEF40000-0x00000261BF0DA000-memory.dmp
memory/7044-16458-0x000002DD49C30000-0x000002DD49DCA000-memory.dmp
memory/7044-16018-0x000002DD49C30000-0x000002DD49DCA000-memory.dmp