# E19. Windows elevation and Electron execution analysis

## Examined branches

The 22 July record compares decrypted Windows pipeline source from the VSIX with the ClickFix stage-three JavaScript. Both contain a COM-elevation script builder and subsequent interpreter-launch logic. The analysis was static on Linux; no Windows elevation or collection was reproduced. [S1]

## Elevation attempt

The recovered builder constructs a PowerShell request for an elevated COM object associated with CMSTPLUA and the ICMLuaUtil interface. Interface identifiers are assembled from numeric components. A runtime-created delegate invokes the relevant shell-execution method. These details establish an implemented attempt; they do not establish successful elevation on every Windows host. [S1]

The source record describes a visible RunAs fallback in the VSIX pipeline. The ClickFix branch additionally includes repeated attempts and a completion-sentinel check. Such fallbacks show that failure is anticipated. Windows version, user group, UAC configuration, policy and process context can change the outcome.

## Editor runtime

The subsequent script sets `ELECTRON_RUN_AS_NODE` and uses the editor executable as a JavaScript interpreter. The path is derived from the process executable in the extension context. This can place an editor binary in the collection process tree while avoiding a separate Node executable for that branch. It does not imply compromise of the editor vendor or a modified editor signature. [S1]

The collection pipeline then invokes a Python component for browser-related decryption. Elevation and browser decryption are separate operations with separate preconditions; successful elevation would not alone prove recovery of App-Bound Encryption material.

## Detection evidence and limits

Relevant observations include editor-to-PowerShell ancestry, an unexpectedly elevated editor interpreter, unusual script arguments and later credential-store access. Publisher trust alone is insufficient to describe the executed script, but the record does not prove that every allowlisting policy would permit it. The ClickFix and extension entry points need not produce identical ancestry.

The report omits a runnable elevation sequence. It records the static mechanism and its dependencies, not a demonstrated universal bypass or successful infection. Decrypted artifact identities and the historical authentication result are given in E04.