Analysis
- geolocation tags
- user interaction
yes - max time kernel
900s - max time network
885s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
02/11/2026, 18:06
General
- Target https://zcode.z.ai/invite/REAL336J
- Sample261102-wpthcsd14p
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- A potential corporate email address has been identified in the URL 1 IoCs
- Checks computer location settings 2 TTPs 48 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 54 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 42 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 25 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 48 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zcode.z.ai/invite/REAL336J1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ffd7398c188,0x7ffd7398c194,0x7ffd7398c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,10638173908270869903,10326618510570024507,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Downloads MZ/PE file
- A potential corporate email address has been identified in the URL
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7950043396412224527,14673957188591214764,262144 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,16900099301040364247,11396992209088090345,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,5571672137762416547,3032363929659684757,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5374692872124691441,6645886862604040997,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3770068332364134358,13917091883197105277,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14688903966594789362,2597196570651996957,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11783118968852367161,485303509527384364,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,18134246354673366955,8857004694993765997,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13844850454016307940,7248985153210292187,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13844850454016307940,7248985153210292187,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,594137279159465778,6452563500076321751,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16935761515194329722,6993201574337362455,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4256,i,4797453160708290913,768570476912986442,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,15849477231839570607,9853921747382712276,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7132,i,5391404040120541958,15117813497998708970,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6800,i,12476059945797335836,9867361714249745862,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7320,i,15514353978460120094,17483638800513752337,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,13963878023397010591,7419280112046426307,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,17963122185518065349,15120041839662987146,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6755372357977421955,12024622681473764566,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,5666856253296989180,11148865071259160121,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7476,i,13947664621179053681,15312475011768634889,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,5309233981021818032,5309186112070752559,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5296,i,15918988254789990336,3960057891727136698,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6328,i,16656069513797137614,11231235249569354932,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7264,i,1851684444163065094,97773831661073138,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7932,i,10817945408270348225,16842711260381356801,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8080,i,1500032810646762202,16222992566691109048,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8284,i,13631110463963489115,14253038286448625087,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8432,i,5024364203160133343,17182803936236788752,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8524,i,16696870177300182561,12269496949567058504,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8544 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7156,i,8498740710498467711,7351749589583279158,262144 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8308,i,18321684879950897920,8791603783277942238,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8963028726914692619,13586938948024447625,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8963028726914692619,13586938948024447625,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8836,i,1867136194293091374,15012775527052542704,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8556,i,6900046503001681024,14146730160415841451,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8852,i,11267616039971116796,17500016630391851015,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\ZCode-3.16.3-win-x64.exe"C:\Users\Admin\Downloads\ZCode-3.16.3-win-x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\ZCode', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8772,i,7242760310308110559,5187392445914508224,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8916,i,190604322421320825,16998124185074158651,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9084,i,3673544969151798212,12185183889458017989,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=9044,i,7691931616909274787,6338104088926920983,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9284,i,2353614069784438315,4382614139180959118,2097152 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=9292 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" -- "zcode://oauth/callback?code=code-849036ab953e&state=dbe3ea74c56c923dd650d7137420758c"2⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x5d4,0x5dc,0x5e0,0x5d8,0x560,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2072,i,9230806889996996134,12829746536822733961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2076,i,8137364558107633982,3537075992333269661,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2112 /prefetch:33⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,9230806889996996134,12829746536822733961,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2076,i,8137364558107633982,3537075992333269661,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2068 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5082886748318996932,11897790704526224229,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9344,i,3436410703142646969,12714817229388151613,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=9336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,368881434948891863,14786927923482621514,524288 --field-trial-handle=2272,i,5834381507131613003,3816690703637398691,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x590,0x600,0x604,0x458,0x610,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,14503989247488426005,13895858246129063437,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,6189035876664793902,7381097079800319095,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1912 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1928,i,14503989247488426005,13895858246129063437,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,6189035876664793902,7381097079800319095,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d 在ZCode中打开 /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d 在ZCode中打开 /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d 在ZCode中打开 /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d 在ZCode中打开 /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --app-user-model-id=dev.zcode.app --app-path="C:\Users\Admin\AppData\Local\Programs\ZCode\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1928,i,14503989247488426005,13895858246129063437,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,6189035876664793902,7381097079800319095,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3840 --device-id=f408f2d1-8a45-4703-ab4d-0fdda4b3da1f /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1928,i,14503989247488426005,13895858246129063437,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,6189035876664793902,7381097079800319095,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs app-server --stdio3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7636 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7592 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7544 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 8180 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7396 /T /F4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5036 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5420 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 2876 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 1128 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5684 /T /F4⤵
- Kills process with taskkill
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1} {2}' -f $_.ProcessId, $_.ParentProcessId, $_.CreationDate.ToUniversalTime().Ticks }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1928,i,14503989247488426005,13895858246129063437,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1932,i,6189035876664793902,7381097079800319095,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=5416 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chat.z.ai/api/oauth/authorize?client_id=client_P8X5CMWmlaRO9gyO-KSqtg&redirect_uri=https%3A%2F%2Fzcode.z.ai%2Fapp%2Foauth%2Flogin%3Fredirect%3Dzcode%253A%252F%252Foauth%252Fcallback%26app_version%3D3.16.3&state=dbe3ea74c56c923dd650d7137420758c&response_type=code2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://chat.z.ai/api/oauth/authorize?client_id=client_P8X5CMWmlaRO9gyO-KSqtg&redirect_uri=https%3A%2F%2Fzcode.z.ai%2Fapp%2Foauth%2Flogin%3Fredirect%3Dzcode%253A%252F%252Foauth%252Fcallback%26app_version%3D3.16.3&state=dbe3ea74c56c923dd650d7137420758c&response_type=code3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x5d0,0x5d8,0x5d4,0x428,0x5dc,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2108,i,18264169881792210670,16528195282990807984,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,16435670592284565826,1385745609519842876,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2108,i,18264169881792210670,16528195282990807984,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2112,i,16435670592284565826,1385745609519842876,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2104 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x5cc,0x5d4,0x5d8,0x428,0x5dc,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2176,i,219204813340879844,16549827659139409750,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2180,i,11893060581890209570,13079280863082953471,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2172 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2176,i,219204813340879844,16549827659139409750,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2180,i,11893060581890209570,13079280863082953471,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x5e0,0x5e4,0x5e8,0x434,0x5ec,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1948,i,16669822239236138071,11415942169607798890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,6866635585159466274,4107852916453773358,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,16669822239236138071,11415942169607798890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,6866635585159466274,4107852916453773358,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1944 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --app-user-model-id=dev.zcode.app --app-path="C:\Users\Admin\AppData\Local\Programs\ZCode\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1948,i,16669822239236138071,11415942169607798890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,6866635585159466274,4107852916453773358,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3520 --device-id=f408f2d1-8a45-4703-ab4d-0fdda4b3da1f /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1948,i,16669822239236138071,11415942169607798890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,6866635585159466274,4107852916453773358,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3996 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs app-server --stdio --surface desktop3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7720 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7160 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5992 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7028 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 6788 /T /F4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 4988 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 3936 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 6496 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 1776 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 5328 /T /F4⤵
- Kills process with taskkill
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | ForEach-Object { '{0} {1} {2}' -f $_.ProcessId, $_.ParentProcessId, $_.CreationDate.ToUniversalTime().Ticks }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=1948,i,16669822239236138071,11415942169607798890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1952,i,6866635585159466274,4107852916453773358,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3704 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ZCode /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.zcode\v2\crash\live --annotation=_productName=ZCode --annotation=_version=3.16.3 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=41.0.3 --initial-client-data=0x5d8,0x5dc,0x5e0,0x428,0x5e4,0x7ff723eea7bc,0x7ff723eea7c8,0x7ff723eea7d82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2148 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --app-user-model-id=dev.zcode.app --app-path="C:\Users\Admin\AppData\Local\Programs\ZCode\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1793642271223363 --launch-time-ticks=920459986 --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3496 --device-id=f408f2d1-8a45-4703-ab4d-0fdda4b3da1f /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3576 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs app-server --stdio --surface desktop3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 3008 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 6528 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 2928 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 7708 /T /F4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /PID 4644 /T /F4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\pdf\0.2.2/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\documents\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\node-repl-host\0.6.1\dist\mcp\server.js4⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\spreadsheets\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exeC:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe C:\Users\Admin\AppData\Local\Programs\ZCode\resources\glm\zcode.cjs __zcode-plugin-host C:\Users\Admin\.zcode\cli\plugins\cache\zcode-plugins-official\presentations\0.2.1/dist/server.mjs4⤵
- Checks computer location settings
-
-
C:\Windows\system32\tasklist.exetasklist /FO CSV /NH4⤵
- Discovers running processes
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=node.mojom.NodeService --lang=en-US --service-sandbox-type=none --no-warnings --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3564 /prefetch:82⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Directory\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /ve /d "Open in ZCode" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v MUIVerb /t REG_SZ /d "Open in ZCode" /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode /v Icon /t REG_SZ /d C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKCU\Software\Classes\Drive\shell\ZCode.OpenInZCode\command /ve /d "\"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe\" --open-workspace \"%1\"" /f2⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\system32\where.exewhere.exe code2⤵
-
-
C:\Windows\system32\where.exewhere.exe code-insiders2⤵
-
-
C:\Windows\system32\where.exewhere.exe cursor2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --standard-schemes=zcode-media,zcode-sandbox --secure-schemes=zcode-media,zcode-sandbox --cors-schemes=rum-event --fetch-schemes=zcode-sandbox --streaming-schemes=zcode-media --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4012 /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe"C:\Users\Admin\AppData\Local\Programs\ZCode\ZCode.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\ZCode" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2152,i,8761462940423694163,14579030852001648029,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2156,i,15470964263177806555,6684849807618530325,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4132 /prefetch:82⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
zcode-2026-11-02.jsonl
zcode-2026-11-02.jsonl
owner.json
plugin.json
owner.json
plugin.json
plugin.json
plugin.json
owner.json
plugin.json
plugin.json
owner.json
plugin.json
bundled-marketplace.json
bot-config.v3.json
bot-state.v3.json
settings.dat
credentials.json
credentials.json
credentials.json
credentials.json
2026-11-02.log
2026-11-02.log
2026-11-02.log
onboarding-record.json
provider_config.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin-refresh.json
zcode-builtin.json
zcode-builtin.json
setting.json
setting.json
setting.json
setting.json
setting.json
setting.json.6268.1793643087425.ku8qtvwew87.tmp
tasks-index.sqlite-wal
telemetry-state.json
powershell.exe.log
06ae1cee-9726-4b53-9bf0-0feb15e160f5.tmp
0dabda2c-db7c-49a1-a7b6-d86374e4b5b3.tmp
1ace6e65-0653-452e-ae1e-55cb4d7615cc.tmp
3aa26b23-0b12-46f1-a03d-6d4acaadc219.tmp
43dbfc3b-7247-43cf-9e22-4a58cff8de5b.tmp
65cababa-e6c1-45ae-baf8-bdeb4318825e.tmp
758b1c43-66b5-4971-a3b4-de005a5e9acf.tmp
82e50bdc-af01-4941-8260-01cf88ac1346.tmp
8ebd0be0-b160-4ad3-9dfc-986693e5d18f.tmp
904dc91f-8d31-4109-90f3-0aa600b7af64.tmp
8b75ab20-9eb2-49f1-9bb7-781180a2c9bd.tmp
settings.dat
settings.dat
25985b13-1b59-43ec-a797-0734ae45c858.tmp
406c9a20-5100-46fc-ba45-46ea383c3108.tmp
740d5a0c-7397-40e9-accf-71b6b30a791f.tmp
87c2b520-23ef-4b99-8f39-07fa6dcd9aed.tmp
9c10f385-76c1-4b7a-888f-33b42f1eaf5c.tmp
LOG
LOG.old
LOG.old
LOG.old
LOG.old
f_00006a
f_00006b
f_00006c
f_00006d
f_00006e
f_00006f
f_000070
f_000071
f_000072
f_000073
f_000074
f_000075
f_000076
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000b4
f_0000b5
f_0000b6
f_0000c6
f_0000d7
f_0000ec
6180fd17ce120bf7_0
660a2e9bddf23a1f_0
6b82aa7f5a758b02_0
d5217fcf72bf5e85_0
db40ec3422887058_0
temp-index
temp-index
the-real-index
the-real-index
bbdcfe8b-d0f5-4942-a45a-ef8454344bcb.tmp
CURRENT
1f14f50d-7093-40bc-a3db-95b0f7f035ef.tmp
5cc3438a-5757-4bf4-8dc5-558a333a923a.tmp
783ebb94-9b48-4354-bbad-4ffba69a36c4.tmp
8fc18a2f-bcdb-48b2-b869-2ab79b9aa308.tmp
Sdch Dictionaries
b40f5333-0b75-47c8-b660-15e95c1e4ecb.tmp
ec95166f-3791-47ae-9a24-8d816fd0f350.tmp
temp-index
temp-index
the-real-index
index.txt.tmp
temp-index
the-real-index
temp-index
sync_diagnostic.log
bf952404-539f-4175-adbd-504540f9e75e.tmp
c3afe022-d4fe-4cf2-8881-8408336ab6be.tmp
d061bb6d-53cd-4c8c-a5fa-d11afef8ad66.tmp
de64ec1a-2c47-47bf-88d5-96f5fffe1d82.tmp
e2b9053f-8402-4e98-aafc-810165638983.tmp
ece2a003-0f45-4a77-be77-02944361ee60.tmp
ee41f712-aa54-416c-bc30-b00a68c1aaea.tmp
a226b33e-5e8b-469c-9053-97b427e40d88.tmp
RevisitationBloomfilter
a47ea5e2-27ad-4fb4-8031-a75cd961287d.tmp
ae298ebb-898c-4cdc-ba38-3aa56c7280e1.tmp
b69424ab-77f4-4bf3-9994-e8de57f83644.tmp
d8c29406-bc90-4be3-b5da-b7a1094d2758.tmp
d9b4f966-fd41-411a-8e5d-4852c0349834.tmp
e1b1e7b4-82ed-4cb5-a0fb-da96aaf104ff.tmp
eaa6f0b6-8442-4d51-898b-02e51a315c90.tmp
cd3d0058-6e1f-4fe7-97bb-86d8e3fb1bc7.tmp
f39c5eb7-a011-4b30-86b9-494588392102.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_35o2mrgb.unc.ps1
.zcode-install-manifest
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
zh-CN.pak
resources.pak
THIRD-PARTY-NOTICES.md
app-update.yml
conpty.node
OpenConsole.exe
conpty.dll
conpty_console_list.node
pty.node
winpty-agent.exe
winpty.dll
OpenConsole.exe
conpty.dll
OpenConsole.exe
conpty.dll
pagent.exe
default.json
zcode-builtin.json
elevate.exe
.node-bundle-meta.json
.mcp.json
plugin.json
README.md
android-dev.md
path.js
run.d.ts
run.js
server.js
app.d.ts
app.js
avd.d.ts
avd.js
build.d.ts
build.js
config.d.ts
config.js
device.d.ts
device.js
logs.d.ts
logs.js
preflight.d.ts
preflight.js
project-template.d.ts
project-template.js
project.d.ts
project.js
screenshot.d.ts
screenshot.js
sdk.d.ts
sdk.js
ui.d.ts
ui.js
package.json
INSTALL_ENVIRONMENT.md
SKILL.md
README.md
plugin.json
README.md
all-tabs-cleanup.md
api.json
browser-troubleshooting.md
documents.json
overview.md
playwright.md
recording.md
safety.md
screenshot.md
tab-claiming-iab.md
tab-cleanup-iab-internal.md
tab-cleanup-iab.md
viewport.md
visibility.md
workflow.md
libvips-42.dll
libvips-cpp-8.17.3.dll
sharp-win32-x64.node
package.json
browser-client.mjs
build.mjs
SKILL.md
SKILL.md
README.md
SKILL.md
examples.md
patterns.md
plugin.json
assets.json
bundle-0.txt
panel.html
package.json
SKILL.md
SKILL.md
env_check.sh
setup.md
setup_mac_linux.sh
setup_windows.ps1
chart-templates.md
common-rules.md
decorations.md
design-system.md
docx-js-advanced.md
docx-js-core.md
faq.md
math-formulas.md
ooxml.md
toc.md
comment.md
create.md
edit.md
format.md
read.md
academic.md
contract.md
copywriting.md
exam.md
official-doc.md
report.md
resume.md
__init__.py
add_toc_placeholders.py
document.py
fix_footer_fields.py
postcheck.py
comments.xml
commentsExtended.xml
commentsExtensible.xml
commentsIds.xml
people.xml
utilities.py
setup.sh
.mcp.json
plugin.json
README.md
package.json
.mcp.json
plugin.json
README.md
ios-dev.md
path.d.ts
path.js
result.d.ts
result.js
run.d.ts
run.js
server.d.ts
server.js
build.d.ts
build.js
logs.d.ts
logs.js
preflight.d.ts
preflight.js
project.d.ts
project.js
screenshot.d.ts
screenshot.js
sim.d.ts
sim.js
ui.d.ts
ui.js
hooks.json
package.json
build-mcp.mjs
SKILL.md
README.md
plugin.json
README.md
server.js
color.cjs
index.cjs
package.json
LICENSE
libvips-42.dll
libvips-cpp-8.17.3.dll
sharp-win32-x64.node
package.json
versions.json
LICENSE
detect-libc.js
elf.js
filesystem.js
process.js
package.json
LICENSE
semver.js
comparator.js
index.js
range.js
semver.js
clean.js
cmp.js
coerce.js
compare-build.js
compare-loose.js
compare.js
diff.js
eq.js
gt.js
gte.js
inc.js
lt.js
lte.js
major.js
minor.js
neq.js
parse.js
patch.js
prerelease.js
rcompare.js
rsort.js
satisfies.js
sort.js
valid.js
index.js
constants.js
debug.js
identifiers.js
lrucache.js
parse-options.js
re.js
package.json
preload.js
range.bnf
gtr.js
intersects.js
ltr.js
max-satisfying.js
min-satisfying.js
min-version.js
outside.js
simplify.js
subset.js
to-comparators.js
valid.js
LICENSE
build.js
check.js
channel.js
colour.js
composite.js
constructor.js
index.js
input.js
is.js
libvips.js
operation.js
output.js
resize.js
sharp.js
utility.js
package.json
binding.gyp
common.cc
common.h
metadata.cc
metadata.h
operations.cc
operations.h
pipeline.cc
pipeline.h
sharp.cc
stats.cc
stats.h
utilities.cc
utilities.h
package.json
build.mjs
plugin.json
visual-judge.md
LICENSE
THIRD_PARTY_NOTICES.txt
server.mjs
assets.json
bundle-0.txt
cjk-fallback.json
noto-sans-sc-100-400-normal.woff2
noto-sans-sc-101-400-normal.woff2
noto-sans-sc-102-400-normal.woff2
noto-sans-sc-103-400-normal.woff2
noto-sans-sc-104-400-normal.woff2
noto-sans-sc-105-400-normal.woff2
noto-sans-sc-106-400-normal.woff2
noto-sans-sc-107-400-normal.woff2
noto-sans-sc-108-400-normal.woff2
noto-sans-sc-109-400-normal.woff2
noto-sans-sc-110-400-normal.woff2
noto-sans-sc-111-400-normal.woff2
noto-sans-sc-112-400-normal.woff2
noto-sans-sc-113-400-normal.woff2
noto-sans-sc-114-400-normal.woff2
noto-sans-sc-115-400-normal.woff2
noto-sans-sc-116-400-normal.woff2
noto-sans-sc-117-400-normal.woff2
noto-sans-sc-118-400-normal.woff2
noto-sans-sc-119-400-normal.woff2
noto-sans-sc-21-400-normal.woff2
noto-sans-sc-22-400-normal.woff2
noto-sans-sc-23-400-normal.woff2
noto-sans-sc-24-400-normal.woff2
noto-sans-sc-25-400-normal.woff2
noto-sans-sc-26-400-normal.woff2
noto-sans-sc-27-400-normal.woff2
noto-sans-sc-28-400-normal.woff2
noto-sans-sc-29-400-normal.woff2
noto-sans-sc-30-400-normal.woff2
noto-sans-sc-31-400-normal.woff2
noto-sans-sc-32-400-normal.woff2
noto-sans-sc-33-400-normal.woff2
noto-sans-sc-34-400-normal.woff2
noto-sans-sc-35-400-normal.woff2
noto-sans-sc-36-400-normal.woff2
noto-sans-sc-37-400-normal.woff2
noto-sans-sc-38-400-normal.woff2
noto-sans-sc-39-400-normal.woff2
noto-sans-sc-4-400-normal.woff2
noto-sans-sc-40-400-normal.woff2
noto-sans-sc-41-400-normal.woff2
noto-sans-sc-42-400-normal.woff2
noto-sans-sc-43-400-normal.woff2
noto-sans-sc-44-400-normal.woff2
noto-sans-sc-45-400-normal.woff2
noto-sans-sc-46-400-normal.woff2
noto-sans-sc-47-400-normal.woff2
noto-sans-sc-48-400-normal.woff2
noto-sans-sc-49-400-normal.woff2
noto-sans-sc-5-400-normal.woff2
noto-sans-sc-50-400-normal.woff2
noto-sans-sc-51-400-normal.woff2
noto-sans-sc-52-400-normal.woff2
noto-sans-sc-53-400-normal.woff2
noto-sans-sc-54-400-normal.woff2
noto-sans-sc-55-400-normal.woff2
noto-sans-sc-56-400-normal.woff2
noto-sans-sc-57-400-normal.woff2
noto-sans-sc-58-400-normal.woff2
noto-sans-sc-59-400-normal.woff2
noto-sans-sc-6-400-normal.woff2
noto-sans-sc-60-400-normal.woff2
noto-sans-sc-61-400-normal.woff2
noto-sans-sc-62-400-normal.woff2
noto-sans-sc-63-400-normal.woff2
noto-sans-sc-64-400-normal.woff2
noto-sans-sc-65-400-normal.woff2
noto-sans-sc-66-400-normal.woff2
noto-sans-sc-67-400-normal.woff2
noto-sans-sc-68-400-normal.woff2
noto-sans-sc-69-400-normal.woff2
noto-sans-sc-70-400-normal.woff2
noto-sans-sc-71-400-normal.woff2
noto-sans-sc-72-400-normal.woff2
noto-sans-sc-73-400-normal.woff2
noto-sans-sc-74-400-normal.woff2
noto-sans-sc-75-400-normal.woff2
noto-sans-sc-76-400-normal.woff2
noto-sans-sc-77-400-normal.woff2
noto-sans-sc-78-400-normal.woff2
noto-sans-sc-79-400-normal.woff2
noto-sans-sc-80-400-normal.woff2
noto-sans-sc-81-400-normal.woff2
noto-sans-sc-82-400-normal.woff2
noto-sans-sc-83-400-normal.woff2
noto-sans-sc-84-400-normal.woff2
noto-sans-sc-85-400-normal.woff2
noto-sans-sc-86-400-normal.woff2
noto-sans-sc-87-400-normal.woff2
noto-sans-sc-88-400-normal.woff2
noto-sans-sc-89-400-normal.woff2
noto-sans-sc-90-400-normal.woff2
noto-sans-sc-91-400-normal.woff2
noto-sans-sc-97-400-normal.woff2
noto-sans-sc-98-400-normal.woff2
noto-sans-sc-99-400-normal.woff2
panel.css
panel.html
pdf-worker.js
78-EUC-H.bcmap
78-EUC-V.bcmap
78-H.bcmap
78-RKSJ-H.bcmap
78-RKSJ-V.bcmap
78-V.bcmap
78ms-RKSJ-H.bcmap
78ms-RKSJ-V.bcmap
83pv-RKSJ-H.bcmap
90ms-RKSJ-H.bcmap
90ms-RKSJ-V.bcmap
90msp-RKSJ-H.bcmap
90msp-RKSJ-V.bcmap
90pv-RKSJ-H.bcmap
90pv-RKSJ-V.bcmap
Add-H.bcmap
Add-RKSJ-H.bcmap
Add-RKSJ-V.bcmap
Add-V.bcmap
Adobe-CNS1-0.bcmap
Adobe-CNS1-1.bcmap
Adobe-CNS1-2.bcmap
Adobe-CNS1-3.bcmap
Adobe-CNS1-4.bcmap
Adobe-CNS1-5.bcmap
Adobe-CNS1-6.bcmap
Adobe-CNS1-UCS2.bcmap
Adobe-GB1-0.bcmap
Adobe-GB1-1.bcmap
Adobe-GB1-2.bcmap
Adobe-GB1-3.bcmap
Adobe-GB1-4.bcmap
Adobe-GB1-5.bcmap
Adobe-GB1-UCS2.bcmap
Adobe-Japan1-0.bcmap
Adobe-Japan1-1.bcmap
Adobe-Japan1-2.bcmap
Adobe-Japan1-3.bcmap
Adobe-Japan1-4.bcmap
Adobe-Japan1-5.bcmap
Adobe-Japan1-6.bcmap
Adobe-Japan1-UCS2.bcmap
Adobe-Korea1-0.bcmap
Adobe-Korea1-1.bcmap
Adobe-Korea1-2.bcmap
Adobe-Korea1-UCS2.bcmap
B5-H.bcmap
B5-V.bcmap
B5pc-H.bcmap
B5pc-V.bcmap
CNS-EUC-H.bcmap
CNS-EUC-V.bcmap
CNS1-H.bcmap
CNS1-V.bcmap
CNS2-H.bcmap
CNS2-V.bcmap
ETHK-B5-H.bcmap
ETHK-B5-V.bcmap
ETen-B5-H.bcmap
ETen-B5-V.bcmap
ETenms-B5-H.bcmap
ETenms-B5-V.bcmap
EUC-H.bcmap
EUC-V.bcmap
Ext-H.bcmap
Ext-RKSJ-H.bcmap
Ext-RKSJ-V.bcmap
Ext-V.bcmap
GB-EUC-H.bcmap
GB-EUC-V.bcmap
GB-H.bcmap
GB-V.bcmap
GBK-EUC-H.bcmap
GBK-EUC-V.bcmap
GBK2K-H.bcmap
GBK2K-V.bcmap
GBKp-EUC-H.bcmap
GBKp-EUC-V.bcmap
GBT-EUC-H.bcmap
GBT-EUC-V.bcmap
GBT-H.bcmap
GBT-V.bcmap
GBTpc-EUC-H.bcmap
GBTpc-EUC-V.bcmap
GBpc-EUC-H.bcmap
GBpc-EUC-V.bcmap
H.bcmap
HKdla-B5-H.bcmap
HKdla-B5-V.bcmap
HKdlb-B5-H.bcmap
HKdlb-B5-V.bcmap
HKgccs-B5-H.bcmap
HKgccs-B5-V.bcmap
HKm314-B5-H.bcmap
HKm314-B5-V.bcmap
HKm471-B5-H.bcmap
HKm471-B5-V.bcmap
HKscs-B5-H.bcmap
HKscs-B5-V.bcmap
Hankaku.bcmap
Hiragana.bcmap
KSC-EUC-H.bcmap
KSC-EUC-V.bcmap
KSC-H.bcmap
KSC-Johab-H.bcmap
KSC-Johab-V.bcmap
KSC-V.bcmap
KSCms-UHC-H.bcmap
KSCms-UHC-HW-H.bcmap
KSCms-UHC-HW-V.bcmap
KSCms-UHC-V.bcmap
KSCpc-EUC-H.bcmap
KSCpc-EUC-V.bcmap
Katakana.bcmap
LICENSE
NWP-H.bcmap
NWP-V.bcmap
RKSJ-H.bcmap
RKSJ-V.bcmap
Roman.bcmap
UniCNS-UCS2-H.bcmap
UniCNS-UCS2-V.bcmap
UniCNS-UTF16-H.bcmap
UniCNS-UTF16-V.bcmap
UniCNS-UTF32-H.bcmap
UniCNS-UTF32-V.bcmap
UniCNS-UTF8-H.bcmap
UniCNS-UTF8-V.bcmap
UniGB-UCS2-H.bcmap
UniGB-UCS2-V.bcmap
UniGB-UTF16-H.bcmap
UniGB-UTF16-V.bcmap
UniGB-UTF32-H.bcmap
UniGB-UTF32-V.bcmap
UniGB-UTF8-H.bcmap
UniGB-UTF8-V.bcmap
UniJIS-UCS2-H.bcmap
UniJIS-UCS2-HW-H.bcmap
UniJIS-UCS2-HW-V.bcmap
UniJIS-UCS2-V.bcmap
UniJIS-UTF16-H.bcmap
UniJIS-UTF16-V.bcmap
UniJIS-UTF32-H.bcmap
UniJIS-UTF32-V.bcmap
UniJIS-UTF8-H.bcmap
UniJIS-UTF8-V.bcmap
UniJIS2004-UTF16-H.bcmap
UniJIS2004-UTF16-V.bcmap
UniJIS2004-UTF32-H.bcmap
UniJIS2004-UTF32-V.bcmap
UniJIS2004-UTF8-H.bcmap
UniJIS2004-UTF8-V.bcmap
UniJISPro-UCS2-HW-V.bcmap
UniJISPro-UCS2-V.bcmap
UniJISPro-UTF8-V.bcmap
UniJISX0213-UTF32-H.bcmap
UniJISX0213-UTF32-V.bcmap
UniJISX02132004-UTF32-H.bcmap
UniJISX02132004-UTF32-V.bcmap
UniKS-UCS2-H.bcmap
UniKS-UCS2-V.bcmap
UniKS-UTF16-H.bcmap
UniKS-UTF16-V.bcmap
UniKS-UTF32-H.bcmap
UniKS-UTF32-V.bcmap
UniKS-UTF8-H.bcmap
UniKS-UTF8-V.bcmap
V.bcmap
WP-Symbol.bcmap
FoxitDingbats.pfb
FoxitFixed.pfb
FoxitFixedBold.pfb
FoxitFixedBoldItalic.pfb
FoxitFixedItalic.pfb
FoxitSerif.pfb
FoxitSerifBold.pfb
FoxitSerifBoldItalic.pfb
FoxitSerifItalic.pfb
FoxitSymbol.pfb
LICENSE_FOXIT
LICENSE_LIBERATION
LiberationSans-Bold.ttf
LiberationSans-BoldItalic.ttf
LiberationSans-Italic.ttf
LiberationSans-Regular.ttf
LICENSE_OPENJPEG
LICENSE_PDFJS_OPENJPEG
LICENSE_PDFJS_QCMS
LICENSE_QCMS
openjpeg.wasm
qcms_bg.wasm
package.json
SKILL.md
LICENSE.txt
SKILL.md
academic.md
creative-fixed-canvas.md
creative-flow.md
creative.md
poster.md
process-advanced.md
process.md
report.md
resume.md
components.md
fonts.md
visual_framework.md
env_check.sh
font_list.txt
setup.md
setup_mac_linux.sh
setup_windows.ps1
resume-academic.tex
resume-altacv.tex
cover_render.py
cover_validate.js
design_engine.py
html2pdf-next.js
html2poster.js
pdf.py
pdf_qa.py
poster_validate.py
setup.sh
toc_validate.py
charts.md
cover-backgrounds.md
cover.md
fill-engine.md
geometry.md
overflow.md
pagination.md
palette.md
typography.md
plugin.json
package.json
SKILL.md
installing-and-updating.md
plugin-json-spec.md
create-basic-plugin.mjs
marketplace-files.mjs
scaffold-files.mjs
upsert-dev-marketplace.mjs
validate-plugin.mjs
plugin.json
THIRD_PARTY_NOTICES.txt
server.mjs
assets.json
bundle-0.txt
panel.html
package.json
SKILL.md
SKILL.md
plugin.json
README.md
restore-legacy-sessions.md
package.json
SKILL.md
restore-conversation.mjs
scan-legacy-sessions.mjs
plugin.json
package.json
SKILL.md
plugin.json
THIRD_PARTY_NOTICES.txt
server.mjs
assets.json
bundle-0.txt
panel.html
sheets.wasm
xlsx-worker.js
package.json
SKILL.md
SKILL.md
chart-templates.md
chart.md
design.md
vba-templates.md
env_check.sh
font_list.txt
setup.md
setup_mac_linux.sh
setup_windows.ps1
pipeline.md
advanced.md
analyze-recipes.md
analyze.md
convert.md
create.md
edit-patterns.md
edit.md
finance.md
finance_lite.md
vba.md
setup.sh
base.py
palettes.py
xlsx.py
plugin.json
package.json
LICENSE.md
SKILL.md
calendar.js
runtime-manifest.json
standalone-host-bridge.js
standalone-shell.js
d3-7.9.0.min.js
d3-7.9.0.min.js.LICENSE
floating-ui-core-1.7.3.min.js
floating-ui-dom-1.7.4.min.js
floating-ui-dom-1.7.4.min.js.LICENSE
lucide-1.17.0.js
lucide-1.17.0.js.LICENSE
manifest.json
visualize.css
visualize.html
calendar.html
api.md
styles.md
render.py
vendor.py
tweak.md
calendar.md
plugin.json
computer-use.md
libvips-42.dll
libvips-cpp-8.17.3.dll
sharp-win32-x64.node
koffi.node
index.d.ts
index.js
package.json
package.json
check-sdk.mjs
check-version-coherence.mjs
computer-use-client.mjs
sync-cache.mjs
sync-skill.mjs
SKILL.md
plugin.json
README.md
package.json
SKILL.md
SKILL.md
SKILL.md
SKILL.md
SKILL.md
SKILL.md
zcode.cjs
icon.png
icon_windows.png
LICENSE
LICENSES.chromium.html
SOURCES.json
ax_native.node
windows-helper.js
libvips-42.dll
libvips-cpp-8.17.3.dll
sharp-win32-x64.node
index.js
package.json
index.js
read.js
json.js
raw.js
text.js
urlencoded.js
utils.js
package.json
LICENSE
index.js
package.json
.eslintrc
FUNDING.yml
actualApply.js
applyBind.js
functionApply.js
functionCall.js
index.js
package.json
reflectApply.js
tsconfig.json
.eslintrc
FUNDING.yml
.nycrc
LICENSE
index.js
package.json
tsconfig.json
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
package.json
browser.js
common.js
index.js
node.js
LICENSE
index.js
index.js
package.json
FUNDING.yml
get.js
package.json
set.js
tsconfig.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
.eslintrc
FUNDING.yml
index.js
package.json
tsconfig.json
.eslintrc
FUNDING.yml
eval.js
index.js
package.json
range.js
ref.js
syntax.js
tsconfig.json
type.js
uri.js
FUNDING.yml
RequireObjectCoercible.js
ToObject.js
index.js
isObject.js
package.json
tsconfig.json
LICENSE
index.js
package.json
index.js
package.json
LICENSE
index.js
application.js
express.js
request.js
response.js
utils.js
view.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
.eslintrc
FUNDING.yml
.nycrc
LICENSE
implementation.js
index.js
package.json
.eslintrc
FUNDING.yml
LICENSE
index.js
package.json
.eslintrc
FUNDING.yml
LICENSE
Object.getPrototypeOf.js
Reflect.getPrototypeOf.js
index.js
package.json
tsconfig.json
.eslintrc
FUNDING.yml
LICENSE
gOPD.js
index.js
package.json
.eslintrc
FUNDING.yml
LICENSE
index.js
package.json
shams.js
tsconfig.json
FUNDING.yml
LICENSE
index.js
package.json
tsconfig.json
LICENSE
index.js
package.json
LICENSE
dbcs-codec.js
dbcs-data.js
index.js
internal.js
sbcs-codec.js
sbcs-data-generated.js
sbcs-data.js
big5-added.json
cp936.json
cp949.json
cp950.json
eucjp.json
gb18030-ranges.json
gbk-added.json
shiftjis.json
utf16.js
utf32.js
utf7.js
bom-handling.js
merge-exports.js
index.js
streams.js
package.json
LICENSE
inherits.js
inherits_browser.js
package.json
LICENSE
ipaddr.min.js
ipaddr.js
package.json
LICENSE
index.js
index.mjs
package.json
.eslintrc
FUNDING.yml
LICENSE
abs.js
maxArrayLength.js
maxSafeInteger.js
maxValue.js
floor.js
isFinite.js
isInteger.js
isNaN.js
isNegativeZero.js
max.js
min.js
mod.js
package.json
pow.js
round.js
sign.js
tsconfig.json
index.js
package.json
index.js
license
package.json
LICENSE
db.json
index.js
package.json
LICENSE
index.js
mimeScore.js
package.json
index.js
package.json
LICENSE
index.js
charset.js
encoding.js
language.js
mediaType.js
package.json
.eslintrc
FUNDING.yml
.nycrc
LICENSE
all.js
circular.js
fn.js
inspect.js
index.js
package-support.json
package.json
test-core-js.js
util.inspect.js
LICENSE
index.js
package.json
once.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
.editorconfig
FUNDING.yml
.nycrc
qs.js
eslint.config.mjs
formats.js
index.js
parse.js
stringify.js
utils.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
layer.js
route.js
package.json
LICENSE
dangerous.js
package.json
safer.js
tests.js
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
.editorconfig
FUNDING.yml
index.js
package.json
.eslintrc
FUNDING.yml
index.js
package.json
.eslintrc
FUNDING.yml
LICENSE
index.js
package.json
FUNDING.yml
index.js
package.json
tsconfig.json
LICENSE
codes.json
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
LICENSE
index.js
package.json
index.js
package.json
package.json
wrappy.js
package.json
runtime-manifest.json
.bundle-meta.json
rg.exe
.bundle-meta.json
SOURCES.json
THIRD-PARTY-NOTICES.txt
ugrep.exe
tray_icon.ico
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsExec.dll
nsis7z.dll
default.dic
162a1554-f5d3-49dd-a3f5-a12e3635d417.tmp
1a1c2a74-b0f2-4285-aa28-a0354cb700ae.tmp
data_3
index
data_2
data_3
data_0
data_1
MANIFEST-000001
temp-index
5ebeabcd-c393-449a-b819-1980b9ea7b11.tmp
c35eef2c-65c7-4ec2-9684-337369db376d.tmp
temp-index
Preferences
c5a720ec-8206-4df8-8c60-01bdf3b6c3de.tmp
memory/624-10974-0x00007FFD82920000-0x00007FFD82921000-memory.dmp
memory/624-10973-0x00007FFD82650000-0x00007FFD82651000-memory.dmp
memory/624-11482-0x000001F150C00000-0x000001F150CAD000-memory.dmp
memory/1244-15435-0x000001547A7F0000-0x000001547A89D000-memory.dmp
memory/1952-16121-0x00000274C3650000-0x00000274C36FD000-memory.dmp
memory/2228-2161-0x000000006FE00000-0x000000006FE4C000-memory.dmp
memory/2228-2169-0x0000000007EE0000-0x0000000007F76000-memory.dmp
memory/2228-2170-0x0000000007E40000-0x0000000007E51000-memory.dmp
memory/3464-15512-0x000001D8FDFA0000-0x000001D8FE055000-memory.dmp
memory/4288-2141-0x0000000007A40000-0x0000000007A5A000-memory.dmp
memory/4288-2140-0x00000000080A0000-0x000000000871A000-memory.dmp
memory/4288-2145-0x000000006FF60000-0x00000000702B7000-memory.dmp
memory/4288-2144-0x0000000007C50000-0x0000000007C74000-memory.dmp
memory/4288-2143-0x0000000007C20000-0x0000000007C4A000-memory.dmp
memory/4288-2142-0x0000000007AA0000-0x0000000007AAA000-memory.dmp
memory/4288-2139-0x0000000007970000-0x0000000007A13000-memory.dmp
memory/4288-2128-0x00000000066D0000-0x000000000671C000-memory.dmp
memory/4288-2127-0x00000000066A0000-0x00000000066BE000-memory.dmp
memory/4288-2118-0x00000000061E0000-0x0000000006537000-memory.dmp
memory/4288-2110-0x0000000006070000-0x00000000060D6000-memory.dmp
memory/4288-2129-0x00000000076B0000-0x00000000076E2000-memory.dmp
memory/4288-2109-0x0000000006000000-0x0000000006066000-memory.dmp
memory/4288-2130-0x000000006FE00000-0x000000006FE4C000-memory.dmp
memory/4288-2138-0x0000000007690000-0x00000000076AE000-memory.dmp
memory/4288-2108-0x0000000005750000-0x0000000005772000-memory.dmp
memory/4288-2107-0x00000000058C0000-0x0000000005F8A000-memory.dmp
memory/4288-2106-0x0000000005040000-0x0000000005076000-memory.dmp
memory/5764-2191-0x0000000005840000-0x0000000005B97000-memory.dmp
memory/5764-2201-0x0000000070140000-0x0000000070497000-memory.dmp
memory/5764-2193-0x000000006FE00000-0x000000006FE4C000-memory.dmp
memory/7664-16451-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16450-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16446-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16447-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16448-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16442-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16441-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16440-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16452-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7664-16449-0x000001BF8BDD0000-0x000001BF8BDD1000-memory.dmp
memory/7724-14793-0x0000020F7D050000-0x0000020F7D105000-memory.dmp
memory/7724-14815-0x0000020F7D150000-0x0000020F7D17A000-memory.dmp
memory/7724-14816-0x0000020F7D150000-0x0000020F7D174000-memory.dmp
memory/7724-14813-0x0000020F7D110000-0x0000020F7D11A000-memory.dmp
memory/7724-14792-0x0000020F7D030000-0x0000020F7D04C000-memory.dmp
memory/7724-14776-0x0000020F7CE80000-0x0000020F7CEA2000-memory.dmp