Analysis
- user interaction
yes - max time kernel
386s - max time network
397s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 15:55
General
- Target QoderSetup-x64.exe
- Size 188.0MB
- Sample260809-tc28matyat
- SHA256 342dd1a5fd980cba5396322b396c0248f8b0d1d6f3fd46354520ca908d27e464
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 15 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
- Looks for VMWare Tools registry key 2 TTPs 3 IoCs
- Looks for VMWare services registry key. 1 TTPs 9 IoCs
- Looks for Xen service registry key. 1 TTPs 15 IoCs
- Uses browser remote debugging 2 TTPs 7 IoCs
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 35 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Modifies file permissions 1 TTPs 1 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Drops desktop.ini file(s) 8 IoCs
- Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry 3 TTPs 12 IoCs
Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 39 IoCs
Looks up country code configured in the registry, likely geofence.
- Discovers running processes 1 TTPs 4 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 21 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EAB79.tmp\QoderSetup-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-EAB79.tmp\QoderSetup-x64.tmp" /SL5="$70226,195856638,916992,C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Program Files\Qoder\bin\qoder-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\Qoder" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX"3⤵
- Modifies file permissions
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1728 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1884 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3440 --vscode-window-config=vscode:160c8e8b-7804-4d15-86d7-5f928b450b35 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache4⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache5⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops desktop.ini file(s)
- Enumerates connected drives
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion6⤵
-
-
C:\Windows\system32\sc.exesc query6⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api6⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log6⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch6⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch6⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"6⤵
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"6⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent6⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service6⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service6⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService6⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exeC:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exe5⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache5⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops desktop.ini file(s)
- Enumerates connected drives
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion6⤵
-
-
C:\Windows\system32\sc.exesc query6⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api6⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion6⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM6⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"6⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"6⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"6⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service6⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service6⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService6⤵
- Launches sc.exe
-
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3980 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4000 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4112 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" "c:\Program Files\Qoder\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=58925⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4248 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops desktop.ini file(s)
- Enumerates connected drives
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4324 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4300 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4712 --vscode-window-config=vscode:11fe8f50-9f51-4dd0-9e05-5469c14b3cd9 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.qoder.com/device/selectAccounts?nonce=48173fe28d744da281190f9dadb751c8&challenge=OJjg5wNEffNrbbePWinMoAKAn30rdN9TwcX2euwMUhA&challenge_method=S256&redirect_uri=qoder://aicoding.aicoding-agent/login-success4⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x338,0x7ffabbefc188,0x7ffabbefc194,0x7ffabbefc1a05⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,16169056509682885167,9799824112093123875,262144 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,12069238294462075355,12462461945181312980,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,6296135234367740463,18029508579349654735,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,6669957461935731204,9067441080947167796,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,6356402972372738364,18428790049830916202,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,2361953913409040237,13904002303971175489,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,9109643705198929144,1691162644396010639,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,5166086592229738937,4744384496716732984,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,18338043038932941098,868722948897924123,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,13442445577727746419,18218922157034670976,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4897879676636330474,12642379096147749325,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,17080694894373891193,505847581155520827,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,672585136573745569,10477051574197838755,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,672585136573745569,10477051574197838755,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12625691531794809232,4175135809315087362,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,318349750229105825,79267534454992076,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,13003402527745624616,3049710549516738572,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,16023819115501741382,14379835430695954416,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16844225709001107865,3455167061829199904,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14878193193022997703,6342744969989988531,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,3775238628682595438,12932901302542079730,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,10588554253813309888,945818494760824831,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1181327598305747544,9399790584288597853,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,8643164109146571143,1268433481810051932,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,1053132854377555921,6839123384634678519,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=872,i,2445453182556513589,3334750261520297687,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,17174975144091292585,12761499390282143817,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5588,i,15073910190380823779,18186260013352729218,262144 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,3447311264720439482,9111496454595232763,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16253834668160345390,6906645508611107217,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,14132938019771684996,10201658204061695789,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14823648751108833644,8186242908489469878,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,8737519438323040237,13357740472657398417,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,16933275430221793837,6953184999904934526,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5328,i,6944961635494824653,14260732348893485469,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7748,i,5759999037048349601,3442431941653482363,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:15⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --open-url -- "qoder://aicoding.aicoding-agent/login-success?auth=%252AV%2540COVMKM%2523M%2526%252AGoKbNOJKDoByB%252ABrBOQiuSa%252Al%252AKcu%2528ihDxB%2526BEw%2524MKM%2523M%2526%252AGoKiPSp%252Al%252ABfV%2540LOD%2540NwVow.%2523OB%2525G%2540JLDRztlSVk%2523%252Cw.V%2540KmYK.PSp%252Al%252ABfV%2540LOD%2540NwVow.%2523OB%2525G%2540JLDRztlSVk%2523%252Cw.V%2540K%252AV%2540COV&nonce=a1a9859f56814ea397092c1442c43456&tokenString=a%2528fYV.Di%2540RVcV%2540NIlR%2526IV%255EVfj%2540BfV_%2524%2524%2523On%2525oOCYJo.VFFLzCOIQ%2540%2528gVFaQS%2540RFrDZptNSDQ%2523SCTpwL%255EaSNYmRjdNggwD%2528.a"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4b0,0x4b4,0x4b8,0x4ac,0x4bc,0x7ff66f8c219c,0x7ff66f8c21a8,0x7ff66f8c21b86⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,5417646464698382053,969013745390008671,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1900,i,13877711156400399251,11304908933303758022,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1892 /prefetch:26⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1896,i,5417646464698382053,969013745390008671,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1900,i,13877711156400399251,11304908933303758022,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1932 /prefetch:36⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7616,i,12052789851662913052,2422347640155989518,2097152 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:15⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --open-url -- "qoder://aicoding.aicoding-agent/login-success?auth=%252AV%2540COVMKM%2523M%2526%252AGoKbNOJKDoByB%252ABrBOQiuSa%252Al%252AKcu%2528ihDxB%2526BEw%2524MKM%2523M%2526%252AGoKiPSp%252Al%252ABfV%2540LOD%2540NwVow.%2523OB%2525G%2540JLDRztlSVk%2523%252Cw.V%2540KmYK.PSp%252Al%252ABfV%2540LOD%2540NwVow.%2523OB%2525G%2540JLDRztlSVk%2523%252Cw.V%2540K%252AV%2540COV&nonce=a1a9859f56814ea397092c1442c43456&tokenString=a%2528fYV.Di%2540RVcV%2540NIlR%2526IV%255EV%2525lRp.V%2526%2524%2524%2523On%2525oOCYJo.VFFLzCOIQ%2540%2528gVFaQS%2540RFrDZptNSDQ%2523SCTpwL%255EaSNYmRjdNggwD%2528.a"5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4b0,0x4b4,0x4b8,0x4ac,0x4bc,0x7ff66f8c219c,0x7ff66f8c21a8,0x7ff66f8c21b86⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1872,i,11065806396331199638,12145848547005921388,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,11936076559472499125,11359590435953654515,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1904 /prefetch:36⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,11065806396331199638,12145848547005921388,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,11936076559472499125,11359590435953654515,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:26⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7684,i,4247008809891830789,2107774807693952381,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,14456332946377760817,764826239748016263,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8072,i,10127271268305111394,10765374833625773712,524288 --field-trial-handle=2264,i,17025392574431764320,13863964082381751835,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:85⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4868 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3976 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q5⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5024 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5304 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5040 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5256 --vscode-window-config=vscode:abca1717-e953-454c-8f90-00659fb4930e /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=5268 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5324 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" "c:\Program Files\Qoder\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=52965⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=5420 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q5⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=5840 --vscode-window-config=vscode:c5e78fb3-9dc1-4879-b7cb-0c41f37bdf22 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=5604 --vscode-window-config=vscode:cecae73a-1f57-4328-8a6b-40ad8989e678 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=3996 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=5840 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1736,i,5056104067589452373,7354643838254562189,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,14453971175001610499,6120378470732091690,4 --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=4100 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 2652" /NH"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 2652" /NH5⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /T /F /PID 2652"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /T /F /PID 26525⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x49c1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4e4,0x4e8,0x4ec,0x4e0,0x4f0,0x7ff66f8c219c,0x7ff66f8c21a8,0x7ff66f8c21b82⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,14187849105224580401,14925508350747792613,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1772,i,14700607579361169765,18402481754233928918,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1756 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,14187849105224580401,14925508350747792613,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1772,i,14700607579361169765,18402481754233928918,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2000 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4bc,0x4c0,0x4c4,0x4b8,0x4c8,0x7ff66f8c219c,0x7ff66f8c21a8,0x7ff66f8c21b82⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1864 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786290467077986 --launch-time-ticks=806139376 --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3472 --vscode-window-config=vscode:2f825f16-4e6e-40d8-9dbc-3221c0859ef1 /prefetch:12⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 2652" /NH"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 2652" /NH3⤵
- Discovers running processes
-
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache2⤵
- Enumerates connected drives
- Executes dropped EXE
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache3⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion4⤵
-
-
C:\Windows\system32\sc.exesc query4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api4⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion4⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log4⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"4⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service4⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service4⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exeC:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exe3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4044 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4060 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4028 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4204 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4332 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4352 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.qoder.com/device/selectAccounts?nonce=a1a9859f56814ea397092c1442c43456&challenge=1Sr3NfkR01-d_PNBj-c3AJ7bjntV1strheNendZwAbg&challenge_method=S256&redirect_uri=qoder://aicoding.aicoding-agent/login-success&machine_id=P1gAfxwpbF5JaiplGyYNfaf9Wwh89iu17CdyQhyNr8IXDWtRAu7wzSCy5lRugd55TBaq7xYXEmPkRA3FvU5YR6T52⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1824,i,9972104936719026685,4311457459636646032,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,13816383234179020931,1185546582375040909,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3804 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3640" /NH"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 3640" /NH3⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /T /F /PID 3640"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /T /F /PID 36403⤵
- Kills process with taskkill
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff66f8c219c,0x7ff66f8c21a8,0x7ff66f8c21b82⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1928 /prefetch:32⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1888 /prefetch:22⤵
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786290467077985 --launch-time-ticks=866433745 --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3492 --vscode-window-config=vscode:011df65e-045d-40e0-919b-64ca4bdb3a76 /prefetch:12⤵
- Uses browser remote debugging
- Checks computer location settings
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3640" /NH"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 3640" /NH3⤵
- Discovers running processes
-
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache2⤵
- Enumerates connected drives
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache3⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"4⤵
-
-
C:\Windows\system32\sc.exesc query4⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version4⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api4⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log4⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"4⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service4⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service4⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService4⤵
- Launches sc.exe
-
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3964 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4000 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4088 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4316 /prefetch:82⤵
- Checks computer location settings
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4364 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1892,i,724485717343255684,9569684374554250339,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1896,i,3763394760176296956,3101341504822221103,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4352 /prefetch:82⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Authentication Process
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
8Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
3Process Discovery
1Query Registry
15System Information Discovery
10System Location Discovery
1System Language Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
8Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
chrome_200_percent.pak
icudtl.dat
en-US.pak
resources.pak
is-672S7.tmp
is-RVN5C.tmp
is-SKINL.tmp
is-O5S1U.tmp
featureFlags.json
is-860MJ.tmp
is-ECKLO.tmp
is-2F7U8.tmp
is-QS801.tmp
is-41E45.tmp
is-NRQPN.tmp
is-JPVV0.tmp
is-3VAQ8.tmp
is-T281D.tmp
is-JNSU9.tmp
is-TT1KM.tmp
is-R2Q6Q.tmp
is-7VJML.tmp
is-COV8L.tmp
is-QUUTE.tmp
is-1RQVE.tmp
is-39KAT.tmp
is-4O1E8.tmp
is-FELIC.tmp
is-DR8TM.tmp
is-3LH3C.tmp
is-FMH34.tmp
is-N7NQT.tmp
is-P81HD.tmp
is-17KI4.tmp
is-8UP0L.tmp
is-MCBSG.tmp
is-MLCN3.tmp
is-RFFA4.tmp
is-1368E.tmp
is-63P85.tmp
is-MP3H3.tmp
is-TJBU5.tmp
is-A6V4D.tmp
is-05DTE.tmp
is-EOF50.tmp
is-136PO.tmp
is-DFO9M.tmp
is-ICJSU.tmp
is-USGPN.tmp
is-172AS.tmp
is-MTV7I.tmp
is-O3EV7.tmp
is-5QEG7.tmp
is-TV61I.tmp
is-HHV7A.tmp
is-703QE.tmp
is-IRPTP.tmp
is-IJRL1.tmp
is-LLIU3.tmp
is-LA2MJ.tmp
is-IO0F0.tmp
is-NLC34.tmp
is-A3GC8.tmp
is-2L022.tmp
is-0HHN3.tmp
is-E4RO4.tmp
api.js
cancellation.js
connection.js
disposable.js
events.js
is.js
linkedMap.js
messageBuffer.js
messageReader.js
messageWriter.js
messages.js
ral.js
semaphore.js
sharedArrayCancellation.js
main.js
ril.js
node.js
package.json
buffer-util.js
constants.js
event-target.js
extension.js
limiter.js
permessage-deflate.js
receiver.js
sender.js
stream.js
subprotocol.js
validation.js
websocket-server.js
websocket.js
package.json
wrapper.mjs
canvas-sdk.js
canvasInject.js
index-canvas.html
main.js
nls.messages.json
package.json
product.json
v8_context_snapshot.bin
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
argv.json
canvas-sdk-version
index.canvas.tsx
index.mjs
code-review.recipe.md
design-system.recipe.md
format-viewer.recipe.md
index.md
presentation.recipe.md
report.recipe.md
sequence-diagram.recipe.md
README.md
canary.d.ts
compiler-runtime.d.ts
experimental.d.ts
global.d.ts
index.d.ts
jsx-dev-runtime.d.ts
jsx-runtime.d.ts
package.json
canvas-tokens.d.ts
chart-primitives.d.ts
index.d.ts
index.d.ts
index.d.ts
code-view.d.ts
core-primitives.d.ts
force-graph-layout.d.ts
format-viewer.d.ts
hooks.d.ts
index.d.ts
palettes.d.ts
patterns.d.ts
presentation.d.ts
report-primitives.d.ts
_version_info.pyi
WHEEL
WHEEL
LICENSE
urls.pyi
ntpath.pyi
bcppcompiler.pyi
errors.pyi
msvccompiler.pyi
unixccompiler.pyi
posixpath.pyi
nodes.pyi
CGIHTTPServer.pyi
__init__.py
grammar311.txt
LICENSE
WHEEL
cp1250.pyi
cp850.pyi
cp950.pyi
INSTALLER
WHEEL
package.json
extensions.json
extensions.json.vsctmp
package.nls.json
plugin.json
README.md
logo.svg
agents-md-good-examples.md
SKILL.md
openai.yaml
SKILL.md
openai.yaml
factory-readiness.md
design-md-complete-example.md
project-capability-artifact-examples.md
qoder.md
ARCHITECTURE.md
community.md
concepts.md
blast-radius.mjs
analysis.mjs
config.mjs
core.mjs
git.mjs
graph.mjs
hook.mjs
go.mjs
index.mjs
javascript-like.mjs
python.mjs
parser.mjs
utils.mjs
commit-count.mjs
mapping-gate.mjs
core.mjs
policy.mjs
go.mjs
index.mjs
java.mjs
python.mjs
hooks.json.template
README.md
agent-work-loop-rationale.md
agent-work-loop.md
harness-engineering.md
routing.md
software-fluency.md
package.json
plugin.json
README.md
README.md
agent-hooks.md
agents-md-review.md
custom-agents-review.md
global-assets.md
hooks-review.md
knowledge-assets-review.md
mcp-review.md
memory-review.md
codex.md
qoder.md
routing.md
skill-discovery.md
skill-review.md
README.md
automation-readiness.md
demand-source-analysis.md
learning-loop-patterns.md
loop-discovery.md
loop-primitives.md
loop-spec-card.md
loop-state-ledger.md
README.md
event-response.md
goal-completion.md
proactive-discovery.md
scheduled-inspection.md
system-improvement.md
README.md
core-change-watch.md
design-md-contract.md
friendly-cli.md
git-hooks.md
observability.md
project-overlays.md
recovery-evidence.md
review-trigger.md
sensitive-code.md
README.md
session-insights-report.md
session-skill-evaluation.md
session-usage-efficiency.md
sessions-diagnostics.md
node-runtime-discovery.md
cli.mjs
constants.mjs
items.mjs
index.mjs
inventory.mjs
codex.mjs
cursor.mjs
index.mjs
qoder.mjs
storage.mjs
install-secret-guard.mjs
platforms.mjs
secret-scan.mjs
cli.mjs
hook-review.mjs
host-instructions.mjs
index.mjs
cli.mjs
cli.mjs
format.mjs
output.mjs
registry.mjs
schema.mjs
better-harness.mjs
analyze.mjs
cli.mjs
count-file.mjs
file-list.mjs
languages.generated.mjs
scanners.mjs
worker.mjs
asset-baseline.mjs
index.mjs
asset-integrity.mjs
checkup.mjs
apply.mjs
cli.mjs
contract.mjs
friction.mjs
plan.mjs
scan.mjs
sources.mjs
inventory.mjs
memory-details.mjs
change-drift.mjs
common.mjs
core-candidates.mjs
diff-impact.mjs
evidence-pack.mjs
git-history-profile.mjs
project-profile.mjs
qoder-consistency-schema.mjs
cli.mjs
doc-link-graph.mjs
findings-recommend.json
findings-recommend.mjs
ai-fix-prompt.mjs
apply-source-review.mjs
canvas-module-boundaries.mjs
canvas-preview-server.mjs
episode-evidence-review.mjs
evidence-brief.mjs
agent-customize.mjs
cli.mjs
contract.mjs
index.mjs
project-harness.mjs
session-evidence.mjs
fluency-dimensions.mjs
intervention-ledger.mjs
learning-capture-evidence.mjs
learning-capture-state.mjs
learning-loop-candidates.mjs
learning-loop-contract.mjs
memory-details-contract.mjs
practice-findings.mjs
canvas-runtime.mjs
canvas-transform.mjs
platform.mjs
record-fix-output.mjs
render-report.mjs
html.mjs
markdown.mjs
qoder-canvas.mjs
qoder-harness.mjs
repair-findings-json.mjs
report-data-schema.mjs
report-quality.mjs
report-review-packet.mjs
report-run.mjs
report-source.mjs
run-dir.mjs
score-finding-consistency.mjs
session-skill-pattern.mjs
skill-pattern-record.mjs
task-loop-report.mjs
task-loop-repository-evidence.mjs
task-loop-source.mjs
validate-canvas.mjs
workflow-demand-diagnostics.mjs
cli.mjs
archive-markdown-links.mjs
create-bundle.mjs
verify-pack.mjs
cli.mjs
index.mjs
usage-analysis.md
usage.mjs
cli.mjs
session-analysis.mjs
benchmark-sessions.mjs
claude-facets.mjs
cli.mjs
codex-json-model.mjs
daily-usage.mjs
episode-contract.mjs
episode-facts.mjs
file-reads.mjs
fs.mjs
ids.mjs
insights.mjs
lifecycle-demand-signals.mjs
long-sessions.mjs
model-pricing.mjs
observation-manifest.mjs
paths.mjs
planning-signals.mjs
claude.mjs
codex.mjs
cursor.mjs
qoder.mjs
privacy-safe-text.mjs
provider-runner.mjs
result-facts.mjs
selection-plan.mjs
selection-profile.mjs
selection.mjs
semantic-facets.mjs
session-core-facts.mjs
session-efficiency.mjs
session-ref.mjs
time.mjs
tool-semantics.mjs
usage-review-packet.mjs
usage-semantic-review.mjs
usage-summary.mjs
validate-usage-report.mjs
SKILL.md
agent-customize.md
asset-demand-reconciliation.md
finding-bound-fix.md
findings-review.md
project-harness.md
session-evidence.md
session-repeated-workflows.md
session-skill-pattern-discovery.md
support-bootstrap.md
support-operationalize.md
support-optimize.md
qoder-harness-insights.canvas.tsx
harness-findings.input.json
html-visual.md
project-traits.md
qoder-canvas.md
report-structure.md
routing.md
analyst.md
audit-scorecard.md
consulting-deck.md
editorial-insight.md
engineering-diagnosis.md
executive-dashboard.md
routing.md
transformation-playbook.md
mcp.json
plugin.json
plugin.json
SKILL.md
qoder-components.md
qoder-plugin-manifest.md
source-resolution.md
validation-and-packaging.md
validate_qoder_plugin.py
plugin.json
qoder-hooks.json
README.md
logo.svg
bootstrap.cmd
bootstrap.sh
qodersec-launch.cmd
qodersec-launch.sh
security-scan-settings.cmd
security-scan-settings.sh
config.yaml.example
package.json
plugin.json
postinstall.sh
security-patterns.yaml.example
SKILL.md
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
protocols.json
CrashpadMetrics-active.pma
c33fe211-7370-4565-b3a9-66863387c623.dmp
settings.dat
settings.dat
LOG.old
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009d
f_00009e
f_00009f
f_0000b1
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a2bb5.TMP
Edge Profile.ico
000005.ldb
CURRENT
LOG.old
LOG.old
LOG.old
LOG.old~RFe5ce334.TMP
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5e5755.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a8704.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe5ceda3.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
ee5c5cc2-3a50-46e1-9d7d-dcfb064b8e61.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
4b4aabd5-b691-4219-937b-b9ab0a4139c5.tmp
89367db2-73d4-4ba6-b95b-846210531737.tmp
__PSScriptPolicyTest_kjwkb2cu.ifn.ps1
bac3c7c0-0784-4edb-ba9f-64f555765f0f.tmp
QoderSetup-x64.tmp
content_new.js
default.dic
b73f8760642355ab.customDestinations-ms
b73f8760642355ab.customDestinations-ms
b73f8760642355ab.customDestinations-ms
b73f8760642355ab.customDestinations-ms
b73f8760642355ab.customDestinations-ms
3dc48af2-e74e-4e43-8e1c-1b5c19eafae2.tmp
configuration.json
2ebc20bd638a3b5d_0
50cf61725fbac5e4_0
77e5f7be53d2cc44_0
961f4b5cc3413a06_0
979804b2b0320f98_0
97a7c7f4181daf29_0
c54ec04c00ade833_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index
detachhead.basedpyright-1.31.6
ms-python.autopep8-2025.2.0
ms-python.python-2025.16.0-win32-x64
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.user.cache
settings.dat
index
index
index
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
bda4fc7b-5917-4c6d-b7a4-0b160331e3e3.tmp
MANIFEST-000001
app-config.json
app-config.json
mcp.json
agents-window.code-workspace
app.json
app.json
state.vscdb
state.vscdb
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
settings.json
settings.json
settings.json.vsctmp
state.vscdb
state.json
state.vscdb
state.json
state.json
state.json
state.json
state.vscdb
state.vscdb
state.vscdb
state.vscdb
languagepacks.json
memory/1136-20531-0x00007FFAB44E0000-0x00007FFAB5607000-memory.dmp
memory/1192-8-0x0000000002CA0000-0x0000000002CD6000-memory.dmp
memory/1192-11-0x0000000005BA0000-0x0000000005C06000-memory.dmp
memory/1192-30-0x00000000086C0000-0x0000000008D3A000-memory.dmp
memory/1192-10-0x00000000053B0000-0x00000000053D2000-memory.dmp
memory/1192-9-0x0000000005400000-0x0000000005A28000-memory.dmp
memory/1192-12-0x0000000005C10000-0x0000000005C76000-memory.dmp
memory/1192-20-0x0000000005D80000-0x00000000060D4000-memory.dmp
memory/1192-22-0x0000000006260000-0x000000000627E000-memory.dmp
memory/1192-23-0x0000000006600000-0x000000000664C000-memory.dmp
memory/1192-28-0x0000000006790000-0x00000000067B2000-memory.dmp
memory/1192-26-0x0000000007440000-0x00000000074D6000-memory.dmp
memory/1192-7-0x0000000004DC0000-0x0000000004DD0000-memory.dmp
memory/1192-27-0x0000000006740000-0x000000000675A000-memory.dmp
memory/1192-29-0x0000000007A90000-0x0000000008034000-memory.dmp
memory/1540-25-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/1540-21-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/1540-7833-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/1540-3933-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/1540-5-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/1540-9637-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/1540-9686-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/1540-61-0x0000000000C50000-0x0000000000FC5000-memory.dmp
memory/2400-20682-0x000002A6D7310000-0x000002A6D7A4F000-memory.dmp
memory/3832-24-0x00000000007D0000-0x00000000008BE000-memory.dmp
memory/3832-0-0x00000000007D0000-0x00000000008BE000-memory.dmp
memory/3832-9703-0x00000000007D0000-0x00000000008BE000-memory.dmp
memory/4504-10632-0x00007FFABE7A0000-0x00007FFABF8C7000-memory.dmp
memory/4632-11882-0x000002091E170000-0x000002091E8AF000-memory.dmp
memory/5828-11666-0x00007FFABE7A0000-0x00007FFABF8C7000-memory.dmp
memory/5900-23744-0x0000021F7BA60000-0x0000021F7C19F000-memory.dmp
memory/6088-10853-0x000001DCF4A50000-0x000001DCF518F000-memory.dmp
memory/6088-10544-0x00007FFADEDD0000-0x00007FFADEDD1000-memory.dmp
memory/6088-10543-0x00007FFADF1A0000-0x00007FFADF1A1000-memory.dmp
memory/6616-18083-0x00007FFAB48A0000-0x00007FFAB59C7000-memory.dmp
memory/7060-19511-0x00000284555E0000-0x0000028455D1F000-memory.dmp
memory/7724-14300-0x00007FFABE7A0000-0x00007FFABF8C7000-memory.dmp
memory/8064-23543-0x00007FFAB44E0000-0x00007FFAB5607000-memory.dmp
memory/9620-18192-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18181-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18188-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18189-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18190-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18191-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18187-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18183-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18193-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9620-18182-0x000001E818050000-0x000001E818051000-memory.dmp
memory/9872-19279-0x0000020A08F20000-0x0000020A0965F000-memory.dmp
memory/11292-18346-0x00007FFAB48A0000-0x00007FFAB59C7000-memory.dmp
memory/11540-17960-0x00007FFAB48A0000-0x00007FFAB59C7000-memory.dmp
memory/11712-19328-0x0000015DDD170000-0x0000015DDD8AF000-memory.dmp