Microsoft Visual Studio Code 1.145.0

by Microsoft Corporationinstaller signed by Microsoft CorporationValid

Sources: observed in the EchoTrail lab on Windows 11 on November 4, 2026.

The install

Installer: vscodeusersetup-x64-1.145.0.exe
Installer type: inno
Installed through: a type-detected silent switch
Install directory: C:\Users\lab\AppData\Local\Programs
Launched: Code.exe
Windows: Windows 11
Date: November 4, 2026
Executables dropped: 31

installer sha256 3f7c8b905cfd4795b9d5ff9cfded9085bd2fa14a1d5001e94d07c89f021d9950

The lab used Microsoft Visual Studio Code for 3 minutes, changed a setting, then rebooted and watched what came back.

On screen

Frames from the lab session, cropped to Microsoft Visual Studio Code's own windows.

Microsoft Visual Studio Code 1.145.0: First window — First window. VS Code first-run welcome dialog asks to sign in to GitHub Copilot, with a OneDrive notification overlapping the corner.

Microsoft Visual Studio Code 1.145.0: Main window — Main window. VS Code Welcome page is open with a OneDrive notification popup in the corner and a Chat side panel.

Microsoft Visual Studio Code 1.145.0: Settings — Settings. The VS Code Settings tab is open showing Commonly Used settings with Editor Font Size set to 14.

Microsoft Visual Studio Code 1.145.0: Worth a look — Worth a look. A Microsoft OneDrive sign-in window has appeared on top of VS Code, which is an unexpected window asking for an email address.

What it dropped

Executables

code.exesigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\Code.exe
sha256 f1e1d79be5f50a238681738f813c4b353aad69f4b05f068899ec98a2d1b74c32
code-tunnel.exesigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\bin\code-tunnel.exe
sha256 ab6955ce9723b8045110867aef2727211999f947587dfbe498142f32327ff186
dxcompiler.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\dxcompiler.dll
libglesv2.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\libGLESv2.dll
tgrep.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\tgrep\bin\win32-x64\tgrep.exe
oneauthinterop.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\OneAuthInterop.dll
vsce-sign.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@vscode\vsce-sign\bin\vsce-sign.exe
vk_swiftshader.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\vk_swiftshader.dll
rg.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\ripgrep\bin\win32-x64\rg.exe
rg.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@vscode\ripgrep-universal\bin\win32-x64\rg.exe
rg.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\extensions\copilot\node_modules\@github\copilot\sdk\ripgrep\bin\win32-x64\rg.exe
d3dcompiler_47.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\d3dcompiler_47.dll
tgrep.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\extensions\copilot\node_modules\@github\copilot\tgrep\bin\win32-x64\tgrep.exe
tgrep.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\extensions\copilot\node_modules\@github\copilot\sdk\tgrep\bin\win32-x64\tgrep.exe
unins000.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\unins000.exe
msalruntime.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\msalruntime.dll
msalruntime.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\extensions\microsoft-authentication\dist\msalruntime.dll
ffmpeg.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\ffmpeg.dll
dxil.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\dxil.dll
openconsole.exe
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\node-pty\build\Release\conpty\OpenConsole.exe
vulkan-1.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\vulkan-1.dll
copilot-runtime.exesigned by CN="GitHub, Inc.", O="GitHub, Inc.", L=San Francisco, S=California, C=USValidran during the lab session
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\@github\copilot-sdk-win32-x64\prebuilds\win32-x64\copilot-runtime.exe
sha256 0ccd6007fffb3240c80d567909c3f610bf45c54fd05a33a55253d14023058504
libegl.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\libEGL.dll
inno_updater.exesigned by CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=USValidran during the lab session
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\tools\inno_updater.exe
sha256 f84747acd395101a4cbf7684fb4361b46c660c9e17f456c8208561613460db44
microsoft.powershell.psreadline.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\out\vs\workbench\contrib\terminal\common\scripts\psreadline\Microsoft.PowerShell.PSReadLine.dll
conpty.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\node_modules.asar.unpacked\node-pty\build\Release\conpty\conpty.dll
vcruntime140.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\tools\vcruntime140.dll
code_explorer_command_x64.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\appx\code_explorer_command_x64.dll
microsoft.powershell.pager.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\out\vs\workbench\contrib\terminal\common\scripts\psreadline\Microsoft.PowerShell.Pager.dll
microsoft.powershell.psreadline.polyfiller.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\out\vs\workbench\contrib\terminal\common\scripts\psreadline\netstd\Microsoft.PowerShell.PSReadLine.Polyfiller.dll
microsoft.powershell.psreadline.polyfiller.dll
C:\Users\lab\AppData\Local\Programs\Microsoft VS Code\a717861c07\resources\app\out\vs\workbench\contrib\terminal\common\scripts\psreadline\net6plus\Microsoft.PowerShell.PSReadLine.Polyfiller.dll

What it talked to

Destinations

13.107.5.93:443asked by code.exe5 connections
74.151.238.133:443asked by code.exe4 connections
23.194.127.238:443asked by code.exe3 connections
23.55.236.212:443asked by code.exe3 connections
74.151.238.100:443asked by code.exe3 connections
138.91.182.224:443asked by code.exe2 connections
23.215.223.41:443asked by code.exe2 connections
150.171.74.16:443asked by code.exe
4.150.223.104:443asked by code.exe

DNS

mobile.events.data.microsoft.comasked by code.exe
default.exp-tas.comasked by code.exe
exp.individual.githubcopilot.comasked by code.exe