hxxps://geaix[.]com/

Analysis

user interaction
yes
max time kernel
849s
max time network
881s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://geaix.com/
Sample261004-2py1qsyeph

Score

8^/10

adware discovery execution installer persistence ransomware spyware stealer

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
76	1520	powershell.exe
77	1520	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2144	powershell.exe
5964	powershell.exe
2656	powershell.exe
5636	powershell.exe
6088	powershell.exe
3756	powershell.exe
3408	powershell.exe
6724	powershell.exe
6796	powershell.exe
4824	powershell.exe
3276	powershell.exe
1948	powershell.exe
6308	powershell.exe
6360	powershell.exe
4924	powershell.exe
1116	powershell.exe
6980	powershell.exe
2756	powershell.exe
1680	powershell.exe
5812	powershell.exe
6560	powershell.exe
4164	powershell.exe
6732	powershell.exe
796	powershell.exe
6160	powershell.exe
1308	powershell.exe
2488	powershell.exe
4852	powershell.exe
2332	powershell.exe
2632	powershell.exe
4968	powershell.exe
6876	powershell.exe
4196	powershell.exe
5840	powershell.exe
1512	powershell.exe
1212	powershell.exe
6632	powershell.exe
5496	powershell.exe
1532	powershell.exe
3000	powershell.exe
4296	powershell.exe
6356	powershell.exe
1244	powershell.exe
3460	powershell.exe
628	powershell.exe
7000	powershell.exe
5596	powershell.exe
3796	powershell.exe
6100	powershell.exe
6576	powershell.exe
3872	powershell.exe
4940	powershell.exe
5128	powershell.exe
6248	powershell.exe
3372	powershell.exe
5756	powershell.exe
6896	powershell.exe
3728	powershell.exe
6492	powershell.exe
6980	powershell.exe
6884	powershell.exe
6516	powershell.exe
6524	powershell.exe
620	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
65	3236	chrome.exe

Executes dropped EXE 49 IoCs

pid	Process
1348	VSCodeUserSetup-x64-1.140.0.exe
5184	VSCodeUserSetup-x64-1.140.0.tmp
5628	inno_updater.exe
1204	Code.exe
2028	Code.exe
1648	Code.exe
4180	Code.exe
3444	Code.exe
3820	Code.exe
3928	Code.exe
4972	Code.exe
2804	Code.exe
4840	copilot-runtime.exe
4760	code-tunnel.exe
7000	Code.exe
5044	Code.exe
5268	Code.exe
5896	Code.exe
6352	Code.exe
984	Code.exe
3364	Code.exe
6928	Code.exe
5964	Code.exe
3672	Code.exe
1268	copilot-runtime.exe
1464	code-tunnel.exe
796	Code.exe
6132	Code.exe
4232	Code.exe
6772	Code.exe
7148	installer_b1d68bb84d.exe
2644	Code.exe
7164	Code.exe
7004	Code.exe
4244	Code.exe
6092	Code.exe
5384	Code.exe
1092	Code.exe
2600	Code.exe
3548	Code.exe
2492	Code.exe
6608	Code.exe
4496	copilot-runtime.exe
3036	code-tunnel.exe
3016	Code.exe
6620	sysprep_8ba71f965a.exe
6712	Code.exe
2380	Code.exe
1748	Code.exe

Loads dropped DLL 64 IoCs

pid	Process
5628	inno_updater.exe
1204	Code.exe
1204	Code.exe
1204	Code.exe
1204	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
4180	Code.exe
2028	Code.exe
4180	Code.exe
2028	Code.exe
4180	Code.exe
2028	Code.exe
4180	Code.exe
4180	Code.exe
3444	Code.exe
4180	Code.exe
2028	Code.exe
4972	Code.exe
3820	Code.exe
2804	Code.exe
3820	Code.exe
4840	copilot-runtime.exe
7000	Code.exe
5044	Code.exe
5044	Code.exe
5044	Code.exe
5896	Code.exe
5896	Code.exe
5896	Code.exe
5044	Code.exe
5896	Code.exe
5044	Code.exe
5896	Code.exe
5896	Code.exe
5044	Code.exe
5044	Code.exe
984	Code.exe
5044	Code.exe
5044	Code.exe
5964	Code.exe
3364	Code.exe
3364	Code.exe
3672	Code.exe
1268	copilot-runtime.exe
796	Code.exe
6132	Code.exe
4232	Code.exe
6772	Code.exe
6772	Code.exe
6772	Code.exe
7164	Code.exe
7004	Code.exe
7004	Code.exe
7004	Code.exe
7004	Code.exe
7004	Code.exe
7004	Code.exe
6092	Code.exe
6092	Code.exe
6092	Code.exe

Modifies file permissions 1 TTPs 25 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1848	icacls.exe
6976	icacls.exe
2520	icacls.exe
1144	icacls.exe
2616	icacls.exe
1472	icacls.exe
3316	icacls.exe
4556	icacls.exe
6632	icacls.exe
6592	icacls.exe
2608	icacls.exe
3960	icacls.exe
4356	icacls.exe
5984	icacls.exe
868	icacls.exe
5648	icacls.exe
4924	icacls.exe
4468	icacls.exe
1008	icacls.exe
724	icacls.exe
5100	icacls.exe
4980	icacls.exe
1316	icacls.exe
5964	icacls.exe
4588	icacls.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\E:\	explorer.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
File opened (read-only)	\??\E:	explorer.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	explorer.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe
	\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Go\pcaiaghtoorm.cfg	installer_b1d68bb84d.exe
File opened for modification	C:\Program Files (x86)\Go\pcaiaghtoorm.cfg	sysprep_8ba71f965a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2640	cmd.exe
6468	cmd.exe
4444	cmd.exe
6660	cmd.exe
6932	cmd.exe
6652	cmd.exe
4156	cmd.exe
5512	cmd.exe
3200	cmd.exe
5872	cmd.exe
5908	cmd.exe
6988	cmd.exe
1612	cmd.exe
4040	cmd.exe
5056	cmd.exe
1000	cmd.exe
3612	cmd.exe
3976	cmd.exe
6752	cmd.exe
6800	cmd.exe
4136	cmd.exe
6488	cmd.exe
6300	cmd.exe
5992	cmd.exe
3724	cmd.exe
2856	cmd.exe
6640	cmd.exe
4900	cmd.exe
3300	cmd.exe
4804	cmd.exe
7012	cmd.exe
1768	cmd.exe
4340	cmd.exe
2744	cmd.exe
6004	cmd.exe
2504	cmd.exe
2104	cmd.exe
6484	cmd.exe
1848	cmd.exe
3104	cmd.exe
5348	cmd.exe
6924	cmd.exe
5264	cmd.exe
4012	cmd.exe
6848	cmd.exe
2648	cmd.exe
4904	cmd.exe
3864	cmd.exe
6152	cmd.exe
4772	cmd.exe
52	cmd.exe
3492	cmd.exe
6348	cmd.exe
4428	cmd.exe
6776	cmd.exe
1284	cmd.exe
5016	cmd.exe
3676	cmd.exe
3408	cmd.exe
4872	cmd.exe
2520	cmd.exe
1760	cmd.exe
720	cmd.exe
984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 42 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Code.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Code.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inno_updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCodeUserSetup-x64-1.140.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VSCodeUserSetup-x64-1.140.0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
796	Code.exe
1092	Code.exe
2380	Code.exe
3444	Code.exe
4972	Code.exe
3928	Code.exe
7000	Code.exe
984	Code.exe
7164	Code.exe
3548	Code.exe
1748	Code.exe
4180	Code.exe
5896	Code.exe
6928	Code.exe
4232	Code.exe
2492	Code.exe
5964	Code.exe
6132	Code.exe
6772	Code.exe
2644	Code.exe
6092	Code.exe
2600	Code.exe
3016	Code.exe
6712	Code.exe
3820	Code.exe
3364	Code.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3236	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1348-404-0x0000000000140000-0x000000000021C000-memory.dmp	innosetup
behavioral1/memory/1348-421-0x0000000000140000-0x000000000021C000-memory.dmp	innosetup
behavioral1/memory/1348-10269-0x0000000000140000-0x000000000021C000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Code.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Code.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Code.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.gitconfig\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.wxi\ = "WiX Include Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.ctp	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.gemspec	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.wxs\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.erb\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.rprofile	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.vue\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\vue.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.jscsrc\shell	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.plist\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.pp\ = "Perl Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.xml\ = "XML Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.csproj\AppUserModelID = "Microsoft.VisualStudioCode"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.psd1\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.toml\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.h\ = "C Header Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.h++	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.ipynb\ = "Jupyter Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cc\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\cpp.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.gemspec\shell	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.go\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.clj	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.editorconfig\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.js\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.py\DefaultIcon	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.groovy\OpenWithProgids\VSCode.groovy	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.shtml\OpenWithProgids\VSCode.shtml	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cc\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.pp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCodeSourceFile\ = "Visual Studio Code Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.bash_logout\shell\open	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cpp\shell\open	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.css\shell\open	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.dtd\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\" \"%1\""	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.edn\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.fsx	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.log\shell\open	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.markdown\OpenWithProgids\VSCode.markdown	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.mdown\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.plist\ = "Properties file Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.bash_profile\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.csproj\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.mdwn	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.wxl\ = "WiX Localization Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.dot\shell\open\Icon = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe\""	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.properties\OpenWithProgids\VSCode.properties	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.t\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cmake\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\default.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cs\AppUserModelID = "Microsoft.VisualStudioCode"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.gemspec\OpenWithProgids\VSCode.gemspec	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.gitattributes\AlwaysShowExt	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.yml\DefaultIcon	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.aspx\shell	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.clojure	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.config\AppUserModelID = "Microsoft.VisualStudioCode"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\.cfg\OpenWithProgids	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cfg\ = "Configuration Source File"	VSCodeUserSetup-x64-1.140.0.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cs\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Microsoft VS Code\\07f806f999\\resources\\app\\resources\\win32\\csharp.ico"	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.dot	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.jade\shell	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.psm1\shell	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.c++\shell	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.c\shell\open\command	VSCodeUserSetup-x64-1.140.0.tmp
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\VSCode.cljs	VSCodeUserSetup-x64-1.140.0.tmp

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5636	powershell.exe
5636	powershell.exe
5636	powershell.exe
5184	VSCodeUserSetup-x64-1.140.0.tmp
5184	VSCodeUserSetup-x64-1.140.0.tmp
5956	chrome.exe
5956	chrome.exe
6088	powershell.exe
6088	powershell.exe
6088	powershell.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
2144	powershell.exe
2144	powershell.exe
2144	powershell.exe
5964	powershell.exe
5964	powershell.exe
5964	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
1520	powershell.exe
1520	powershell.exe
1520	powershell.exe
2488	powershell.exe
2488	powershell.exe
2488	powershell.exe
5100	explorer.exe
5100	explorer.exe
7100	powershell.exe
7100	powershell.exe
7100	powershell.exe
6772	Code.exe
6772	Code.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5100	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe
Token: SeShutdownPrivilege	5192	chrome.exe
Token: SeCreatePagefilePrivilege	5192	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5184	VSCodeUserSetup-x64-1.140.0.tmp
5192	chrome.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2748	sihost.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
5192	chrome.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
2028	Code.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe
5100	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2500	StartMenuExperienceHost.exe
5116	SearchHost.exe
5100	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 4368	5192	chrome.exe	89
PID 5192 wrote to memory of 2396	5192	chrome.exe	90
PID 5192 wrote to memory of 3236	5192	chrome.exe	91
PID 5192 wrote to memory of 2396	5192	chrome.exe	90
PID 5192 wrote to memory of 5160	5192	chrome.exe	94
PID 5192 wrote to memory of 5160	5192	chrome.exe	94
PID 5192 wrote to memory of 1476	5192	chrome.exe	93
PID 5192 wrote to memory of 1476	5192	chrome.exe	93
PID 5192 wrote to memory of 1356	5192	chrome.exe	95
PID 5192 wrote to memory of 1356	5192	chrome.exe	95
PID 5192 wrote to memory of 1768	5192	chrome.exe	96
PID 5192 wrote to memory of 2692	5192	chrome.exe	97
PID 5192 wrote to memory of 2692	5192	chrome.exe	97
PID 5192 wrote to memory of 1184	5192	chrome.exe	98
PID 5192 wrote to memory of 1184	5192	chrome.exe	98
PID 5192 wrote to memory of 4856	5192	chrome.exe	102
PID 5192 wrote to memory of 4856	5192	chrome.exe	102
PID 5192 wrote to memory of 5964	5192	chrome.exe	103
PID 5192 wrote to memory of 5964	5192	chrome.exe	103
PID 5192 wrote to memory of 1576	5192	chrome.exe	104
PID 5192 wrote to memory of 1576	5192	chrome.exe	104
PID 5192 wrote to memory of 3920	5192	chrome.exe	105
PID 5192 wrote to memory of 3920	5192	chrome.exe	105
PID 5192 wrote to memory of 3436	5192	chrome.exe	106
PID 5192 wrote to memory of 3436	5192	chrome.exe	106
PID 5192 wrote to memory of 4412	5192	chrome.exe	107
PID 5192 wrote to memory of 4412	5192	chrome.exe	107
PID 5192 wrote to memory of 2084	5192	chrome.exe	108
PID 5192 wrote to memory of 2084	5192	chrome.exe	108
PID 5192 wrote to memory of 4384	5192	chrome.exe	109
PID 5192 wrote to memory of 4384	5192	chrome.exe	109
PID 5192 wrote to memory of 2564	5192	chrome.exe	110
PID 5192 wrote to memory of 2564	5192	chrome.exe	110
PID 5192 wrote to memory of 2856	5192	chrome.exe	111
PID 5192 wrote to memory of 2856	5192	chrome.exe	111
PID 5192 wrote to memory of 4080	5192	chrome.exe	113
PID 5192 wrote to memory of 2508	5192	chrome.exe	114
PID 5192 wrote to memory of 5464	5192	chrome.exe	115
PID 5192 wrote to memory of 6048	5192	chrome.exe	116
PID 5192 wrote to memory of 1348	5192	chrome.exe	117
PID 1348 wrote to memory of 5184	1348	VSCodeUserSetup-x64-1.140.0.exe	118
PID 5184 wrote to memory of 5636	5184	VSCodeUserSetup-x64-1.140.0.tmp	119
PID 5184 wrote to memory of 2608	5184	VSCodeUserSetup-x64-1.140.0.tmp	121
PID 5192 wrote to memory of 5956	5192	chrome.exe	123
PID 5184 wrote to memory of 6088	5184	VSCodeUserSetup-x64-1.140.0.tmp	124
PID 5184 wrote to memory of 3756	5184	VSCodeUserSetup-x64-1.140.0.tmp	126
PID 5184 wrote to memory of 2144	5184	VSCodeUserSetup-x64-1.140.0.tmp	128
PID 5184 wrote to memory of 5964	5184	VSCodeUserSetup-x64-1.140.0.tmp	130
PID 5184 wrote to memory of 2656	5184	VSCodeUserSetup-x64-1.140.0.tmp	134
PID 5184 wrote to memory of 5628	5184	VSCodeUserSetup-x64-1.140.0.tmp	137
PID 5192 wrote to memory of 1632	5192	chrome.exe	139
PID 5192 wrote to memory of 1632	5192	chrome.exe	139
PID 1520 wrote to memory of 260	1520	powershell.exe	142
PID 260 wrote to memory of 1204	260	cmd.exe	143
PID 2028 wrote to memory of 1648	2028	Code.exe	145
PID 2028 wrote to memory of 4180	2028	Code.exe	146
PID 2028 wrote to memory of 3444	2028	Code.exe	147
PID 2028 wrote to memory of 3820	2028	Code.exe	148
PID 2028 wrote to memory of 3928	2028	Code.exe	149
PID 2028 wrote to memory of 4972	2028	Code.exe	150
PID 2028 wrote to memory of 2804	2028	Code.exe	151
PID 2028 wrote to memory of 4428	2028	Code.exe	152
PID 4428 wrote to memory of 3240	4428	cmd.exe	154
PID 2028 wrote to memory of 936	2028	Code.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://geaix.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffda343c728,0x7ffda343c734,0x7ffda343c740
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,8579896608772922384,16192628511796967604,262144 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,3064949658540380463,6876530270056188939,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2996,i,1188127008513874225,3534566091218408231,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,17715884646788724361,17863833714904447431,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3000,i,16611734738273906553,2158783856119459845,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,16638835908466220917,15512865614272589111,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5272,i,10558381431309630409,11755970432428004969,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5296,i,16734370524792907852,10093410647747240659,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5652,i,14012151883332311361,3330637894359311384,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5960,i,17229641005266501867,965272453814602040,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6004,i,9708953864897276962,11287305694369871100,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5356,i,184437982515044436,5690762702327495167,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5660,i,12631289614861696323,17069560371333832412,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6124,i,11916155503462589253,7434118596485969516,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5652,i,11981993942718440190,6537386190807524977,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5576,i,5241605784262745013,13170338727626820811,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5936,i,10994095359250687284,3700532024263540957,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3016,i,13386308264862389209,11256707572059848474,2097152 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6244,i,1946293343268872832,8861849418863474879,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,9438288204984166395,6731407844036990786,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,17484902291968288805,12678545998802184494,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6344,i,3455213506624327467,3123897249424240339,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:6048
- C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.140.0.exe
  "C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.140.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\is-CS7ED.tmp\VSCodeUserSetup-x64-1.140.0.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CS7ED.tmp\VSCodeUserSetup-x64-1.140.0.tmp" /SL5="$F01CE,242962415,841216,C:\Users\Admin\Downloads\VSCodeUserSetup-x64-1.140.0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath -eq 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe' } | Select @{Name='Id'; Expression={$_.ProcessId}} | Stop-Process -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5636
  - - C:\Windows\system32\icacls.exe
      "C:\Windows\system32\icacls.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code" /inheritancelevel:r /grant:r "*S-1-5-18:(OI)(CI)F" /grant:r "*S-1-5-32-544:(OI)(CI)F" /grant:r "*S-1-5-11:(OI)(CI)RX" /grant:r "*S-1-5-32-545:(OI)(CI)RX" /grant:r "*S-1-3-0:(OI)(CI)F" /grant:r "Admin:(OI)(CI)F"
      4⤵
      Modifies file permissions
      PID:2608
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter ""Name = 'dllhost.exe'"" | Where-Object { $_.CommandLine -like '*/Processid:1C6DF0C0-192A-4451-BE36-6A59A86A692E*' } | ForEach-Object { try { Stop-Process -Id $_.ProcessId -Force -ErrorAction Stop } catch {} }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-AppxPackage -Name 'Microsoft.VisualStudioCode' | Select-Object -ExpandProperty PackageFullName"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-AppxPackage -Name 'Microsoft.VisualStudioCode' | Select-Object -ExpandProperty PackageFullName"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:2144
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-AppxPackage -Path 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\appx\code_x64.appx' -ExternalLocation 'C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\appx'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_Process -Filter ""Name = 'dllhost.exe'"" | Where-Object { $_.CommandLine -like '*/Processid:1C6DF0C0-192A-4451-BE36-6A59A86A692E*' } | ForEach-Object { try { Stop-Process -Id $_.ProcessId -Force -ErrorAction Stop } catch {} }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2656
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\tools\inno_updater.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\tools\inno_updater.exe" "--gc" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" "07f806f999" "Code.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5852,i,6238247067020633932,3350653263600959294,262144 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5984,i,7765956964672131292,14975529155502254960,524288 --field-trial-handle=1932,i,10007527901730400171,1272803178936764764,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:1632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code.cmd" --install-extension C:\Users\Admin\AppData\Local\Temp\geaix-07864e8106084692a818ad5ca1918445\geaix-1.0.19.vsix --force"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\..\Code.exe" "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\..\07f806f999\resources\app\out\cli.js" --install-extension C:\Users\Admin\AppData\Local\Temp\geaix-07864e8106084692a818ad5ca1918445\geaix-1.0.19.vsix --force
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:1204

C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
"C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1976 /prefetch:11
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1648
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4180
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1791153436065605 --launch-time-ticks=884343978 --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3240 --vscode-window-config=vscode:d570260d-21bf-4869-b76c-a82fff2282c5 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3444
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3776 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3820
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:5588
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -NonInteractive -Command "Write-Output ('Version=' + $PSVersionTable.PSVersion.ToString()); Write-Output ('PSHome=' + $PSHOME)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2488
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:724
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:5100
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:1160
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:4980
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1316
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:4248
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
    3⤵
    - Modifies file permissions
    PID:5964
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:3960
- - C:\Windows\System32\whoami.exe
    C:\Windows\System32\whoami.exe /user /fo csv /nh
    3⤵
    PID:5756
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
    3⤵
    - Modifies file permissions
    PID:2520
- - C:\Windows\System32\icacls.exe
    C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
    3⤵
    - Modifies file permissions
    PID:1144
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4220 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3928
- - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
    "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel kill
    3⤵
    - Executes dropped EXE
    PID:4760
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4268 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4972
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4340 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\wsl.exe
    wsl.exe -l -q
    3⤵
    PID:3240
- C:\Windows\System32\wsl.exe
  C:\Windows\System32\wsl.exe --status
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
  2⤵
  - Executes a command shell one-liner
  PID:4872
- - C:\Windows\system32\wsl.exe
    wsl.exe -l -q
    3⤵
    PID:5636
- C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
  "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1936,i,2952403890804140056,2395723538368703295,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,13433968991530358865,15341094335414066277,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3564 /prefetch:14
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4172

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2748
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5100
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    PID:5044
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=7b1dc854-8430-46b5-b9d0-123e376b557a&iid=7b1dc854-8430-46b5-b9d0-123e376b557a&sid=7b1dc854-8430-46b5-b9d0-123e376b557a --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.140.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.7.3 --initial-client-data=0x504,0x508,0x50c,0x500,0x510,0x7ff64b954648,0x7ff64b954658,0x7ff64b954668
      4⤵
      Executes dropped EXE
      PID:5268
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1916 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5896
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2008 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:6352
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1791153436065606 --launch-time-ticks=1004942718 --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3336 --vscode-window-config=vscode:4e2bd2ed-a7f8-47fe-ac4b-10e72740ea56 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:984
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3372 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3364
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:1804
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        5⤵
        Modifies file permissions
        
        PID:4356
    - - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1268
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -Command "Write-Output ('Version=' + $PSVersionTable.PSVersion.ToString()); Write-Output ('PSHome=' + $PSHOME)"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7100
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:5984
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:3604
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        5⤵
        Modifies file permissions
        
        PID:4588
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:2616
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:4232
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        5⤵
        Modifies file permissions
        
        PID:4924
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:868
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:4736
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        5⤵
        Modifies file permissions
        
        PID:1472
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3664 /prefetch:14
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6928
    - - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel kill
        5⤵
        Executes dropped EXE
        
        PID:1464
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5964
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      PID:3672
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c start "" /B C:\Users\Admin\AppData\Local\Temp\installer_b1d68bb84d.exe
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\installer_b1d68bb84d.exe
        
        C:\Users\Admin\AppData\Local\Temp\installer_b1d68bb84d.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:7148
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:2120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:2948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1760
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4196
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:4704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3864
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:7000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:2248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1512
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1212
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:1008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:1848
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:4656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:3544
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:4916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:5516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5348
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:1204
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:5596
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:4924
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6492
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:7072
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
      4⤵
      Executes a command shell one-liner
      PID:2520
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        5⤵
        
        PID:7136
  - - C:\Windows\System32\wsl.exe
      C:\Windows\System32\wsl.exe --status
      4⤵
      PID:1676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
      4⤵
      PID:4112
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        5⤵
        
        PID:5736
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1791153436065606 --launch-time-ticks=1014883731 --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4372 --vscode-window-config=vscode:4e2bd2ed-a7f8-47fe-ac4b-10e72740ea56 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:796
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1791153436065606 --launch-time-ticks=1065608376 --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4148 --vscode-window-config=vscode:4e2bd2ed-a7f8-47fe-ac4b-10e72740ea56 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6132
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1791153436065606 --launch-time-ticks=1080060673 --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4808 --vscode-window-config=vscode:4e2bd2ed-a7f8-47fe-ac4b-10e72740ea56 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4232
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4228 /prefetch:10
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6772
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=4720 /prefetch:12
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2644
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1924,i,7832473707674947628,2013273382514468897,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1940,i,616731070387323249,140068875502138135,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:7164
- - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
    "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    PID:7004
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Code /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Code\Crashpad --url=appcenter://code?aid=a4e3233c-699c-46ec-b4f4-9c2a77254662&uid=7b1dc854-8430-46b5-b9d0-123e376b557a&iid=7b1dc854-8430-46b5-b9d0-123e376b557a&sid=7b1dc854-8430-46b5-b9d0-123e376b557a --annotation=_companyName=Microsoft --annotation=_productName=VSCode --annotation=_version=1.140.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=43.7.3 --initial-client-data=0x518,0x51c,0x520,0x514,0x524,0x7ff64b954648,0x7ff64b954658,0x7ff64b954668
      4⤵
      Executes dropped EXE
      PID:4244
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6092
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1996 /prefetch:11
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      PID:5384
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1791153436066220 --launch-time-ticks=1194336977 --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3452 --vscode-window-config=vscode:cba08b56-1555-4f1a-a30f-0eefc748b940 /prefetch:1
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1092
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2768 /prefetch:14
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2600
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:7024
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        5⤵
        Modifies file permissions
        
        PID:3316
    - - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe" --headless --no-auto-update --log-level info --stdio --no-auto-login
        5⤵
        Executes dropped EXE
        
        PID:4496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -NoProfile -NonInteractive -Command "Write-Output ('Version=' + $PSVersionTable.PSVersion.ToString()); Write-Output ('PSHome=' + $PSHOME)"
        6⤵
        
        PID:2172
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:4556
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:7096
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        5⤵
        Modifies file permissions
        
        PID:1008
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:1848
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:6280
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /reset
        5⤵
        Modifies file permissions
        
        PID:6976
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:6632
    - - C:\Windows\System32\whoami.exe
        
        C:\Windows\System32\whoami.exe /user /fo csv /nh
        5⤵
        
        PID:6648
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /reset
        5⤵
        Modifies file permissions
        
        PID:6592
    - - C:\Windows\System32\icacls.exe
        
        C:\Windows\System32\icacls.exe C:\Users\Admin\AppData\Roaming\Code\agent-host\local-endpoint\entries /inheritance:r /grant:r *S-1-5-21-4280978039-528710165-233981602-1000:(OI)(CI)F *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F
        5⤵
        Modifies file permissions
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3548
    - - \??\c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
        
        "c:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe" tunnel kill
        5⤵
        Executes dropped EXE
        
        PID:3036
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2492
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --dns-result-order=ipv4first --experimental-network-inspection --inspect-port=0 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3904 /prefetch:14
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      PID:6608
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c start "" /B C:\Users\Admin\AppData\Local\Temp\sysprep_8ba71f965a.exe
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\sysprep_8ba71f965a.exe
        
        C:\Users\Admin\AppData\Local\Temp\sysprep_8ba71f965a.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:6620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6340
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6356
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:3132
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6688
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:3664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5128
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:2388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:5728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6776
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6764
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:2172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6864
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:4540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6752
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6780
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1532
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:7124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3372
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6152
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3276
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:4956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:2324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:5388
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:4164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:4344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3164
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:2332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6732
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4136
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:5436
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:7100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:3844
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:1060
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6192
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:3404
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3724
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:5112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6924
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:4852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5264
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:2332
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:5540
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3460
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:4968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:1632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1116
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3480
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:4668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2856
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6516
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:52
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:5496
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6808
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:1944
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:5744
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2756
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:904
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5016
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:5388
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6976
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:3408
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:7012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6100
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3492
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:4312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6004
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:7016
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4040
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6524
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6652
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:7120
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4156
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Enumerates connected drives
        
        PID:6484
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:620
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1768
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:628
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1948
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:5056
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:4336
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:1680
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6348
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2504
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2632
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:4292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:5812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Enumerates connected drives
        
        PID:6576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:1652
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:2648
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4296
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:1848
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:2876
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:3104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:5964
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3872
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:6300
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6724
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:2568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6308
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:2120
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        
        PID:824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        Executes a command shell one-liner
        
        PID:4904
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:6584
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress""
        5⤵
        
        PID:3716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -Command "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine | ConvertTo-Json -Compress"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
      4⤵
      PID:3636
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        5⤵
        
        PID:3844
  - - C:\Windows\System32\wsl.exe
      C:\Windows\System32\wsl.exe --status
      4⤵
      PID:1116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wsl.exe -l -q"
      4⤵
      Executes a command shell one-liner
      PID:3976
    - - C:\Windows\system32\wsl.exe
        
        wsl.exe -l -q
        5⤵
        
        PID:1212
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1791153436066220 --launch-time-ticks=1203854900 --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4640 --vscode-window-config=vscode:cba08b56-1555-4f1a-a30f-0eefc748b940 /prefetch:1
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3016
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4968 /prefetch:12
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6712
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAOAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=940 /prefetch:10
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2380
  - - C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe
      "C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\Code.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Code" --standard-schemes=vscode-webview,vscode-file --enable-sandbox --secure-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --cors-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --fetch-schemes=vscode-webview,vscode-file,vscode-remote-resource,vscode-managed-remote-resource --service-worker-schemes=vscode-webview --code-cache-schemes=vscode-webview,vscode-file --app-user-model-id=Microsoft.VisualStudioCode --app-path="C:\Users\Admin\AppData\Local\Programs\Microsoft VS Code\07f806f999\resources\app" --enable-sandbox --enable-blink-features=HighlightAPI --max-active-webgl-contexts=32 --disable-gpu-compositing --disable-blink-features=FontMatchingCTMigration,StandardizedBrowserZoom, --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1791153436066220 --launch-time-ticks=1347678837 --field-trial-handle=1964,i,11834238675082064448,16803115850973351043,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EarlyEstablishGpuChannel,EstablishGpuChannelAsync,PdfUseShowSaveFilePicker --disable-features=CalculateNativeWinOcclusion,DropInputEventsWhilePaintHolding,HideCursorWhileTyping,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,10891843835023531335,5034710450912051575,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=1148 --vscode-window-config=vscode:cba08b56-1555-4f1a-a30f-0eefc748b940 /prefetch:1
      4⤵
      Executes dropped EXE
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1748

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.txt

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\LICENSE.txt
Size 11KB
SHA256 d907e7f3f1396695c474d1376c40909921ffb1fc608d2504992809a6da1742f9
MD5 fe96034c02a5c43e44605029f233d7bf
SHA1 15c1b2654f4c6b7adaa94feb19df71b57256a256
SHA512 b547c2e43c7b9fd85267eca1842258cdd878c29055714fa623dcb61e30f3e9666da3f2329d3eb91fc80f317ca9d4362eff2a3df6ffe61cb26ae3b541e9146bda
SSDEEP 192:fU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEt7HbHR:M9vlKM1zJlFvmNz5VrlkTSw7Ht
TLSH
T16332522FBA48037716C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nest-pipe.svg

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\assets\vscode-material-icons\icons\nest-pipe.svg
Size 4KB
SHA256 fe2148ec5a2bb5155a3d3a201bf8cfc8e54de5c0f8a74dab18e837f0470a58c5
MD5 70ce643863aa71978c5214fc3a2e9913
SHA1 f454698b4afa0f446bf1b591da2d12b530193610
SHA512 555ebe4b02220f735e5d05ef078e5915cb18b2f35874d63a22521d5f8f96092a914ef0f6547608d22b6d17fb1fd562e98be9a9e80b1b8562a2a8d557ecda3261
SSDEEP 96:bHyirVzurv3ipimCEHY7h2bnRpCigdgfDUMJPYHSfSUSYhL9Hn32Iw:Dlr4rv3ipimCFMRpCzdQDpYHtq9H32Iw
TLSH
T12AA104398754C3B89DD5D5FCAF629078A08EA0CDC0F7C79582E5816065E35CAF24F89A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

worktrees.json

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\dist\i18n\locales\tr\worktrees.json
Size 120B
SHA256 64b7aa0a3f3cf14704de9deb2ac64281cd7fac0ec45dd3e73a7545dce95fa30b
MD5 f1ff4830e6738ffb92f1c5bad90ad0c7
SHA1 f1923c11a19c77c3139297d52ad18fbd270178b8
SHA512 7ee019c9e5859fbafb43a792b537e74e1df784c7549b6183240ee29212158142fecd2f999c9be49bcc3f3e80b4bc7b0d9fa16c18d46b8865e2eb042e3b9d26d5
TLSH
T1D3B092EB23049433C66E4E4F87471F10006D485F987D02080980996C41620E8429388B
MD5 SHA1 SHA512 TLSH

Submit Download

KaTeX_AMS-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_AMS-Regular.ttf
Size 62KB
SHA256 68534840bcfdd2bffb6f0e8deb48684dd01e7f04ea2813267577afb906de1d13
MD5 56573229753fad48910bda2ea1a6dd54
SHA1 1dfd0ee6e30f8a1c23999d9d965db8700b5a9f2e
SHA512 456634c8b2b87bac6ed10b3f8393fa01040f73fa3a5d66c868b13ca1ff8e04961347455f3dfe9fea50dfc6945c7996ff31827a70f1c09461ca16faaeac2c0364
SSDEEP 1536:Jmht5PieNKntVPEefbJbH1I2CYmixLRffac3Eg4fgmiqZFAPNfLT:g16FFrtmiXfx0ZihPNjT
TLSH
T170536CD6C3F6FA1EC97BE73146946002D0EAE420FE79963EFE43968DD0575D0909EA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_AMS-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_AMS-Regular.woff
Size 32KB
SHA256 30da91e84c893f875e252689faebdc590b2871145e8adc7f9a9d4dbd8ce0b251
MD5 10824af77e9961cfd548c8a458f10851
SHA1 99ada2de3200e795143d639232c3444b08018235
SHA512 f4e4e65c3894c93642d74244c706ec7fd8aae4b071fbd97b0fd0b8ffa8be97475ffaae159a846e064aad386b1026ae809379678a4bab36b5db7e9a287a63515b
SSDEEP 768:lwtLGVnFPkmlTw2Vm+6XCPXZ3UI2LtAaFHiFqOh:lwtECyTjVSXCxEptAUCMOh
TLSH
T185E2E10166C31B2AB618DBBE4245FDCA5DB98CC067E7A7DD701E1E8F140B2B83A63449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Caligraphic-Bold.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Caligraphic-Bold.ttf
Size 12KB
SHA256 07d8e303ce4fc12b4bb54f1004170dd190a1f3db45d400fe68060df3e0897268
MD5 497bf407c4c609c6cf1f1ad38f437f7f
SHA1 8fab738a16ba8fb7e7002a075f036a455a45c6e8
SHA512 e968586a792bac38c0d1ddfa3342f845b99a77a8fa958d6fb97a7fe00a1c98874107d570592577ca8dfa2bfca0902bde18f92f65134999f06175a4e00cdd2bc2
SSDEEP 192:0KDRWsPUKoUoKTNrqKUkis+wKXZ55wJkgcwQfLFp/ROu2O2LkFEr:0KlodKxjUTpr8kgMfLxG5
TLSH
T1064209C08362EA5DC2EBDA7406E0A257C7F3BC51FDB9D32CC91245E8D0664D8945BB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Caligraphic-Bold.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Caligraphic-Bold.woff
Size 7KB
SHA256 1ae6bd7475590e97e7f145a89e09ccde322f7a6bc0b91607b1c8b8ee28290fed
MD5 de2ba279933d60f7819ff61f71c17bed
SHA1 dd23ac0fb0ac469b0624485ea78d700f63614203
SHA512 75f5267bd42d7f22e85ee9208454a74ee4e52ec43ff0ee980b44277db7097ab992e017274b8c969194f53049033cbeff3949d51dc052b8b96f3db410be224b1b
SSDEEP 192:OEU9cXj7NPWDjT47BqzzPvXYZqYOFPrEYxinnv2ciqd:Op2KjT47EoZilinp3
TLSH
T17EF1BF43E4F30A13FD1A9B7461C40E0F33E303B0A78DE2EC588E75260D28AD450A0B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Caligraphic-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Caligraphic-Regular.ttf
Size 12KB
SHA256 ed0b74372feefcbb9c0666b2e210da37b7e49fa7fbbf3eeb11db5f693dacfbb7
MD5 e6fb499fc8f9925eea3138cccba17fff
SHA1 26f26a13e6a7d0a69b48f62acd31a8196bce7f6e
SHA512 4f616ef3d60cbc99c95c473f4c610020416a3911fc1e74e55d854da1fc92c88e98862ffb12bf991f91694227844b7773b71412697f1a68648755e726031d87d5
SSDEEP 384:kEW4b1GSLxPnejPKa/3RDzpr8kgMfLYhh:91/LxPnejia/Dr0MfLYhh
TLSH
T1B04229C08395AA1EE1DF9B3406E4D152CBF7B951EEB8E71CCD820589D465CC8491FB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Caligraphic-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Caligraphic-Regular.woff
Size 7KB
SHA256 3398dd02302557a793f2863f88e02d96ce10df2abffa07c8e9fa90775116e65c
MD5 a25140fbe6692bffe71a2ab861572eb3
SHA1 1a6f39bd70c9b74713078df5f7dd6108f9bad38b
SHA512 df52edd6bcabbed432171c2b001c36c598a88c6180c600dfd688d0155cb5d66ce69497e7dfc4154b0c484a7b9d65506bb25b07c9a8680ee64aeb006b6b227f2c
SSDEEP 192:It0lOpC+EvcZ6aTD36PSw3R2qYOFPrEYxinnv2aNhJd:It0Ok+k4l/36PbR2ilinP/
TLSH
T1E3F19E0F2AB5420FE72D76B42582D5596261B3B0680BA6D850BE6DA54C5EB3C4334FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Fraktur-Bold.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Fraktur-Bold.ttf
Size 19KB
SHA256 9163df9c7122432e6495b4229fa9071cf9ae86a758ae5efc4924ec2e1a6dbce1
MD5 b9d7c4497cab3702487214651ab03744
SHA1 4e08dd00383124e7cd96970ccb0fbe35c9efaaa3
SHA512 14296d0a12b7a1747e71db0721a543017c11d2cbfa3c8485490f959660dd67257f1a007e5e34e1d864c363a03d482ceedba3d1a8ba0f48cf03140d4da5dbc836
SSDEEP 384:k2zFaMfGXGz/DXOvG8+jK0p1kpv0IdbCg5m8Wp/2epr8kgMfL3PyEl:7hLfHzyvG8+jXIuIdbCg5m8c/2ur0MfR
TLSH
T18E927D40E3639D9FE1D7FFBD4A90A1B3DAA3AE06D831924C4A53405DA1999B04CD7FC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Fraktur-Bold.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Fraktur-Bold.woff
Size 12KB
SHA256 9be7ceb88004ab8ad124082246fbfcca4091e36385d4ec6ed1df67375dad50fb
MD5 40934fc076960bb989d590db044fef62
SHA1 5bbafd501f262219426af7f20c1103bb4b732592
SHA512 6db0e3d500339de09317dfffa278b5ac8437c0a8ed317da419b4ab61a54d24e08e3ce1d60fe327f1908009000acec567597f4807c5f55306b3ca3cfde6498f02
SSDEEP 384:27H9D4SDxHkuUWF/ljQYecDre1WyPilinmn4:2BH5ywlnBrHnim4
TLSH
T14C52BF5126A21933E53E4CF40156989FCB65C344EDCBD96CE57BD53C0A18AD2A39C8F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Fraktur-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Fraktur-Regular.ttf
Size 19KB
SHA256 1e6f9579e90e2cac37f8f60a597c436e075c114385652b7cbeb0dec0421291b3
MD5 97a699d83318e9334a0deaea6ae5eda2
SHA1 17db40882dd5f140625f28dd94c43045e1893e98
SHA512 13747eb5911d17302923e9d54640acf6bfe533f020d535713a1b951d96721d7aac19c7705440cb7d0a26b384258c2c5190771961e2622519d99c17998a37bf47
SSDEEP 384:WfsAqO/MdyFnajLrmL/GzOpcz5ZDrTpr8kgMfLIv1G2:ShEoFas/GzOpcbDrtr0MfLIv1N
TLSH
T15C927D40D3A2C50FD09BFFB44780A1B2E9A77E539E76822C5A22415EB085C6598DFFC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Fraktur-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Fraktur-Regular.woff
Size 12KB
SHA256 5e28753be717dac97f559f49bc10be9cf3c124ddcabda6659d11cb68febc6463
MD5 e435cda5784e21b26ab2d03fbcb56a99
SHA1 6f756376360f0815b44862f57f795eb7c1cd4db2
SHA512 6e9843b5a5d86e29819244bc008cb0d1a05b0d6a0c564784230027cfe45ad4badcad9c4f09aaa257ad793f783ccd1bd609489fab57cd040aaf1d82ea9217754c
SSDEEP 384:bX+KfLf7QVrRVmYlMQ6zB3Yn1C/CyilinY5H/:jfjmrRYvon1CKDiYx/
TLSH
T18C52D063B0B39643F20FC3F408688D8F3EA94107DA9E6652D1EE44C4027E34E6353E84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Bold.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Bold.ttf
Size 50KB
SHA256 138ac28d1663b3037e9c5f52371fa5c63d8324f4a38d22cd573e6ea3a3fd0cf8
MD5 8e431f7ece346b6282dae3d9d0e7a970
SHA1 413ab3dc3fc3a5752275bae2cae67eb58f2b32f0
SHA512 4347e693e276c8baf6ee8413c46b1bc2bee4eb8ba4ef4ffb49fd5fcc6a3da2cb84e7654d87d2a3c640ec0a906ff64e2ece55c45d450753b82055a1164cc44215
SSDEEP 1536:bMqnbuev+IMrhg9nzhO/9SvwurRcfMdDfL68xD:NnbuZ+Fk/Mhj6s
TLSH
T1BF336A96C7A4F90DD11EEB35CA86A213D1E7B614FFB9837DED03498D88AA4D0848F741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Bold.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Bold.woff
Size 29KB
SHA256 c76c5d696297d51b9cb1639c7da4334f0e7dec81b42b11213b5e25ef671bb822
MD5 4cdba6465ab9fac5d3833c6cdba7a8c3
SHA1 f69a36250eae6e8a02173a9909aa628428ba2060
SHA512 f941865e7e1faa24c8e63f6f6c72bba4683502b4723f52a3335d2d4f24637445d45e5f15612f1516e29c666ed363348051b282c8c44ea4c6abcc23cd761c1460
SSDEEP 768:ZBht1jPbcFAi1RLpVBjUe52dawyDBGCLzacm+CxBcnFA+AmoVM:ZB71fyrR5f8SNnaV+bj
TLSH
T122D2F18651E88792D49D2BF300D2C5E72A27D00010DACDF8C7B7598D812BE9CFD756E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-BoldItalic.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-BoldItalic.ttf
Size 32KB
SHA256 70ee1f64a20f2048c21940ef46d0144fd215baa953ca69afd1e31e98544f708f
MD5 52fb39b0434c463d5df32419608ab08a
SHA1 ba6464e442fd50aef7678924ba0f2d9581ebbb07
SHA512 ec9e2fd832ce22a5e1b0f16aa016284a18144017b955e4d5ee7040f9a1877551029108eadfb1e038d94d896e567f29a8aef547a7fb8806c4d34b3b953c2e9a41
SSDEEP 768:dYM5khBrOEgXmqdTrSHDBBDVJGzPix25plshTYXrdyMfLxur:dYgk/rOE9vfSPiCplsh0dDfL8
TLSH
T15EE23A81C785A99CD20BEB39C5D2E622C6E3B920F97C831DDD435A9ED8648D4D05EF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-BoldItalic.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-BoldItalic.woff
Size 18KB
SHA256 a6f7ec0d846ac7ad975adb8959c37ed49b94acbc4ae436db9ce9e20287e4a64c
MD5 5f875f986a9bce1264e8c42417b56f74
SHA1 038bbdc8887a9730ad94147fc57c6ff4dfb48411
SHA512 01740167b08510f9948531260f6f746b06b2d4232c5c6fba07533673490a7b0405839ca7c087bf16bc97ab874dbdc4e1e828ede0fa8c32cb3ca22f799348ad4b
SSDEEP 384:F6m/Vu6fZIY1pNhfKHEXle6bB+nT+Gjl2dkMauwry7wJEbMCe5yq9OtKf:FJ/z2ipuEg6bcT+ElNuWjqNKf
TLSH
T10F92E13719EB8143DA5F95FA099976861FB9467002DC91C6E0C8FF027B2D3E4B5588F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Italic.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Italic.ttf
Size 32KB
SHA256 0d85ae7cc30f23790a7f1a58c4a112fdca8aae769b6ba11429af1d98b1b6cb3a
MD5 39349e0a2b366f38e2672b45aded2030
SHA1 1d5668a2b94ae7dbeefdd7cd68d98fe9d5825e07
SHA512 b3191aff76f38c75c7c8e3ed4b82c520e7d03eb1c4021933013f54906d7ea166eab7ced7369177dba0df86b2fa9e7e77ce2ce0b9b9a8a0518089b9728821509d
SSDEEP 768:mH5kjyXWWcme53V6fGXDcRwn/Byv/RM97UW5YIXCTGrdyMfLQLJ:CksqF6+XD8wn/4/yAJIXckdDfL+
TLSH
T146E26CC28398ED1DE55EEB39C991D051C6EBB820FABCD61CDE434D8EE4908DC499F182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Italic.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Italic.woff
Size 19KB
SHA256 f1d6ef86f3b11a528bd5185199bd2443ecb2b0dead96d88674b5a2c12be24bdf
MD5 8ffd28f6390231548ead99d7835887fa
SHA1 7c8589213bc7003e2c2334b51ca4152858987abd
SHA512 3a39963134880e54dfd591a1390899b19010d5cc92a38122ce1aac853bdbbaa66481b52d574dbdd610bf40dfa8e3e54573b381c5a29661a2608c546cce9427b8
SSDEEP 384:Fd2HPakh3w/mgc5jJGNx2JViY1nX+72xtZYSWvfEVus5yq9OooE7:H2HNh3w/TUjkNQ/1nX++H8vnIoG
TLSH
T16E92D11581A67B32D8F8D9B34E401E6F13396278A4DA930A515EFF9C37E638E0119BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Regular.ttf
Size 52KB
SHA256 d0332f52868370fd83ae7fa46470f90c8f2eab2fcf12bc4f88080b340c95a830
MD5 818582dae57e6fac46202cfd844afabb
SHA1 8744db6ef8c309e3dc85f1bbe980520ad8b7bfd4
SHA512 fc4a33bdcdc48da1d387370f55ea7e69737f85f7fea25d0eaaab620e4b278b63638000200f1700f5019e8fdcceb67aabb2e9ff3c347cfcdede97dcf466ba4a73
SSDEEP 1536:c2oUVCqROnDgt03ljHOAvVy6UV3vlUNUv/f0DZ5vBmvPzldDfLf5z:c2nOnDgt03ort/8alhjN
TLSH
T14D336DA6C3B2E90EE46EA3348590A247D5E3B411FEB9C72CEE139DCAD1855D4448F742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Main-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Main-Regular.woff
Size 30KB
SHA256 c6368d87e8a1a3a5d337623d83d8dc4b868f242a9ad476237d6f8d1e0f168cdc
MD5 f1cdb692ee31c10b37262caffced5271
SHA1 fdcae54ba1d4635ee85a5462cc1c97e521cfd515
SHA512 7bf47a13f931a5efd924ea1e94413f529d65b88f931a09d993bb2a0f95848199e2de64fb4ae2485de83e4ddb3a690556dc453939daf3910832ed22af82697037
SSDEEP 768:yRvm9ltyZLNA0q37Cs3IM5nkO7yOZaIpxX3Y4G/tf:yRvktyQd3u4ln7yOZ3X3Yrtf
TLSH
T165D2F15306F66976FC6826FB69F08BB4E5C5463142C7A8F9400871E486D3BE46B35A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Math-BoldItalic.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Math-BoldItalic.ttf
Size 30KB
SHA256 f9377ab0271cda59af24bcffbd46a4d0c8a3572ffafdbb38de2ad5ea7b0d5ee5
MD5 6589c4f1f587f73f0ad0af8ae35ccb53
SHA1 e80cc4c232d2075f762a52d46beb4ffbd37a5f1a
SHA512 877edd67dd08990794fb4f153509308914b087d7d7d92c698b3c9a93cf1ad75aaefecea6c9227e192eb8a7bbdd94358c810f28a6097f319ff87a91811bc67328
SSDEEP 768:HrDqekCKYnYviw3SNoo0A2p9FnIyATLrdyMfLLFxO:Hru+piRSN/Z2TFBKdDfL6
TLSH
T16DE25CC1C7A1A65DE21BEB3DC682E216C4E7B911FE3D571CED13598EC8648D0E09E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Math-BoldItalic.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Math-BoldItalic.woff
Size 18KB
SHA256 850c0af5c2238497febaf5e461d880bf458c341f42f4f330f1b1ab5698b1998e
MD5 48155e43d9a284b54753e50e4ba586dc
SHA1 d54e6480d6d4046c6a5619aa383baa5971fb8a0c
SHA512 bce52e5abb56aecc2aa3a6f2697a5d2975322550108d9768bf18d732ab7677ad3bee13973f86ee0fdf82106ce088974538b5e0572b7aeb7420db857ab6aeead2
SSDEEP 384:RTycdkV7rbnINOwZD9qojbjtAbIbPZk+BGNZq/aU5yq989HGZly:TdWIN7N9q8XyIbPa+BuHfmZ0
TLSH
T14F82D0108D92DF25E08E4FBB23D38BA563A0C609648C12AC64517DDD9D4E7CCB2CC6D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Math-Italic.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Math-Italic.ttf
Size 30KB
SHA256 08ce98e51b04d58945a301e639e02b6998af29fdfd61a7b8afdd07bbfc479d4a
MD5 fe5ed5875d95b18c98546cb4f47304ff
SHA1 9e9a10d8fa5ad88c9ecfa4902addd4d92580b2bc
SHA512 37eca95ea4704525b727ed29c19a993ef22b54658931cc58fe5a2f7d3a231fb18da6d3461141e054a941e2639c4559c0f4fad8bfee89e08e1077077ffc773a73
SSDEEP 768:iCM/Am3RjXaXNUFgxJL+htKHObpS0Hl7TFlrdyMfLMoRO:i1/AmZXaX5zL+htsObsQlPFNdDfLI
TLSH
T19CE24A80C352DE5ED62BDB32C191E512C6EFB920FEB9931CCE03599ED4614D8989F382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Math-Italic.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Math-Italic.woff
Size 18KB
SHA256 8a8d244581371912b8f3f5a23e2437cb2a59cd9bcaebb0346e722c05737a2571
MD5 ed7aea12d765f9e2d0f9bc7fa2be626c
SHA1 1c1b48739e1cb4be13ddd8c0bc279dde851bdba0
SHA512 4d4cb5eecf613e0b0ad217b7689c44b69bb8b5dad7220030491d3026792be1bd0134a48401aa75a2b87b300d90813fca395e686fa64e58eec7a9bc3043d19572
SSDEEP 384:7daHi/25lGu5h9GUA76bmQWlsH/wyew5enV2QU5yq989HASXZly:7AC+lfP9G76b4lmZ5oJHfFXZ0
TLSH
T16082E1E42813C366F47DE6FE4119630B99989710023B9220A71C13AFCAEECC4ADDDCD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Bold.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Bold.ttf
Size 23KB
SHA256 1ece03f79f95277d57dc7f6b435a74e1379b0d46104a8530286b60ff49369ea0
MD5 f2ac73121357210d91e5c3eaa42f72ea
SHA1 20b45f5346b686d52c445745393d1707bb88ec1d
SHA512 aa1b4c8161441d57339f9e7b6a7e4726fa7a5edf4e306a15f59cf7f3d7124b2708d7b7864f329a34c38f2caf7b8decad9b1eb5f12806d85d32555378cf143f5e
SSDEEP 384:CaBGPYdZsxFHLDldfACuTrDs+nmhZ20FkKoIYP6F62Lei8+YaCrdWkgMfLqjDx:/B0qydnLfAHnKR9qDXKYprdyMfLqjV
TLSH
T16EB20880D730A90DC05FDF358AA5A64AD6B6BD51BD78C32DDC03909D19578EC88EF782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Bold.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Bold.woff
Size 14KB
SHA256 ece03cfd83e22c212cdef66feb8442d25a083beb988db3f1883f3f9738d750ba
MD5 0e897d27f063facef504667290e408bd
SHA1 a2beddc8a3d4d08028d707776edbd4d24f2ec0fc
SHA512 c7c5c3bd4d455ad577552571c2ef73a62a015de8823d4e5e3d12629eda31a751ee3e0dcb045d170b45fd7ce9ce6cee951c4b50b4ac3329f7af34b86b416ce2f7
SSDEEP 384:G4gJfti9c5SgntvMqmiuiub9Jvwd90rKT5yq9OYUv:c49ccgOiQ9xwdSPv
TLSH
T14552C0914DF1C204DACE28B446C490772FBA82A002D5F1DF871F815A6F6B7CDE2769C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Italic.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Italic.ttf
Size 21KB
SHA256 3931dd81faed86ba021bb2bbdc36f5bed9a38d6b4f4077aca59b265aa1b02083
MD5 f60b4a34842bb524b562df092917a542
SHA1 991fbdc03168bb14a4447cfa3e515f09a6ecfedc
SHA512 bd96804c21c6896d99be43b95d449e990128de74c135a16a8b18148fed7dc3fac1ab60d1f850a463f242864902e52729d1e23494d8c2c73870dac9a33184678b
SSDEEP 384:498b6aOH8MJ4avOk8Q4EE6trSF7/XobqtMgGXfbdXN45WvclNXCrdWkgMfLI8Sq:4VthZOjQ4rCC7XoKCXFN4SOgrdyMfLIm
TLSH
T101A28D409345CE1CD06FC73916D09342DAE7FE64BEBC931CDA8395EAB8804D1A8E97D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Italic.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Italic.woff
Size 13KB
SHA256 91ee67500cc0129aa0ace3ac5c61ff1692102f0f31d02b69347fba35dcb75bf2
MD5 ef725de572b71381dccf53918e300744
SHA1 7564a366b76fd837041c24beef4c5580a5add40e
SHA512 58d1ffd474f3ab2fb3649a7d52e4f8c8c48aff29c3d1fd96778698df0d262947b3589b579fdb9469aded01dc39ac4edf8a7003d924f2db80b3c1592efa5739c6
SSDEEP 384:n+90aUBcewkTlNckGfTNaRO5yq9Ojgvy1:+90aUCR6Nc5RaTDgvQ
TLSH
T1D952C002825BB300DD1EC4FA205D8B1CD9E8718D04DA75D625F607DE22C7EE3A86AAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Regular.ttf
Size 18KB
SHA256 f36ea897e19f4a2e571d1e900e4e3710e438deb05a842486045ba0a3e616a4ad
MD5 3243452ee6817acd761c9757aef93c29
SHA1 4a8e17a0cb58a8228dd4417fbd1b899e41dab045
SHA512 bd924acfde1e4d013f7b0316aa0056554937ea97a509833ba9d7dbed1479d7d6341c56f203b45e2cd2263a421e94ed9fddf0c4728e8926f6c35fb5193c87a9d6
SSDEEP 384:aLtjIsQmXmyLGjJiQtyMfPRSf3b9RXvDbgnCrdWkgMfLxESq:anQm/LCJj7fPM/b9R/HrdyMfLxEd
TLSH
T10D925D01C3A1DB0EE46B9B3C51B4A293C6E7AD19FCB9C71C4DD35155AD86CC084FAB8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_SansSerif-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_SansSerif-Regular.woff
Size 12KB
SHA256 11e4dc8a6471ff6d6ee561d53d10fde8f7489e798257ff449c5d37c197435605
MD5 5f8637ee731482c44a37789723f5e499
SHA1 804610f4cb2e2ead9694b8da2ec84ece8d09c38d
SHA512 3b89871f359e98089b2f56150531b494f65645d70d43f41b9f6fd2bd0e60cfd091107af7a56420acb23b56ea9272e763ef86b3775bf44b861488dba8163c1fa0
SSDEEP 192:G+BKlJftseS2v0uhv0IMvWyBupd+64QfDp+CP6qYOkdYxqEtofWM1Cfq31:HBaJftrJMuhs0pY8fNni5yq9OM1+y1
TLSH
T12A42D041B3AB8F12F52ED2F0221D45080B34A747097A79FB11B48D942F0D6CD79F7969
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Script-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Script-Regular.ttf
Size 16KB
SHA256 1c67f068fea8bb09bf099c088b1cf64bd27516a6e07f4684344873564bb66a67
MD5 a189c37d73ffce63464635dc12cbbc96
SHA1 c6f675da81ad29cbf24b2cf770f795b4da2c648e
SHA512 374df932f9c98a6025c48e8747afb0f702ee11fac6ca669edc4385b2df69b16a01aeeb7754ce05f3fccb4d01f7d3a2e50933c23f46ad3e566c0f5da461705e40
SSDEEP 384:HWx3pzL83MrPcR2Dn1gjtR6qTIGpr8kgMfLRJ/L:I3BM4PcRK1sEGr0MfLj/L
TLSH
T1A07229C08291A54DE5EAEB3485A0A103D6F7BD51FEBC9B1CDE1319CAD0754C8C4AFB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Script-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Script-Regular.woff
Size 10KB
SHA256 d96cdf2b3bdd4d64a8fd5f74a4c467f123a8a73931cd435889f08ffaf9bf947a
MD5 a82fa2a7e18b8c7a1a9f6069844ebfb9
SHA1 6a05cdca4f1f7085e607dc38bedef55753f86fd8
SHA512 1a767acf7f1069a44d99f38b6a29287b9c741e0c50d2a85f8b97863ba4337474d77468935b157e46360faefa16fef73d064fc17551fdbc1708383857b70b1866
SSDEEP 192:UPTpg95R21+dmECPCOwm0z/lftGneS943KobFjULNzlqYOFPrEYxinnv2AECd:MuLIMdgsm0zdknh9aXbFIVlilinpR
TLSH
T1B722B06ED971C241E059573946068CEC3E4864357672C3F4F97EED45462B31CDE48A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size1-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size1-Regular.ttf
Size 11KB
SHA256 95b6d2f1a50173bfedb8c63e1d1c99b10427d0a4df4201cb44513b226951a22b
MD5 0d8d9204004bdf126342605f7bbdffe6
SHA1 3280bacbcb1245971fe01017b474c76c337c10c9
SHA512 09ec1956348b69fb16aa33c1fd6774230cd2978eba3470618c9aab3c8fb006ff4b092318416d29f8772804158d8993d65229cf2669631076af055f83c6326e3c
SSDEEP 192:UgM0JKnDigtle3n55RSnDSPXM55IJkgcwQfLq5OYR+/O2LbFEt/:UgMlDiuwNPcrUkgMfLej+/A/
TLSH
T146423C844BB19D0ED8EB9A745AD17597C7D7FE70EE74823D8DE204C8900B0C98897F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size1-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size1-Regular.woff
Size 6KB
SHA256 c943cc986384f59e86bea5fd7dc50a9c4dfe567a7c05eb40d6790720dead97c9
MD5 4788ba5b6247e336f734b742fe9900d5
SHA1 aefe6674a56533627c739cd7896398f14487e01c
SHA512 5e43a366f9bc3a4eb7cd0e907d930c158574fd61b9f6ac72f3e9fc22ee95ab36e8f52f8786fb14a6840310a2ce4bf0652e6bd64318caa03251770ba1b795cfec
SSDEEP 192:X8NgemoliTfsQsgR1BK4j0wcVam5qYORbNZw+nx/:MNx8XR1B70wcVam5Eb4+nx/
TLSH
T143D18E64CEEEA3C3D5CE2630FDF6D2606ABB83C812DA4B63D5D395B44E046062447676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size2-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size2-Regular.ttf
Size 11KB
SHA256 a6b2099fb555c60e3a0db3a08842ebf1d732c6eb4e4bf44913613bed4fc4e39b
MD5 1fdda0e59ed35495ebac28badf210574
SHA1 faf73ff3e795184e5431666ffafeb8aa0e28834d
SHA512 9efa6449884dba1e18fb2207a296481ade8441f077b019d4a3f304d298442a6e65acc8d5f436edc3e496605185bfa89eeeab31e3b3baed1a91550bb05992b633
SSDEEP 192:4Lq5FdCpQGnCnT/YCc9CXM55IJkgcwQfLq5OhWO2LGFExj:46FdCORLcrUkgMfLePZj
TLSH
T17C325DC403F29E7EC4EB8A341A5422C6DDD6FD82DFB59B2D89D1458860128D8A077BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size2-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size2-Regular.woff
Size 6KB
SHA256 2014c523c3210bcc166648c4d4cc57f05b747df07a24277bf71c51e67dc79e3d
MD5 b0628bfd27c979a09f702a2277979888
SHA1 46698ff1819bd27826fd5d2dc4ba4e1f63cacdf4
SHA512 f25712b2afb43941d0d6dc4638efa16d79514fd1e31745e67155d4d6dae02ad0c9c7e7ead9e8c8d34c095ff25dfaac3b7bbd01b0e22e86f858ffd3a0e701b18b
SSDEEP 192:a00sEpsJhzmL2QYufCYKTFqYORbNZw/sY5:oswsraZYW6Eb4/sY5
TLSH
T19AD18F014B012AA3FECAA731623B90A97752429C13FEBFDAC1DA98ED0D346E9444D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size3-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size3-Regular.ttf
Size 7KB
SHA256 500e04d54f0d51666332c9d2089aa803be22aa878eca539e59fa53c6e522b082
MD5 963af864cbb10611ba33267ba7953777
SHA1 302a61b2ecdf82d39e6780f42bd07ee4ce67b8d5
SHA512 f0b1a1f3b5a6e3e286972a02586b6a1aa442ef44c9bd9bd14319a98293c07d61c21fa344ceb98c4242c80bfb83cea5c9c672ea23ad3119f632eab338e63f6cb8
SSDEEP 192:gvxUwizK8ZomXM55IJkgcwQfLq5OeeO2LRFEsM4:gvxYRZomcrUkgMfLeW/B
TLSH
T157F11A8513E2C62ED0EF5D780FE03186CEB7FDA26D74633D8591819860168A85873FDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size3-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size3-Regular.woff
Size 4KB
SHA256 6ab6b62e9b62dae2c00dd90f791bd10950be0ecc3490d7d6045f51c2e8fe0949
MD5 4de844d4552e941f6b9c38837a8d487b
SHA1 1da1905a6d1d9bcab92b059df72b528dea708bcb
SHA512 128df9cbe651785a6646066fd0dd9d280739820717184df09eb09fdbcaa7bb91b5f8892f7b0d0816474260dd48e859c7b0f0d39d0ce325953bf85ee8058bc729
SSDEEP 96:v76om+A9DNKvsZyKt40+cCOdOpEmznbKJQZLFwfsjA:eN1UvsZrtqYORbNZwfsU
TLSH
T1EB916BA89D6336D3C9DE6370A506E11D3AB341CD23DEA153A0C695EC1DED38112AF328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size4-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size4-Regular.ttf
Size 10KB
SHA256 c647367d1dd4e162468717d020e1fc0f1dc5c26ebfdffbe55261713bf88c5877
MD5 27a23ee69999affa55491c7dab8e53bf
SHA1 3d8d9dd58a03b7a46d497f5761e60d8b844a5199
SHA512 d4774014a4aa73b58631ea21c39fbd545342769f9743961b2e436bafa3590abe002c7f13064641c56daecd1fb3c77d0179550dd5a1f399bbede5a7eaad2cdd55
SSDEEP 192:s8GUXfjbwiwAWIvIJ5R26oASK1K4VObiouQ0+s8iXM55IJkgcwQfLq5OnmO2L8FV:lGifjb7WIvIJ5rXViuQ0+ocrUkgMfLeA
TLSH
T17F223C468376D50DD4AB9D390AE47382CF67BD51AEB0D22FC75380C960134D6A833F9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Size4-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Size4-Regular.woff
Size 5KB
SHA256 99f9c6750b489c9462bf04900bd3f939df9b829339daaaaa99ef5495cdddea58
MD5 3045a61f722bc4b198450ce69b3e3824
SHA1 8fdddb83513ec226231ebee05079ec45fc013578
SHA512 627deb0a7d3fc21ec8271a9393120c4261364755aea28071d4d5e5b2b9a6a1d5189632a85c3898e55fc435fa9abf865a5681dfb9a85fa90cafc10f06c8c82d2d
SSDEEP 96:dJD3hKysdbyOdHMTNh+hGouQkbT40+cCOdOpEmznbKJQZLFwSbsj4fal:LDk11dHMRoQouQk/qYORbNZw+sEyl
TLSH
T1B7C19F886B9503DBD1E8E5314561D6A77DA981CC22FDEAC2A3D38CF8117C092534831A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Typewriter-Regular.ttf

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Typewriter-Regular.ttf
Size 26KB
SHA256 f01f3e87d9c6a61c0c081ceb577abd864eb00a612f7ac1620dd6915fad2ef5aa
MD5 6bf4287568e1d3004b54d5d60f9f08f9
SHA1 629b99faf18d97529f21a1b1018093e60bcd058f
SHA512 334ba0c8d5c909df85a9dfbb364403c134ed19234d6066f0b28b19bbcb6a004df09bc098cf22f81acc7887f8581557d400b726b7c23478ee659a78c2f36c1810
SSDEEP 768:dz3ml7/89RurSjSN1J5Ap9voVluAGrdyMfLAn3:0lo9RD81J5Ap9voVluFdDfLg
TLSH
T144C22844E7B2DC19E46FDB35C2E9D102E5FF7515FEB8868ECA47128C98690C0889EF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KaTeX_Typewriter-Regular.woff

Path C:\Users\Admin\.vscode\extensions\.cea1c1b3-7dca-4083-a400-ccee36518844\webview-ui\build\assets\fonts\KaTeX_Typewriter-Regular.woff
Size 15KB
SHA256 e14fed02b1aba7ce9f5afd5844b5d0321b22351febc720e0de8b8723527609f7
MD5 0e0460587676d22eae09accd6dcfebc6
SHA1 f5e729fa4ff466fc07e0c7ab1979ad70c45fa5d5
SHA512 075aaf86ca957a82baa6816c39d5644a8006dd17152e295aea84c4f06791c6dad1b064c5d9e58ac1d6370ba4ddd428a36e1e94be392e9c123fda9596ea609a5e
SSDEEP 384:I4QFzRKNs+avySJ/kJesGfsgSPCM5GG5sef+5yq9OMdPxJLR:I4QFzRY9ZSJ/MRGf0wopsdPN
TLSH
T10E72D0A127C2E000F69F42AB9AB333D617604019C4D6588FB04DE6CF766EFC6B136D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\.vscode\extensions\extensions.json
Size 429B
SHA256 4088ff6eedd5b52782b5a32cead30e7177fcae0d855f91ee5dfe7961484828b7
MD5 5141385e0026c3a7e51dd98c015cd6a0
SHA1 82472404eef9ae437a27a1d2c484e0fe48f0f7eb
SHA512 30c81bb71e1b50b0c3c59c1fc5c55f9a7bfcf0c002a51c5d5a0dc860d8cba11485b2541468e0a04814fb8da70aa09e7fb5967a7c504f1cf01ce19aa6dc86ffb1
TLSH
T185E0EC410949CB23490D23024D719946EEB7129B74802965BFF1C5C2115735D329382B
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\.vscode\extensions\geaix.geaix-1.0.19\package.json
Size 14KB
SHA256 e0f34628b025935d1f2b9fed752d142fa9237e6b3299232f00d0d4f39fedac65
MD5 d6490d1a8d7ce4134185026a047d92ac
SHA1 64a9c00be56b35aa9b7cd6f789c9c14a4ae1a14b
SHA512 68c92e958fb4fdcb442853d7807cc8508bcf63f5e50fde3e3987ee19556633df3299a10260518b47235ee01faff05d4dad15311d26a825633b0c9052bdc006c1
SSDEEP 192:9u8zSM/Rj7cKVeiM2fquxggwkvX0R/DN/RreXb2gI2MEsxI83+:9LEgwkvX0R/DraXbFsB33+
TLSH
T1F4623153EDACE5FF06C806698DFD50CA807E13798490E8FFBDA2BE24508D5E58276352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

154310d4-fb9a-4b1b-bbba-4cc6ffd3ae4c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\154310d4-fb9a-4b1b-bbba-4cc6ffd3ae4c.tmp
Size 5KB
SHA256 7670fbe6682200f02d9c1e0aaa0c2758b8d0878930f8fea5e8b63151be51e9c7
MD5 2422942d0d692e486de43e104e1abecc
SHA1 892d0076e23f4ca05820096694db4d48da89599a
SHA512 22d43b86976d57069023fed85d4f8547f37f6f05f9d55581acbb3c628ac0abf1cbc3b32932f581b4e53cd9f75c200eb72af5c615cec2784450d975327e639708
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVbsoRESl8h4otop5RXDjB6GGGfvoD3EFH0p1QzbpXKZP37:Dt0ESKk9RIiU2B93vo4FH0c63BmeUJaN
TLSH
T1A1C118B1B96DAC7769F6A5A1F0032A83CFB0207BD540AE94EADE0F0C15DB0DC2342476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ac68709-27a2-4a4c-b07f-b46dd324ce8e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4ac68709-27a2-4a4c-b07f-b46dd324ce8e.tmp
Size 6KB
SHA256 88e9dc2a0aaf578a6e10fe5857ae163c890de5d4b49cda079417e0fd402c49eb
MD5 3635de6af920868429285865ff5f8d18
SHA1 ee6650fc34ae0107e5dd24b81430a8b9aa9651d7
SHA512 2c5e370795e0d10d5ee4753267721f6b809dea92bdd441a049437f1a818c0d76680f2fa981aa0b0890a465b1be2841799a6261c13cde4fed1af522a837927a47
SSDEEP 96:DbJod+7N0X7jVYVfGTVbsoRESl8h4otok5R2DjB6GGGfvoD3EFZmBmBRNC39ISMP:DtoESKk9RIiUDi93vo4FZmBmBu8xzVRT
TLSH
T100D109B1E86D9C7B59FAB895B0032D87CEB8207B99447D58F9ED4E0800E74DC1382577
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e3dc1e2-68f2-4c47-ac52-2fbb9ca8e802.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4e3dc1e2-68f2-4c47-ac52-2fbb9ca8e802.tmp
Size 5KB
SHA256 863bdf8d9edbc8ae9b56603a25e4facff1c81d20cb6be71f6a9ed97b8ab88937
MD5 f05d26952e018e1df3974e336b373da0
SHA1 c827e1438cadc7985446dbb4fe46181c7cb7e8d1
SHA512 218a45a3c4c82049986945c73c16344a6ce784277988271f57ca151586d178dc89044591db6231bcd57f0f6c8e1173f2528c6ed9a76f8adf8fefec716d3d657b
SSDEEP 96:DC0d+7N0X7jVYVfGTVbsoRESl8h4otop5RXDjB6GGGfvoD3EFH0p1QzbpXKZP3Bp:DC0ESKk9RIiU2B93vo4FH0c63BmeUJaN
TLSH
T14EC119B5B96DAC7769F6A5A1F0032A87CFB4207BD540AE94EADE0F0C15DB0DC2342476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74389228-7b77-4e1c-aad4-caf9e8918d4a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\74389228-7b77-4e1c-aad4-caf9e8918d4a.tmp
Size 4KB
SHA256 ee4f45b0138475e35c2c31f20ce7e519245c4e5fe40dc6eb8466447c95bbd1fa
MD5 9e3d36f2bf4626927b157f6182c1677a
SHA1 d229fc12a7549373ac0337dad970a139520f6e67
SHA512 0a68d1e4592a665d764b616fcbede5abd4c0d1fd7717b6332a8e7629b3d78ab6e4006c3db7d01c0e3ac08708d89cdb56337bfbc267ffa43bb91580520d9e6a86
SSDEEP 96:fC0d+7N0X7jVYVfGTVnsERDotok5RhDjB6FGyvoD3Emwm+Tbv4v4a:fC0ESKkdDUD39Bp4mwm+Tbvi
TLSH
T1F4A10831A8789C7B59FAD848F4436A47CFB4307BD462AE94E9DD4F0814EB0EC1342567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c86731d-93a3-4e4e-bd48-88aec3551bfd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7c86731d-93a3-4e4e-bd48-88aec3551bfd.tmp
Size 5KB
SHA256 99270f9ea0c2a3e36684f7675a42dc90d63a61571a96f311c3c760b68b8345dd
MD5 790d69106a2ba584a4eb46d912c1be67
SHA1 ceaf0863a3a9ed47afb2eb8600ac6c1153e294d7
SHA512 218ba368c8583635ae2a1c0f64e69d6d3c4ac0af0ebe7f0aa9e68521514ccb37e78d2db259f0d01d80e4bee10823178a4f7860a5fbc61a430b3594d697cf5f65
SSDEEP 96:DbJ0d+7N0X7jVYVfGTVbsoRESl8h4otop5RXDjB6GGGfvoD3EFZ1BmBRNC39ISyY:Dt0ESKk9RIiU2B93vo4FZ1BmBuCUREg
TLSH
T108C1F8B0A86D9CBB5DF6B895B0032D87CEB8207BA955BD58F9ED4E0801E74DC1342563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 95156e85b10bb169669ac3a8fd229cfc0fca67c83c351ee5fb76ca8d89d5e1be
MD5 0e3d1285ddae06a225fe04ae6af82b07
SHA1 8b978c7f8232dd442e11dfffef2c83ca59b28c38
SHA512 80afb4af262e2c48dbaf6a132572df5f508b1bc75b767aa0e1c3120174946162fe57cb5e4d27adf119ed9d8b08b5a29cfdf85d6351217ffc2219bdda998e30cf
MD5 SHA1 SHA512

Submit Download

15208e70-6146-40eb-9c5c-240ce0075a35.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\15208e70-6146-40eb-9c5c-240ce0075a35.tmp
Size 11KB
SHA256 00df514df8815c566e5b766b3d60510ee679d2d3abd29b5d72af9c4160f23b5e
MD5 721477a8907a4745f6f8351522ba0857
SHA1 f462f11886dd83876ee1c712e6356ac65e969c90
SHA512 d94dd9acd95e1682f1f4662c43f61f1cb5000f01289e7d9211056f1a9504c8c2c2dc393f4bd3583ceaba7002ff7fc3c4792eaf1f98f7860c1bdec6a29f7804b8
SSDEEP 192:CRyFDL3LDEv7xAPRp2xM9xHsb+WNnnss6x2w82beJr9jVyIsnAUge:CRyFPAYXlDwsD212mXe
TLSH
T11232A62EAE20797F5CDAC219FA65BB57D7F5202160D12E84EAFC893C21E75CC2117057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

254eb350-8f44-4964-abb3-2faf24c5aad5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\254eb350-8f44-4964-abb3-2faf24c5aad5.tmp
Size 11KB
SHA256 4e6c490de08d18d119a36d022b04ea6edb18ea6dbca11b046ee3b6ecb9a67625
MD5 e2537e5a5003e698e025f5c391950f05
SHA1 f7cc9c27ae92f955ec25179b75a378e8bca060f5
SHA512 ab1425b4f0375174b6ca27624c90462f6eb2187f981633ab7a7ec0dd029fb931348ea8eb4317c89b309c0f2ba8d53d9010404994bf99cbbb61c74b8d65545459
SSDEEP 192:ezs4K6pN7KxkXqK4I40pUZNCgVLHrKHfFKslERbFXzKD/6N+ErUkKN9a7v+ANAPH:GsjSN7KxkXqKf/pUZNCgVLH2HfgsloFY
TLSH
T16832D917A84D6E7F0FD8D50DCC166F4B6DB5029676680D2893FBAD0803A57CE114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c703b4a-79fd-419b-844d-2656912d4c2f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5c703b4a-79fd-419b-844d-2656912d4c2f.tmp
Size 12KB
SHA256 fa43f8428c1dc32561f1b89185c4e6d977b2554d84875355060b76f13f6491dc
MD5 e4ee681bcde7fa675c2cc495b12b7352
SHA1 91c64f020fe2715054841bb14a3b5f61cc1a9526
SHA512 b0423c8c609533b51bef00287e6c69da4b8a94280fec6fcb3bf66e646416524d09e552d3a8de4da34b3ee5563c92f90d61e38b3a1c9a2c24678fc7f00a77c87e
SSDEEP 192:CRCcBzdDL3CEv7xAPRp2xbqfI9xHsb+WNy/nss6x+ty2e82beJr9jVyIsnAUge:CRCmzdPFYXeDw7DB2r2mXe
TLSH
T1C042C76AAE2079BF5DDAC219F961B75BE7F5202160D12E84EAFCCA3C20E75CC2117447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ce1b671-a342-4025-b81b-80f2cfefeaae.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8ce1b671-a342-4025-b81b-80f2cfefeaae.tmp
Size 13KB
SHA256 a6a935781ab17c0a01e9a4dbef22e0e0e94d75399e771421bf4415e424f3dc19
MD5 bd29044f6db8b7801573a7ecf6a98ba2
SHA1 467a93dc9358554251301d7ce8ff9b1511dfd868
SHA512 dc7ef01096bb33739bed2aafbf9fe37eefee894f72fa8e6f583b07bb15d5dd9303a218837acc73ebdc368a76a6b92ae9dff355237a539e28c358c57bdfcfc32b
SSDEEP 192:CRCcBz4DL3GEv7xKPRpVxbqfI9xHsb+WNy/nsljwq6x+ty2X82beJr9zVyIsnAU3:CRCmz4PRuXrDw7ihB2s2mDE
TLSH
T11252B76AAE2079BB5DD6C219F965FB57E3F5202160E12E84EAFCCA3C20E75CC2117057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ee18f24-6ce9-4ac7-8437-20bfc2d6cee9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9ee18f24-6ce9-4ac7-8437-20bfc2d6cee9.tmp
Size 13KB
SHA256 77292fb1ce585d5df26945bb0c468c917fb29174ae8f5f9d88064e7bc9e2f6fc
MD5 830d5d75a98ed5d1f7f4bc15fa526188
SHA1 7dec2158e94f55d7c2025b10719b4fa41e2826e4
SHA512 60482c0e13229f8a81b0310be041d12cf20078031bd825aead151a3121da9b59ebe27da41e61f2a71a64f440c1f1f736d046c4e0f0bfcc266c89ad60cc740787
SSDEEP 192:CRCcBz4DL36Ev7xKPRpVxbqfI9xHsb+WNy/nsljwq6x+ty2X82beJr9zVyIsnAU3:CRCmz4P9uXrDw7ihB2s2mDE
TLSH
T19F52C76AAE2079BB5DD6C219F965FB57E3F5202160D02E84EAFCCA3C20E75CC2117057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Size 49KB
SHA256 e0712db3ed1b5c3b7e5a546010e454c8aa5870f1de9bfd5a55c69677c960caa8
MD5 6c2f3e61dfa3a81fa6c6bcc20929d44a
SHA1 adc1d18fb03f0eff81d7813eca0e8cff017210bc
SHA512 e91a760561a646c3f8c85c9f974887fbd744982582e565c5691762129026a5c34299cffe95ff1d884af68cf96163d57c8dc97ee3952b83d727073185e26b568b
SSDEEP 768:NeZ5ZNVnqT8VsmDIw8/1ko71/m8ki1cuPv2khl8OE3Bwa/TLTgNBhHyM4sF8LjPf:NeZ5RtIw89zRIIXrlK3Ca7Ly1D4Rrd
TLSH
T14733F228B2627956B48E060CD65F00CCEE117DD32F7E2A125F3BB45D2EA2936D66C713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 960B
SHA256 6afed216abdbc37171e20ad9c96f974f1bf31e2ccc18240408a89ccde6350be3
MD5 398e4240bf2ec2f7026997577d6dbbfb
SHA1 25583e659eeeeb625f2536877601f2989de3dce4
SHA512 0da623abb7a453363e8f2d7e86350c03d646540f4c291a4d03bb951fe43386ff6f893236427a0be66cf2873769b40268193ddcdfd09caa075fd3bb7770266b85
TLSH
T1F4116D8741875971C7C0D27428DEAD05F52015AEC9F1EE5E109A0A94FFAB354324BEEF
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 407561097cbe14ea3c3bee031c2b4294b227a7cf19a47c10f1426e17268a2240
MD5 107c5beb19ef842700e4de07256cde23
SHA1 9afb501f5fb32498a9f7d1f3bcdc0e5fc7c1e453
SHA512 499c89e96108a5305ab341191af369660c628d27be8a00339adaac7a904da5a494bab4cf660cb77d1ff82b7d0ee9eee5d532e827d48cb1bf11fd4327b0cd765f
SSDEEP 3:MsEllllkEthXllkl2zEflbI3Kl:/M/xT02zl6
TLSH
T1E744041C7FC00405C701503040D1D35C1370D4104553574F34D10C33FCC75510C000C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

34cf6639-7481-4f99-883d-d1976a46a633.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\34cf6639-7481-4f99-883d-d1976a46a633.tmp
Size 7KB
SHA256 b8a1b52eeac35f9c0c79738fe510624c05404c1628192b06f22c04e828c86476
MD5 53c77557d541eb14a8adfe4954cbef69
SHA1 f38c18357391a357c77804b501026486038cafb9
SHA512 7b5a3f825a015c3f9f95e70ffa309089d17e514dba4b01023f092736d9d8204d2a03a0afd970bc9e954e7a84128e91c5eef754a44637585584b3d0a04bc2c2bb
SSDEEP 192:Dljto8eaAVBp67bZAZvFlnp1idIaIaQzNPxf7eapFK:Dljto8eaAVBp67bZAZvFlnp1idIaIaQQ
TLSH
T1B4F1BDF7C3D8862D991156F8AB257E1FCE291A18432C3C66C8D8AF1B93E2971D35074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b1c5a02-cc99-4e23-916c-75edbf05f083.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\5b1c5a02-cc99-4e23-916c-75edbf05f083.tmp
Size 8KB
SHA256 12150c0605617013960ac9499d35ea38d16b6a5ab865e8b62bfa8d44e96d3212
MD5 c98a5bfed5cebe6deeb6b203c6533441
SHA1 c25cf91ae74b788ddb3e324034a128049c085941
SHA512 703fca1c7fc3b40ad8402a0a6774e7cfe8c71705a02f92579e39e91cd7133bd8ef6ab6a11016ac5579c2380e3f236d551dd526ef7720c23e2bcd094a6fec05dc
SSDEEP 192:Dljto8eaAVrIp67bZAZvFlnp1idIaIaQzNPxf7apABXiW:Dljto8eaAVrIp67bZAZvFlnp1idIaIai
TLSH
T1C802BEF7C3D8862DD91116F8E7256E1FCE291A18432C3C66C8D8AF0B93E2971D25074E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

665acf1b-d135-4733-9d87-6481c6f99321.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\665acf1b-d135-4733-9d87-6481c6f99321.tmp
Size 6KB
SHA256 11bbab964eda8c7cb612cb2a38847f3ad05563ebabcac1656751da12670a3feb
MD5 2e589c9f3cc5f73ffbaefacb5bc1f114
SHA1 d21aa8f7f96de0b24594ea4d63d1623324e40501
SHA512 08fecef310d1bfdbd6461e977f1fbdac5f8d2617c5e4f9387bece379587e36da0d707af17005e3611c2329b0002b91ddb4422b734ff81ae8ba2a07e8d78d42d1
SSDEEP 192:D4mzOhutwHjIp67VxEdvFknU1udIXtzNPxf7apAib5:D4mzOhutwHjIp67VxEdvFknU1udIXtzm
TLSH
T13CE1A9F7C3E4862D991156F4EB15AE1FCE291A24432C3C76C8D4AE1B93E2972E21174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6009956-e00e-41c2-a77e-2ac5b03fbb05.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a6009956-e00e-41c2-a77e-2ac5b03fbb05.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aff8af3c-9d35-4ce8-89c2-1cddc5f0e62a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\aff8af3c-9d35-4ce8-89c2-1cddc5f0e62a.tmp
Size 858B
SHA256 ac9a9b9009d84b75f8e72c087eacbeb2c36c03b7da8825f76bf1a5eb5c2cdc67
MD5 71258ecdf5f5f03fd2a96390e42819d2
SHA1 77cdd507b384092a0241705ecebc7218d5021f03
SHA512 81363d9721978a1f15660a582a8f781c5990ca10398a4b69cc4d261921e5cae0d2a75a595d8d31ecb05ff203a6d06ab81101aea9eb6c62a7062d65f4ab5c9abf
TLSH
T1B9116FD7A6BE7977207945BB0D18B84A6A76AC3226415CF4DE5B833CB0C16F30B11453
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 2bc2c6eb97bb31b5eee82eeff29458bd861613f94a9755b66d8076b2bd20ee4e
MD5 7e45d936250cdbb53cc5e1ed1732d06b
SHA1 c847c042a786cbc6585dc139b5f18c9a03a844b2
SHA512 5e17fda5cbc624b5c3e669d88b4d1e6cdaec4aaf60c9de1e5c8e4fdb17e9405be2dd38204bab0ae895e1e9c5f49ac10ec4796671a0f77c9997ef5d7b06b24c30
TLSH
T133B024C000333C73F441C77001D5D0C137303D10C34341C550F41014F1535534307001
MD5 SHA1 SHA512 TLSH

Submit Download

b94ebcea-e0cd-491a-b0b1-f2fb48537f64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b94ebcea-e0cd-491a-b0b1-f2fb48537f64.tmp
Size 12KB
SHA256 7dad54505c653d7768e3a9988b19e6bffdf3f8fb9001f9c8ce1f9ae5ec1f879a
MD5 eda0e7bbb528de1f863df2b46fff5330
SHA1 a632b6183deab4206da393abc927458b4585ee65
SHA512 fc551f2e4aa0b26d36d954e1acc4aed30d343084e8a4ddf96b8cd0c0361962a1dabbaad8edab802d760360ff9dace2ebf681eb0c3bbbc8f81fdd1890ca690643
SSDEEP 192:CRCcBzFDL3CEv7xAPRp2xbqfI9xHsb+WNy/nss6x+ty2q82beJr9jVyIsnAUge:CRCmzFPFYXeDw7DB2v2mXe
TLSH
T14342C76AAE2079BF5DDAC219F961B75BE7F5202160D12E84EAFCC93C20E75CC2117447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d31d4358-56bd-4399-b1c8-997266cec85a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d31d4358-56bd-4399-b1c8-997266cec85a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b8850337-43e5-4044-ba40-6fb674f4fb59.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b8850337-43e5-4044-ba40-6fb674f4fb59.tmp
Size 5KB
SHA256 f07cf2c813507993ddb7112aa1c34d7e0db1279acf28dfde8d238b2d98e2ad38
MD5 c72bf68b0863a937b645afba59ef9d7c
SHA1 8f42b96d4950a6b9a91a8c7fe732710093598d10
SHA512 cab08842d9e63bc2e1024d32ee5863ca8082c78b002c2b31ba8d64ee286d8df92706590f00aa5c815a6611d48743fda6246e11edcf8f5289b88ba13ae2879a06
SSDEEP 96:DbJod+7N0X7jVYVfGTVbsoRESl8h4otop5RXDjB6GGGfvoD3EFZ1BmBRNC39ISyY:DtoESKk9RIiU2B93vo4FZ1BmBuCUREg
TLSH
T1A1C1F7B0A86D9CBB59F6B895B0032D87CEB4206BE945BD58FDED0E0800E74DC1382567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download