Analysis
- user interaction
yes - max time kernel
486s - max time network
501s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
13/08/2026, 16:10
General
- Target QoderSetup-x64.exe
- Size 188.0MB
- Sample260813-tmrvmstdre
- SHA256 342dd1a5fd980cba5396322b396c0248f8b0d1d6f3fd46354520ca908d27e464
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Identifies Xen via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 6 IoCs
- Looks for Xen service registry key. 1 TTPs 10 IoCs
- Uses browser remote debugging 2 TTPs 5 IoCs
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 26 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Modifies file permissions 1 TTPs 2 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Drops desktop.ini file(s) 6 IoCs
- Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry 3 TTPs 8 IoCs
Disk information is often read in order to detect sandboxing environments.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 31 IoCs
Looks up country code configured in the registry, likely geofence.
- Discovers running processes 1 TTPs 4 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 29 IoCs
- Executes dropped EXE 61 IoCs
- Launches sc.exe 60 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 23 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Kills process with taskkill 2 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SP3EF.tmp\QoderSetup-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-SP3EF.tmp\QoderSetup-x64.tmp" /SL5="$701F0,195856638,916992,C:\Users\Admin\AppData\Local\Temp\QoderSetup-x64.exe"2⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Program Files\Qoder\bin\qoder-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\Qoder" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX"3⤵
- Modifies file permissions
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1744 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2012 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786637443902783 --launch-time-ticks=582206041 --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3416 --vscode-window-config=vscode:fcf54f10-6630-4858-ba3f-854cee598a95 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache4⤵
- Enumerates connected drives
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache5⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops desktop.ini file(s)
- Enumerates connected drives
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc query6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion6⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log6⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion6⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch6⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"6⤵
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion6⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"6⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service6⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM6⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service6⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService6⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exeC:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exe5⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3984 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4012 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4100 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" "c:\Program Files\Qoder\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=37365⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4176 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Xen via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Drops desktop.ini file(s)
- Enumerates connected drives
- Maps connected drives based on registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info"6⤵
- Executes a command shell one-liner
-
\??\c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"c:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info7⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"8⤵
-
-
C:\Windows\system32\sc.exesc query8⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api8⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log8⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM8⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch8⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion8⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"8⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"8⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service8⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM8⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service8⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService8⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4284 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4308 /prefetch:84⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q5⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1786637443902783 --launch-time-ticks=602025525 --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4704 --vscode-window-config=vscode:94ea0f2e-e07c-442f-a21a-4d6fd12464f9 /prefetch:14⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.qoder.com/device/selectAccounts?nonce=ba11e96edd484779bf315f8502c82997&challenge=R5SPCOwEYQ7Z2ATuSeGT9CN9FC4DxHF3XWiNoZAvKxc&challenge_method=S256&redirect_uri=qoder://aicoding.aicoding-agent/login-success&machine_id=P1gAiwxr2il-Q9z_tgouW6BOPZomGMbCRJUoi8Fa4AvR9uWs78CBu97DriyvbcL7ReojaztcQLx8Grz9kVC6qzld4⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x350,0x7ffc9ff6c188,0x7ffc9ff6c194,0x7ffc9ff6c1a05⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=29446296813744 --process=304 /prefetch:7 --thread=35806⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,16865645814350234798,4497841469442002074,262144 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4949923836042034754,3001966869735103972,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,17983288887527857092,14876503737447349966,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6533360551933323868,4894116397114346182,2097152 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13861027696120832119,12789813576740477650,2097152 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,12593748198309522736,8840417398419752432,2097152 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,8152697628617516972,13054520580995559974,2097152 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,15601838322911599956,3518734790074267384,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,11343337131038892942,11966152232101043219,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,15386655957233114021,2941878606683883823,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,6246759269711529591,8617442319718226889,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,11949861421272207565,13892236101571513528,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1109091155372196128,9273240574253008557,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,11103016907185145711,7787172861527943758,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,11103016907185145711,7787172861527943758,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8207769134776205593,3954221635041789,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=156 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,6222881607610347162,11782354117526269545,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,15925957259553214623,5923545285382781277,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,17212563429028829595,17075313473587571189,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,13778322604628375335,11750653409063264078,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,16330515790200564220,1094524208853742409,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,8651211952432135982,6427231550956129705,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,10446815344655117149,1067508053154281990,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1115815055989232869,9988426659669111199,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,17191238037591069439,5246315323268632141,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,14143997347992860687,5751829967710013361,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,1718793520788587673,15566009764500745524,524288 --field-trial-handle=2736,i,3777592217143498425,299731301555981747,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:85⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4840 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=3960 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5196 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"4⤵
- Executes a command shell one-liner
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5084 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1748,i,15478241058344175998,6140300953121900493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1752,i,10705308146755166667,5554796656125967805,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5012 /prefetch:84⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3524" /NH"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 3524" /NH5⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /T /F /PID 3524"4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /T /F /PID 35245⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f0 0x2481⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.23.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4f4,0x4f8,0x4fc,0x4f0,0x500,0x7ff7bf7b219c,0x7ff7bf7b21a8,0x7ff7bf7b21b82⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1764 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1808 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1786637443902782 --launch-time-ticks=721087726 --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3512 --vscode-window-config=vscode:84ee64a0-435c-4e1c-ba73-ed09066d1dac /prefetch:12⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 3524" /NH"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 3524" /NH3⤵
- Discovers running processes
-
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache2⤵
- Enumerates connected drives
- Executes dropped EXE
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache3⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\sc.exesc query4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version4⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion4⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log4⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM4⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"4⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch4⤵
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion4⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"4⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"4⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service4⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM4⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service4⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exeC:\Users\Admin\.qoder\plugins\cache\qoder-bundler\qoder-computer-use\QoderComputerUse.exe3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3984 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3868 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4112 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" "c:\Program Files\Qoder\resources\app\extensions\json-language-features\server\dist\node\jsonServerMain" --node-ipc --clientProcessId=73843⤵
- Checks computer location settings
- Executes dropped EXE
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4172 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4248 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4312 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q3⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1786637443902782 --launch-time-ticks=742858190 --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4480 --vscode-window-config=vscode:acc7ef0c-3295-4c48-8bf7-8da2610f149b /prefetch:12⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4848 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4940 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5008 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5124 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"2⤵
- Executes a command shell one-liner
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.qoder.com/device/selectAccounts?nonce=8ee18d4764cf49719e7d822ecd1ee3ef&challenge=Pb_YqyZZew-AEagcDqQQ3qK4GiKmtqlEyMpK_Ci5SHs&challenge_method=S256&redirect_uri=qoder://aicoding.aicoding-agent/login-success&machine_id=P1gAiwxr2il-Q9z_tgouW6BOPZomGMbCRJUoi8Fa4AvR9uWs78CBu97DriyvbcL7ReojaztcQLx8Grz9kVC6qzld2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.qoder.com/device/selectAccounts?nonce=8ee18d4764cf49719e7d822ecd1ee3ef&challenge=Pb_YqyZZew-AEagcDqQQ3qK4GiKmtqlEyMpK_Ci5SHs&challenge_method=S256&redirect_uri=qoder://aicoding.aicoding-agent/login-success&machine_id=P1gAiwxr2il-Q9z_tgouW6BOPZomGMbCRJUoi8Fa4AvR9uWs78CBu97DriyvbcL7ReojaztcQLx8Grz9kVC6qzld3⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x284,0x7ffca17cc188,0x7ffca17cc194,0x7ffca17cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,2042464383146939459,10787330095458057054,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:34⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15134502338401057848,5335011244060127880,262144 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,9710022700150986017,4745633824887446114,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6179456812353642208,14104460065242485667,2097152 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12937774623792409078,11373045722343534582,2097152 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,6351506405119952738,16786800990827637987,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,1622157591096073022,7332022457819005241,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3265295428472676337,9555243190490903547,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3265295428472676337,9555243190490903547,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2501478597874574720,6476355419754604707,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,14169352500672701680,9045315871448296981,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=136,i,6047230477443237165,12426996212733588711,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,6295846101283430427,7005528884910167311,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,18130765090273520862,5527746749553549551,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,9552204661875403418,3063212666889186714,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,13384036608351052991,1830325728977183806,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,12262903776299286475,237419703408552587,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=780,i,230660857009400249,8774993392142978944,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,15625722614169285833,1654698595113038844,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6844,i,9586954858685263352,5301481263118526578,2097152 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6452,i,17294660630395513435,4075841297842895129,262144 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,7345354399579539436,347367196598348955,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,12828525862267241376,7433310757009140084,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,17688658621618740840,13127864746715727958,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,7195848806548581380,2210128131256348983,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6558172294504625681,13503800804683595743,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8457020997188393393,1552623208346479342,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,17133403377842135653,9780405389319554967,524288 --field-trial-handle=2324,i,11522981039420622734,4773957940777389667,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:84⤵
-
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,18440787470649720837,2378365545497443796,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,2570190031460914005,764964081691397963,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=2984 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5444" /NH"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 5444" /NH3⤵
- Discovers running processes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /T /F /PID 5444"2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /T /F /PID 54443⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\vscode-stable-system-x64\QoderSetup-stable-2d99292768eef6ec542c2b67778175667060a609.exeC:\Users\Admin\AppData\Local\Temp\vscode-stable-system-x64\QoderSetup-stable-2d99292768eef6ec542c2b67778175667060a609.exe /silent /log /mergetasks=runcode,!desktopicon,!quicklaunchicon2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-QIVLP.tmp\QoderSetup-stable-2d99292768eef6ec542c2b67778175667060a609.tmp"C:\Users\Admin\AppData\Local\Temp\is-QIVLP.tmp\QoderSetup-stable-2d99292768eef6ec542c2b67778175667060a609.tmp" /SL5="$B011A,195884823,916992,C:\Users\Admin\AppData\Local\Temp\vscode-stable-system-x64\QoderSetup-stable-2d99292768eef6ec542c2b67778175667060a609.exe" /silent /log /mergetasks=runcode,!desktopicon,!quicklaunchicon3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\Qoder" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX"4⤵
- Modifies file permissions
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Qoder /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Qoder\Crashpad --annotation=_companyName=Microsoft --annotation=_productName=Qoder --annotation=_version=1.24.1 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.2.0 --initial-client-data=0x4f4,0x4f8,0x4fc,0x4f0,0x500,0x7ff630ec219c,0x7ff630ec21a8,0x7ff630ec21b85⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=gpu-process --disable-skia-graphite --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1800 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1880 /prefetch:35⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --app-user-model-id=AlibabaCloud.Qoder --app-path="C:\Program Files\Qoder\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --remote-debugging-port=0 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3572 --vscode-window-config=vscode:5eaf6d8d-807d-4254-9c1d-d1b7c66e47b8 /prefetch:15⤵
- Uses browser remote debugging
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FI "PID eq 5444" /NH"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\tasklist.exetasklist /FI "PID eq 5444" /NH6⤵
- Discovers running processes
-
-
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" start --workDir C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache5⤵
- Enumerates connected drives
- Executes dropped EXE
-
C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe"C:\Program Files\Qoder\resources\app\resources\bin\x86_64_windows\Qoder.exe" machine-info -r 1 -k "" -t "" -w C:\Users\Admin\AppData\Roaming\Qoder\SharedClientCache6⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Executes dropped EXE
-
C:\Windows\system32\reg.exereg query "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"7⤵
-
-
C:\Windows\system32\sc.exesc query7⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\wmic.exewmic computersystem get manufacturer,model7⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic bios get version7⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\SystemBiosVersion7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Api7⤵
-
-
C:\Windows\system32\reg.exereg query HARDWARE\Description\System\VideoBiosVersion7⤵
-
-
C:\Windows\system32\reg.exereg query "SOFTWARE\VMware, Inc.\VMware Tools"7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2-Windows\Launch\Log7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion7⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion7⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\SSM7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Amazon\EC2Launch7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion7⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AwsEc2Launch7⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System /v SystemBiosVersion7⤵
- Checks BIOS information in registry
-
-
C:\Windows\system32\sc.exesc query AmazonSSMAgent7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AwsEc2Config7⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Azure\Compute"7⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\Auto"7⤵
-
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtual Machine\GuestAgent"7⤵
-
-
C:\Windows\system32\sc.exesc query WindowsAzureGuestAgent7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query WindowsAzureNetAgentSvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\ECS7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba\CloudMonitor7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Aliyun\Service7⤵
-
-
C:\Windows\system32\sc.exesc query AliyunService7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query AliyunAssistService7⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\Cloud7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\Tencent\CVM7⤵
-
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\SOFTWARE\QCloud\Service7⤵
-
-
C:\Windows\system32\sc.exesc query TencentCVMService7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query QCloudService7⤵
- Launches sc.exe
-
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3956 /prefetch:85⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3976 /prefetch:85⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4020 /prefetch:85⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4524 /prefetch:85⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\wsl.exewsl.exe -l -q6⤵
-
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4404 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files\Qoder\Qoder.exe"C:\Program Files\Qoder\Qoder.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Qoder" --standard-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --enable-sandbox --secure-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,aicoding-aura-buddy,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file,aicoding-aura-buddy --field-trial-handle=1812,i,9726570394793613866,12357661459655845268,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,FontationsLinuxSystemFonts,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1840,i,6910882851859200120,4891755433543160533,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4380 /prefetch:85⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Modify Authentication Process
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
8Credential Access
Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
3Process Discovery
1Query Registry
15System Information Discovery
10System Location Discovery
1System Language Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
8Replay Monitor
Loading Replay Monitor...
Downloads
chrome_100_percent.pak
chrome_200_percent.pak
icudtl.dat
en-US.pak
resources.pak
is-0K9HO.tmp
is-GNO5Q.tmp
is-TOHOR.tmp
is-6CBD2.tmp
is-EHOMT.tmp
is-GM9PN.tmp
is-V6H3V.tmp
is-TSS4J.tmp
is-ANJ1Q.tmp
is-3BHPB.tmp
is-1AA1Q.tmp
is-CABFM.tmp
is-RNB2M.tmp
is-V5G5D.tmp
is-8ABA8.tmp
is-PM9MG.tmp
is-VFRBO.tmp
is-N4342.tmp
is-27KC1.tmp
is-MOGFJ.tmp
is-4GQOF.tmp
is-T0F58.tmp
is-MN105.tmp
is-ACSJI.tmp
is-ROE67.tmp
is-VRR28.tmp
is-M7C0K.tmp
is-KN7MS.tmp
is-VRST9.tmp
is-0B2J4.tmp
is-0JQBB.tmp
is-0P4RO.tmp
is-11B1D.tmp
is-1I3LH.tmp
is-20NR4.tmp
is-26HGQ.tmp
is-2FNST.tmp
is-2HBU8.tmp
is-2KS26.tmp
is-3BJ5U.tmp
is-3IT3P.tmp
is-491SN.tmp
is-4K54L.tmp
is-4SI5P.tmp
is-4UONO.tmp
is-4UVFQ.tmp
is-5MRVK.tmp
is-5S05A.tmp
is-5USS8.tmp
is-63S7N.tmp
is-655H8.tmp
is-65FC6.tmp
is-65FMV.tmp
is-6AKH6.tmp
is-6PST4.tmp
is-6UPES.tmp
is-712P6.tmp
is-86RGP.tmp
is-87UB9.tmp
is-8BRAE.tmp
is-8MQ98.tmp
is-8VIDM.tmp
is-9913F.tmp
is-9LS1A.tmp
is-AD74C.tmp
is-AMTC2.tmp
is-ATML5.tmp
is-B5UJ4.tmp
is-BI5J5.tmp
is-C2DA3.tmp
is-CHR03.tmp
is-CNFSI.tmp
is-CVTDL.tmp
is-DA24R.tmp
is-DB476.tmp
is-DHKH8.tmp
is-E137C.tmp
is-E5M91.tmp
is-EISSE.tmp
is-F6B06.tmp
is-FAQRG.tmp
is-FH92Q.tmp
is-FKLL6.tmp
is-G83LM.tmp
is-GAR5N.tmp
is-GRBAT.tmp
is-H2Q9H.tmp
is-HFA53.tmp
is-IB491.tmp
is-IGTJ4.tmp
is-IICVF.tmp
is-IJ0M0.tmp
is-IP6FT.tmp
is-IV0PK.tmp
is-JJ9RE.tmp
is-JQPPI.tmp
is-JTLTD.tmp
is-K3EHG.tmp
is-K4614.tmp
is-K7JCT.tmp
is-KJBE9.tmp
is-L8VKK.tmp
is-LCMPP.tmp
is-LGCK8.tmp
is-LJE4R.tmp
is-LV415.tmp
is-M8NEL.tmp
is-MPDRP.tmp
is-NROV1.tmp
is-NUNR0.tmp
is-OAQ5S.tmp
is-OIBPJ.tmp
is-OORQS.tmp
is-PJ928.tmp
is-PRSL8.tmp
is-PVVCK.tmp
is-QHA9R.tmp
is-QM588.tmp
is-QMPJ9.tmp
is-QTUSA.tmp
is-QU147.tmp
is-R19I2.tmp
is-RACUA.tmp
is-RMOCM.tmp
is-RUIPE.tmp
is-SF232.tmp
is-SJQAK.tmp
is-T0IE6.tmp
is-T16E1.tmp
is-TJ3H2.tmp
is-U0CBQ.tmp
is-U0UD3.tmp
is-V9CD3.tmp
is-V9NKD.tmp
is-VAIE2.tmp
is-AT4HK.tmp
is-OH6SJ.tmp
is-287DK.tmp
is-1QQ60.tmp
is-I0GG5.tmp
is-B12K8.tmp
is-OHHUS.tmp
is-T6E39.tmp
is-CIG5J.tmp
is-G26EQ.tmp
featureFlags.json
is-GL19O.tmp
is-90O9P.tmp
is-55ALJ.tmp
is-MSPV7.tmp
is-0AJQU.tmp
is-K2BCC.tmp
is-620PO.tmp
is-VT7LN.tmp
is-1QM8A.tmp
is-A22H0.tmp
is-FK72F.tmp
is-INPM5.tmp
is-MBSNJ.tmp
is-MCB3V.tmp
is-2V3GU.tmp
is-347GT.tmp
is-JDH59.tmp
is-NMP5A.tmp
is-7HI74.tmp
is-HP7LQ.tmp
is-8K0H1.tmp
is-CVJGA.tmp
is-D4CM7.tmp
is-T3VH5.tmp
is-8N9P7.tmp
is-J94AM.tmp
is-5HPAO.tmp
is-9N5T7.tmp
is-U2LVQ.tmp
is-8T34E.tmp
is-QJP26.tmp
is-FOGKF.tmp
is-4VEEH.tmp
is-SLRA7.tmp
is-HD8HP.tmp
is-H0SR5.tmp
is-0RS74.tmp
is-PE4K8.tmp
is-JUF6P.tmp
is-M5EOD.tmp
is-0TA1E.tmp
is-3VIED.tmp
is-4EVP8.tmp
is-9OCG2.tmp
is-O6FUR.tmp
is-T17JV.tmp
is-FOI38.tmp
is-HT59C.tmp
is-J14UV.tmp
is-QC9CP.tmp
is-JHUI3.tmp
is-K14QF.tmp
is-VL6LM.tmp
is-4UMRQ.tmp
is-8UFJ6.tmp
is-GU6OG.tmp
is-BEVN6.tmp
is-FMI60.tmp
is-KFINS.tmp
is-O1T03.tmp
is-E70B5.tmp
is-GPNDU.tmp
is-JODRE.tmp
is-N6VJI.tmp
is-NUNCN.tmp
index.js
is-84RA3.tmp
is-EJ98U.tmp
is-GRG1H.tmp
is-7LN68.tmp
is-0E767.tmp
is-4AI3F.tmp
is-H1H7L.tmp
is-LDI1G.tmp
is-O4HNS.tmp
is-9OJN1.tmp
is-6ETT7.tmp
is-9U78R.tmp
is-BJB6I.tmp
is-CG2FS.tmp
is-MER1H.tmp
is-S4L4Q.tmp
is-39K8J.tmp
is-H53TM.tmp
is-R5LKM.tmp
is-G3IEQ.tmp
is-2OPCR.tmp
is-63CTF.tmp
is-KV80F.tmp
is-PUAN8.tmp
is-PVTBL.tmp
is-F9KNF.tmp
is-EI3V3.tmp
is-V5841.tmp
is-23N9F.tmp
is-EOKOG.tmp
is-1CHPA.tmp
is-OGAFN.tmp
is-5F16S.tmp
is-E0OMP.tmp
is-9SJ6J.tmp
is-ILQ4Q.tmp
is-CQK54.tmp
is-T2ILQ.tmp
is-K4361.tmp
is-PEL37.tmp
is-2AKTE.tmp
is-DSK4U.tmp
is-N6KJ3.tmp
is-VO6EB.tmp
is-0PNV0.tmp
is-96UT3.tmp
is-RGC07.tmp
is-SEH6I.tmp
is-ATJ3I.tmp
is-NFAOA.tmp
is-VGNVI.tmp
is-HQF2M.tmp
is-502VG.tmp
is-M3IU5.tmp
is-MH3PQ.tmp
is-HGDI1.tmp
is-NNDTI.tmp
is-UK7KM.tmp
is-8FSUT.tmp
is-JR9I9.tmp
is-VJ7QD.tmp
is-2T8SQ.tmp
is-BTSIN.tmp
is-34VAL.tmp
is-8DDO0.tmp
is-DE3FD.tmp
is-E9RJI.tmp
is-J66KJ.tmp
is-FQVOR.tmp
is-IB6BS.tmp
is-IO4RP.tmp
is-V3PR9.tmp
is-565VD.tmp
is-88447.tmp
is-AIJSH.tmp
is-CQ4IP.tmp
windowsTerminal.js
is-RI97D.tmp
is-V4L22.tmp
is-VF9I2.tmp
is-V86R3.tmp
is-2AI8D.tmp
is-383LD.tmp
is-NEUCM.tmp
is-SR0G0.tmp
is-OHH17.tmp
is-TDNH4.tmp
is-U2QTG.tmp
is-2I8M1.tmp
is-8TC2H.tmp
is-63BTA.tmp
is-8CVTF.tmp
is-5IVQ3.tmp
is-7NCMB.tmp
is-CT1HO.tmp
is-BQG1L.tmp
is-SNUKP.tmp
is-484UL.tmp
is-VNBEN.tmp
is-OKM7S.tmp
is-1H9HE.tmp
is-QFSDS.tmp
is-UJ167.tmp
is-CL2P9.tmp
is-52RGH.tmp
is-FFINO.tmp
is-I4JM0.tmp
is-2UO70.tmp
is-4N5OO.tmp
is-HK7MP.tmp
is-JMU0E.tmp
is-K0BF8.tmp
is-UKCR2.tmp
is-S1941.tmp
is-0QEUD.tmp
is-M761O.tmp
is-VR49J.tmp
is-V0PGR.tmp
is-R94OK.tmp
index.js
is-3I4MB.tmp
is-4TICB.tmp
is-A2IV3.tmp
is-BUC2V.tmp
is-C9GMN.tmp
is-D4D8P.tmp
is-DV3JU.tmp
is-ERJRV.tmp
is-LTF8A.tmp
is-SMULM.tmp
is-SRND7.tmp
is-0BISG.tmp
is-1BT9J.tmp
is-4365J.tmp
is-4388K.tmp
is-6GJAJ.tmp
is-6PL76.tmp
is-9T60R.tmp
is-BKBTS.tmp
is-D9A7G.tmp
is-DFLB7.tmp
is-DIJGK.tmp
is-MLOAI.tmp
is-SVR1N.tmp
is-VR0MJ.tmp
regex.js
api.js
cancellation.js
connection.js
disposable.js
events.js
is.js
linkedMap.js
messageBuffer.js
messageReader.js
messageWriter.js
messages.js
ral.js
semaphore.js
sharedArrayCancellation.js
main.js
ril.js
node.js
package.json
buffer-util.js
constants.js
event-target.js
extension.js
limiter.js
permessage-deflate.js
receiver.js
sender.js
stream.js
subprotocol.js
validation.js
websocket-server.js
websocket.js
package.json
wrapper.mjs
is-37GG7.tmp
is-21RGC.tmp
canvas-sdk.js
canvasInject.js
index-canvas.html
is-6CRE2.tmp
is-6GPGR.tmp
is-8T17E.tmp
is-A7QM8.tmp
is-HUT6K.tmp
main.js
nls.messages.json
package.json
product.json
v8_context_snapshot.bin
argv.json
.managed-format-viewers.json
package.json
_version_info.pyi
WHEEL
WHEEL
LICENSE
urls.pyi
clearsessions.pyi
console.pyi
ntpath.pyi
expatbuilder.pyi
bcppcompiler.pyi
errors.pyi
msvccompiler.pyi
unixccompiler.pyi
posixpath.pyi
nodes.pyi
CGIHTTPServer.pyi
__init__.py
grammar311.txt
LICENSE
WHEEL
INSTALLER
WHEEL
package.json
SECURITY.md
__init__.py
LICENSE
LICENSE.BSD
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_spdx.py
metadata.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
package.json
icon.png
LICENSE
casio.pyi
patch.pyi
patch.pyi
__init__.pyi
fasttext.pyi
ar.pyi
zh_cn.pyi
__init__.pyi
luajit20.pyi
_gen_files.pyi
wire_format.pyi
hooks.pyi
status_codes.pyi
cPickle.pyi
collections_abc.pyi
email_mime_text.pyi
html_entities.pyi
html_parser.pyi
http_cookiejar.pyi
queue.pyi
reprlib.pyi
socketserver.pyi
tkinter.pyi
tkinter_commondialog.pyi
tkinter_constants.pyi
tkinter_dialog.pyi
tkinter_ttk.pyi
error.pyi
parse.pyi
response.pyi
robotparser.pyi
urllib_error.pyi
urllib_parse.pyi
urllib_robotparser.pyi
package.json
cp1250.pyi
cp850.pyi
cp950.pyi
__init__.pyi
de.pyi
da.pyi
METADATA.toml
tls_backport.pyi
__init__.pyi
version.pyi
_dummy_thread.pyi
email_mime_base.pyi
email_mime_multipart.pyi
email_mime_nonmultipart.pyi
tkinter_filedialog.pyi
urllib_request.pyi
urllib_response.pyi
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json
extensions.json.vsctmp
package.nls.json
package.nls.json
package.nls.json
package.json
package.nls.json
plugin.json
plugin.json
plugin.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
installed_plugins_v2.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
settings.json
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
9a3ed69f-a9a6-4a91-ae5d-d1ff98f5913e.tmp
LOG.old
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_000093
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a7eb7.TMP
Edge Profile.ico
CURRENT
LOG.old
7dd08fcb-5dd2-4dee-9ca5-75c0c29f1f28.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
sync_diagnostic.log
favorites_diagnostic.log
fe225b82-8a73-43ed-9d8f-98b4b8fbb35c.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe5dc9ea.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
13fbc5a0-54ba-4e3e-a88f-b314b2eb0777.tmp
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
__PSScriptPolicyTest_id54uj1c.efr.ps1
afa9682b-0cfb-4425-80e4-4b88cdfe5a4a.tmp
QoderSetup-x64.tmp
content_new.js
default.dic
b73f8760642355ab.customDestinations-ms
b73f8760642355ab.customDestinations-ms
4e0e9046-9e06-4f0c-b933-cac91ffac4a9.tmp
configuration.json
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index
detachhead.basedpyright-1.31.6
ms-python.autopep8-2025.2.0
ms-python.debugpy-2025.14.0-win32-x64
ms-python.python-2025.16.0-win32-x64
ms-python.vscode-python-envs-1.8.0-win32-x64
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
extensions.builtin.cache
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
ef5a7419-2bfc-480d-b368-ae53154edfcd.tmp
app-config.json
id
agents-window.code-workspace
aicoding-usage-equity-notice-state.json.tmp
aicoding-usage-equity-notice-state.json.tmp
app.json
app.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
storage.json.vsctmp
settings.json
settings.json
settings.json.vsctmp
state.json
state.json
state.json
state.json
state.json
languagepacks.json
LICENSE
canvas-sdk-version
index.canvas.tsx
index.mjs
code-review.recipe.md
design-system.recipe.md
format-viewer.recipe.md
index.md
presentation.recipe.md
report.recipe.md
sequence-diagram.recipe.md
canary.d.ts
compiler-runtime.d.ts
memory/3876-1-0x0000000000610000-0x00000000006FE000-memory.dmp
memory/3876-29-0x0000000000610000-0x00000000006FE000-memory.dmp
memory/3876-9743-0x0000000000610000-0x00000000006FE000-memory.dmp
memory/4024-4045-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4024-9707-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4024-21-0x0000000003400000-0x0000000003401000-memory.dmp
memory/4024-30-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4024-161-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4024-5-0x0000000003400000-0x0000000003401000-memory.dmp
memory/4024-7949-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4024-9067-0x0000000000AD0000-0x0000000000E45000-memory.dmp
memory/4272-9846-0x00007FFCC3590000-0x00007FFCC3591000-memory.dmp
memory/4272-9847-0x00007FFCC3070000-0x00007FFCC3071000-memory.dmp
memory/4708-23-0x0000000006400000-0x000000000644C000-memory.dmp
memory/4708-24-0x0000000007310000-0x00000000073A6000-memory.dmp
memory/4708-11-0x0000000005CC0000-0x0000000005D26000-memory.dmp
memory/4708-12-0x0000000005D30000-0x0000000005D96000-memory.dmp
memory/4708-8-0x0000000002D20000-0x0000000002D56000-memory.dmp
memory/4708-20-0x0000000005DA0000-0x00000000060F7000-memory.dmp
memory/4708-7-0x0000000002D10000-0x0000000002D20000-memory.dmp
memory/4708-22-0x0000000006370000-0x000000000638E000-memory.dmp
memory/4708-26-0x0000000006900000-0x0000000006922000-memory.dmp
memory/4708-25-0x00000000068B0000-0x00000000068CA000-memory.dmp
memory/4708-27-0x0000000007960000-0x0000000007F06000-memory.dmp
memory/4708-28-0x0000000008590000-0x0000000008C0A000-memory.dmp
memory/4708-10-0x0000000005320000-0x0000000005342000-memory.dmp
memory/4708-9-0x0000000005440000-0x0000000005B0A000-memory.dmp
memory/4780-9935-0x00007FFCA2220000-0x00007FFCA3347000-memory.dmp
memory/5092-47861-0x00007FFC97A60000-0x00007FFC98B87000-memory.dmp
memory/5488-10240-0x00007FFCA2220000-0x00007FFCA3347000-memory.dmp
memory/6256-39959-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/6256-44790-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/6256-47628-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/6256-37843-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/6256-37923-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/6256-46869-0x0000000000960000-0x0000000000CD5000-memory.dmp
memory/7076-26119-0x00007FFC9A990000-0x00007FFC9BAB7000-memory.dmp
memory/8028-31254-0x0000024419010000-0x0000024419477000-memory.dmp
memory/8028-37392-0x0000024419010000-0x0000024419477000-memory.dmp
memory/8028-29759-0x0000024419010000-0x0000024419477000-memory.dmp
memory/11520-37809-0x0000000000510000-0x00000000005FE000-memory.dmp
memory/11520-37842-0x0000000000510000-0x00000000005FE000-memory.dmp
memory/11520-47629-0x0000000000510000-0x00000000005FE000-memory.dmp
memory/11956-25720-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25713-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25721-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25722-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25714-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25723-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25715-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25719-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25724-0x0000026131690000-0x0000026131691000-memory.dmp
memory/11956-25725-0x0000026131690000-0x0000026131691000-memory.dmp
memory/12168-25675-0x00007FFC9A990000-0x00007FFC9BAB7000-memory.dmp
memory/12920-47705-0x00007FFCC3590000-0x00007FFCC3591000-memory.dmp
memory/12920-47706-0x00007FFCC3070000-0x00007FFCC3071000-memory.dmp
memory/13632-37426-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37421-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37417-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37419-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37418-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37423-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37422-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37425-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/13632-37424-0x00000178EE3B0000-0x00000178EE3B1000-memory.dmp
memory/14200-25605-0x0000020027E00000-0x0000020027F5B000-memory.dmp
memory/14200-25614-0x0000020027E00000-0x0000020027F5B000-memory.dmp
memory/15388-25859-0x00007FFC9A990000-0x00007FFC9BAB7000-memory.dmp
memory/16060-27207-0x0000024A48ED0000-0x0000024A49337000-memory.dmp
memory/16060-26221-0x0000024A48ED0000-0x0000024A49337000-memory.dmp