Analysis
-
max time kernel
1046s -
max time network
1046s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2023, 13:17
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Detected phishing page
-
Blocklisted process makes network request 2 IoCs
flow pid Process 66 1400 powershell.exe 68 1400 powershell.exe -
Downloads MZ/PE file
-
Modifies Installed Components in the registry 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe -
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe -
Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation javaw.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation msedgewebview2.exe -
Executes dropped EXE 64 IoCs
pid Process 3412 MicrosoftEdgeWebview2Setup.exe 2240 MicrosoftEdgeUpdate.exe 3024 MicrosoftEdgeUpdate.exe 1572 MicrosoftEdgeUpdate.exe 2544 MicrosoftEdgeUpdateComRegisterShell64.exe 2172 MicrosoftEdgeUpdateComRegisterShell64.exe 3972 MicrosoftEdgeUpdateComRegisterShell64.exe 1796 MicrosoftEdgeUpdate.exe 3964 MicrosoftEdgeUpdate.exe 5040 MicrosoftEdgeUpdate.exe 4556 MicrosoftEdgeUpdate.exe 3160 MicrosoftEdge_X64_114.0.1823.43.exe 2752 setup.exe 1892 MicrosoftEdgeUpdate.exe 448 LiquidLauncher.exe 4204 msedgewebview2.exe 996 msedgewebview2.exe 4908 msedgewebview2.exe 2660 msedgewebview2.exe 1012 msedgewebview2.exe 4496 msedgewebview2.exe 2700 msedgewebview2.exe 5888 msedgewebview2.exe 2064 msedgewebview2.exe 4716 msedgewebview2.exe 968 msedgewebview2.exe 4328 detection-tool-0-0-2-win.exe 5860 msedgewebview2.exe 1288 msedgewebview2.exe 5144 msedgewebview2.exe 4572 msedgewebview2.exe 5244 msedgewebview2.exe 3712 msedgewebview2.exe 4712 msedgewebview2.exe 4968 msedgewebview2.exe 5600 msedgewebview2.exe 1120 msedgewebview2.exe 5552 msedgewebview2.exe 3336 msedgewebview2.exe 6056 msedgewebview2.exe 3232 msedgewebview2.exe 4832 msedgewebview2.exe 4576 msedgewebview2.exe 5584 MicrosoftEdgeUpdate.exe 2272 MicrosoftEdgeUpdate.exe 3700 MicrosoftEdge_X64_114.0.1823.43.exe 5924 setup.exe 2684 setup.exe 1416 setup.exe 3868 MicrosoftEdgeUpdate.exe 1920 detection-tool-0-0-2-win.exe 1640 javaw.exe 3972 detection-tool-0-0-2-win.exe 2856 LiquidLauncher.exe 2996 msedgewebview2.exe 2768 msedgewebview2.exe 4632 msedgewebview2.exe 1388 msedgewebview2.exe 5624 msedgewebview2.exe 9164 msedgewebview2.exe 1492 msedgewebview2.exe 6812 msedgewebview2.exe 6684 msedgewebview2.exe 5168 msedgewebview2.exe -
Loads dropped DLL 64 IoCs
pid Process 3148 MsiExec.exe 2240 MicrosoftEdgeUpdate.exe 3024 MicrosoftEdgeUpdate.exe 1572 MicrosoftEdgeUpdate.exe 2544 MicrosoftEdgeUpdateComRegisterShell64.exe 1572 MicrosoftEdgeUpdate.exe 2172 MicrosoftEdgeUpdateComRegisterShell64.exe 1572 MicrosoftEdgeUpdate.exe 3972 MicrosoftEdgeUpdateComRegisterShell64.exe 1572 MicrosoftEdgeUpdate.exe 1796 MicrosoftEdgeUpdate.exe 3964 MicrosoftEdgeUpdate.exe 5040 MicrosoftEdgeUpdate.exe 5040 MicrosoftEdgeUpdate.exe 3964 MicrosoftEdgeUpdate.exe 4556 MicrosoftEdgeUpdate.exe 1892 MicrosoftEdgeUpdate.exe 3148 MsiExec.exe 448 LiquidLauncher.exe 4204 msedgewebview2.exe 996 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 2660 msedgewebview2.exe 2660 msedgewebview2.exe 2660 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 1012 msedgewebview2.exe 1012 msedgewebview2.exe 1012 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 4908 msedgewebview2.exe 4496 msedgewebview2.exe 4496 msedgewebview2.exe 4496 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 2700 msedgewebview2.exe 2700 msedgewebview2.exe 2700 msedgewebview2.exe 5888 msedgewebview2.exe 5888 msedgewebview2.exe 5888 msedgewebview2.exe 2064 msedgewebview2.exe 2064 msedgewebview2.exe 2064 msedgewebview2.exe 4716 msedgewebview2.exe 4716 msedgewebview2.exe 4716 msedgewebview2.exe 4716 msedgewebview2.exe 968 msedgewebview2.exe 968 msedgewebview2.exe 968 msedgewebview2.exe 5860 msedgewebview2.exe 5860 msedgewebview2.exe 5860 msedgewebview2.exe 1288 msedgewebview2.exe 1288 msedgewebview2.exe 1288 msedgewebview2.exe -
Registers COM server for autorun 1 TTPs 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\notification_click_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\BHO\\ie_to_edge_bho_64.dll" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\notification_helper.exe" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\PdfPreview\\PdfPreviewHandler.dll" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\notification_click_helper.exe" setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce setup.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce setup.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LiquidLauncher.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LiquidLauncher.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe -
Checks system information in the registry 2 TTPs 20 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM32\ucrtbase.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\DLL\kernel32.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\symbols\DLL\kernel32.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\dll\ntdll.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe File opened for modification C:\Windows\SYSTEM32\jvm.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\kernel32.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\ntdll.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\dll\jvm.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\dll\ucrtbase.pdb javaw.exe File opened for modification C:\Windows\SYSTEM32\symbols\dll\ucrtbase.pdb javaw.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_sr.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_ta.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_kok.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdateSetup.exe MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\nn.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\Locales\am.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\pl.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\psuser.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Installer\msedge_7z.data setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\sr.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedge_100_percent.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\identity_proxy\win11\identity_helper.Sparse.Dev.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\concrt140.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\msedge_100_percent.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_ka.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\am.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\bn-IN.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\icudtl.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\VisualElements\SmallLogoBeta.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Sigma\Content setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Trust Protection Lists\Mu\Cryptomining setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\gu.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\ne.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\az.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\BHO\ie_to_edge_bho.dll setup.exe File created C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4204_1354599674\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping4204_1354599674\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Locales\de.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\notification_helper.exe setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_vi.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\microsoft_shell_integration.dll setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\Locales\ta.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\msedge_200_percent.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Sigma\Staging setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Mu\Analytics setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Locales\ca.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_pt-BR.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\BHO\ie_to_edge_bho_64.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\identity_proxy\win10\identity_helper.Sparse.Dev.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Mu\Content setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\identity_proxy\win10\identity_helper.Sparse.Canary.msix setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Locales\hr.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_es-419.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\msedge.exe setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\Locales\ms.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Locales\or.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_tr.dll MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\fa.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\Edge.dat setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\ne.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\manifest.json setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\hu.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\v8_context_snapshot.bin setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\gl.pak setup.exe File created C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\msedgeupdateres_lb.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Sigma\LICENSE setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Locales\ug.pak setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\sv.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\VisualElements\LogoDev.png setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\Trust Protection Lists\Sigma\Cryptomining setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\microsoft_shell_integration.dll setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Trust Protection Lists\Sigma\Cryptomining setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\sl.pak setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\114.0.1823.43\Locales\tt.pak setup.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\Installer\e57a2e9.msi msiexec.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ucrtbase.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\ucrtbase.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\DLL\kernel32.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\ntdll.pdb javaw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIA49C.tmp msiexec.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\ntdll.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\dll\jvm.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\kernel32.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\DLL\kernel32.pdb javaw.exe File opened for modification C:\Windows\Installer\e57a2e7.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{B6D7A800-A8B4-4E73-8DF9-038ECC59CD9C}\ProductIcon msiexec.exe File created C:\Windows\Installer\e57a2e7.msi msiexec.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\symbols\dll\jvm.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ucrtbase.pdb javaw.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\ntdll.pdb javaw.exe File created C:\Windows\Installer\SourceHash{B6D7A800-A8B4-4E73-8DF9-038ECC59CD9C} msiexec.exe File opened for modification C:\Windows\Installer\{B6D7A800-A8B4-4E73-8DF9-038ECC59CD9C}\ProductIcon msiexec.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\jvm.pdb javaw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 javaw.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\ javaw.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier javaw.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor javaw.exe -
Enumerates system info in registry 2 TTPs 11 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d42e80ebae45d901 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\BHO" setup.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\114.0.1823.43\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9A121FEC-09EC-11EE-9EF6-62A6D96D5571} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{6616BC2D-2791-423E-8384-E90A1F30D5A0}" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000 iexplore.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133311360281009487" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall" setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CLSID\ = "{8F09CD6C-5964-4573-82E3-EBFF7702865B}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\msedgeupdate.dll,-1004" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\AppUserModelId = "MSEdge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\CLSID\ = "{9F3F5F5D-721A-4B19-9B5D-69F664C1A591}" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\runas setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalizedString = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\msedgeupdate.dll,-3000" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE} MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas\ProgrammaticAccessOnly setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\Elevation\Enabled = "1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreMachineClass\CLSID\ = "{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\VersionIndependentProgID\ = "MicrosoftEdgeUpdate.CredentialDialogMachine" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.html setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachine\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}\ = "ie_to_edge_bho" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods\ = "26" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.175.27\\MicrosoftEdgeUpdateOnDemand.exe\"" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgePDF\DefaultIcon setup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\ = "IPolicyStatus4" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\Application\ApplicationName = "Microsoft Edge" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\MSEdgeMHT\shell\open setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F7B3738C-9BCA-4B14-90B7-89D0F3A3E497}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\ = "Microsoft Edge Update Update3Web" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ProxyStubClsid32\ = "{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5} setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\DOMStorage\office.com\NumberOfSubdomains = "1" wwahost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E92E8AF9-A2D8-48A4-B704-3024EC20EEFF}\ = "PSFactoryBuffer" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods\ = "8" MicrosoftEdgeUpdateComRegisterShell64.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 41 IoCs
pid Process 4100 msiexec.exe 4100 msiexec.exe 1400 powershell.exe 1400 powershell.exe 1400 powershell.exe 2240 MicrosoftEdgeUpdate.exe 2240 MicrosoftEdgeUpdate.exe 2240 MicrosoftEdgeUpdate.exe 2240 MicrosoftEdgeUpdate.exe 2240 MicrosoftEdgeUpdate.exe 2240 MicrosoftEdgeUpdate.exe 1332 chrome.exe 1332 chrome.exe 4716 msedgewebview2.exe 4716 msedgewebview2.exe 448 LiquidLauncher.exe 448 LiquidLauncher.exe 5584 MicrosoftEdgeUpdate.exe 5584 MicrosoftEdgeUpdate.exe 5584 MicrosoftEdgeUpdate.exe 5584 MicrosoftEdgeUpdate.exe 2272 MicrosoftEdgeUpdate.exe 2272 MicrosoftEdgeUpdate.exe 1416 setup.exe 1416 setup.exe 4336 wwahost.exe 4336 wwahost.exe 5876 LocalBridge.exe 5876 LocalBridge.exe 5876 LocalBridge.exe 5876 LocalBridge.exe 5876 LocalBridge.exe 5876 LocalBridge.exe 1640 javaw.exe 1640 javaw.exe 1640 javaw.exe 1640 javaw.exe 2856 LiquidLauncher.exe 2856 LiquidLauncher.exe 5692 msedgewebview2.exe 5692 msedgewebview2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
pid Process 4204 msedgewebview2.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 4204 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe 2996 msedgewebview2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1100 7zG.exe Token: 35 1100 7zG.exe Token: SeSecurityPrivilege 1100 7zG.exe Token: SeSecurityPrivilege 1100 7zG.exe Token: SeShutdownPrivilege 4936 msiexec.exe Token: SeIncreaseQuotaPrivilege 4936 msiexec.exe Token: SeSecurityPrivilege 4100 msiexec.exe Token: SeCreateTokenPrivilege 4936 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4936 msiexec.exe Token: SeLockMemoryPrivilege 4936 msiexec.exe Token: SeIncreaseQuotaPrivilege 4936 msiexec.exe Token: SeMachineAccountPrivilege 4936 msiexec.exe Token: SeTcbPrivilege 4936 msiexec.exe Token: SeSecurityPrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeLoadDriverPrivilege 4936 msiexec.exe Token: SeSystemProfilePrivilege 4936 msiexec.exe Token: SeSystemtimePrivilege 4936 msiexec.exe Token: SeProfSingleProcessPrivilege 4936 msiexec.exe Token: SeIncBasePriorityPrivilege 4936 msiexec.exe Token: SeCreatePagefilePrivilege 4936 msiexec.exe Token: SeCreatePermanentPrivilege 4936 msiexec.exe Token: SeBackupPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeShutdownPrivilege 4936 msiexec.exe Token: SeDebugPrivilege 4936 msiexec.exe Token: SeAuditPrivilege 4936 msiexec.exe Token: SeSystemEnvironmentPrivilege 4936 msiexec.exe Token: SeChangeNotifyPrivilege 4936 msiexec.exe Token: SeRemoteShutdownPrivilege 4936 msiexec.exe Token: SeUndockPrivilege 4936 msiexec.exe Token: SeSyncAgentPrivilege 4936 msiexec.exe Token: SeEnableDelegationPrivilege 4936 msiexec.exe Token: SeManageVolumePrivilege 4936 msiexec.exe Token: SeImpersonatePrivilege 4936 msiexec.exe Token: SeCreateGlobalPrivilege 4936 msiexec.exe Token: SeCreateTokenPrivilege 4936 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4936 msiexec.exe Token: SeLockMemoryPrivilege 4936 msiexec.exe Token: SeIncreaseQuotaPrivilege 4936 msiexec.exe Token: SeMachineAccountPrivilege 4936 msiexec.exe Token: SeTcbPrivilege 4936 msiexec.exe Token: SeSecurityPrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeLoadDriverPrivilege 4936 msiexec.exe Token: SeSystemProfilePrivilege 4936 msiexec.exe Token: SeSystemtimePrivilege 4936 msiexec.exe Token: SeProfSingleProcessPrivilege 4936 msiexec.exe Token: SeIncBasePriorityPrivilege 4936 msiexec.exe Token: SeCreatePagefilePrivilege 4936 msiexec.exe Token: SeCreatePermanentPrivilege 4936 msiexec.exe Token: SeBackupPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeShutdownPrivilege 4936 msiexec.exe Token: SeDebugPrivilege 4936 msiexec.exe Token: SeAuditPrivilege 4936 msiexec.exe Token: SeSystemEnvironmentPrivilege 4936 msiexec.exe Token: SeChangeNotifyPrivilege 4936 msiexec.exe Token: SeRemoteShutdownPrivilege 4936 msiexec.exe Token: SeUndockPrivilege 4936 msiexec.exe Token: SeSyncAgentPrivilege 4936 msiexec.exe Token: SeEnableDelegationPrivilege 4936 msiexec.exe Token: SeManageVolumePrivilege 4936 msiexec.exe Token: SeImpersonatePrivilege 4936 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1716 iexplore.exe 1716 iexplore.exe 1100 7zG.exe 4936 msiexec.exe 4936 msiexec.exe 448 LiquidLauncher.exe 4204 msedgewebview2.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1920 firefox.exe 1920 firefox.exe 1920 firefox.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1332 chrome.exe 1920 firefox.exe 1920 firefox.exe 1920 firefox.exe 2912 firefox.exe 2912 firefox.exe 2912 firefox.exe 2912 firefox.exe 2912 firefox.exe 2912 firefox.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1716 iexplore.exe 1716 iexplore.exe 4280 IEXPLORE.EXE 4280 IEXPLORE.EXE 1920 firefox.exe 1920 firefox.exe 1920 firefox.exe 1920 firefox.exe 4336 wwahost.exe 2912 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4280 1716 iexplore.exe 83 PID 1716 wrote to memory of 4280 1716 iexplore.exe 83 PID 1716 wrote to memory of 4280 1716 iexplore.exe 83 PID 4100 wrote to memory of 3148 4100 msiexec.exe 97 PID 4100 wrote to memory of 3148 4100 msiexec.exe 97 PID 4100 wrote to memory of 3148 4100 msiexec.exe 97 PID 4100 wrote to memory of 3272 4100 msiexec.exe 101 PID 4100 wrote to memory of 3272 4100 msiexec.exe 101 PID 4100 wrote to memory of 1400 4100 msiexec.exe 103 PID 4100 wrote to memory of 1400 4100 msiexec.exe 103 PID 1400 wrote to memory of 3412 1400 powershell.exe 107 PID 1400 wrote to memory of 3412 1400 powershell.exe 107 PID 1400 wrote to memory of 3412 1400 powershell.exe 107 PID 3412 wrote to memory of 2240 3412 MicrosoftEdgeWebview2Setup.exe 108 PID 3412 wrote to memory of 2240 3412 MicrosoftEdgeWebview2Setup.exe 108 PID 3412 wrote to memory of 2240 3412 MicrosoftEdgeWebview2Setup.exe 108 PID 2240 wrote to memory of 3024 2240 MicrosoftEdgeUpdate.exe 109 PID 2240 wrote to memory of 3024 2240 MicrosoftEdgeUpdate.exe 109 PID 2240 wrote to memory of 3024 2240 MicrosoftEdgeUpdate.exe 109 PID 2240 wrote to memory of 1572 2240 MicrosoftEdgeUpdate.exe 110 PID 2240 wrote to memory of 1572 2240 MicrosoftEdgeUpdate.exe 110 PID 2240 wrote to memory of 1572 2240 MicrosoftEdgeUpdate.exe 110 PID 1572 wrote to memory of 2544 1572 MicrosoftEdgeUpdate.exe 111 PID 1572 wrote to memory of 2544 1572 MicrosoftEdgeUpdate.exe 111 PID 1572 wrote to memory of 2172 1572 MicrosoftEdgeUpdate.exe 112 PID 1572 wrote to memory of 2172 1572 MicrosoftEdgeUpdate.exe 112 PID 1572 wrote to memory of 3972 1572 MicrosoftEdgeUpdate.exe 113 PID 1572 wrote to memory of 3972 1572 MicrosoftEdgeUpdate.exe 113 PID 2240 wrote to memory of 1796 2240 MicrosoftEdgeUpdate.exe 114 PID 2240 wrote to memory of 1796 2240 MicrosoftEdgeUpdate.exe 114 PID 2240 wrote to memory of 1796 2240 MicrosoftEdgeUpdate.exe 114 PID 2240 wrote to memory of 3964 2240 MicrosoftEdgeUpdate.exe 115 PID 2240 wrote to memory of 3964 2240 MicrosoftEdgeUpdate.exe 115 PID 2240 wrote to memory of 3964 2240 MicrosoftEdgeUpdate.exe 115 PID 5040 wrote to memory of 4556 5040 MicrosoftEdgeUpdate.exe 117 PID 5040 wrote to memory of 4556 5040 MicrosoftEdgeUpdate.exe 117 PID 5040 wrote to memory of 4556 5040 MicrosoftEdgeUpdate.exe 117 PID 5040 wrote to memory of 3160 5040 MicrosoftEdgeUpdate.exe 120 PID 5040 wrote to memory of 3160 5040 MicrosoftEdgeUpdate.exe 120 PID 3160 wrote to memory of 2752 3160 MicrosoftEdge_X64_114.0.1823.43.exe 121 PID 3160 wrote to memory of 2752 3160 MicrosoftEdge_X64_114.0.1823.43.exe 121 PID 5040 wrote to memory of 1892 5040 MicrosoftEdgeUpdate.exe 122 PID 5040 wrote to memory of 1892 5040 MicrosoftEdgeUpdate.exe 122 PID 5040 wrote to memory of 1892 5040 MicrosoftEdgeUpdate.exe 122 PID 3148 wrote to memory of 448 3148 MsiExec.exe 124 PID 3148 wrote to memory of 448 3148 MsiExec.exe 124 PID 448 wrote to memory of 4204 448 LiquidLauncher.exe 125 PID 448 wrote to memory of 4204 448 LiquidLauncher.exe 125 PID 4204 wrote to memory of 996 4204 msedgewebview2.exe 126 PID 4204 wrote to memory of 996 4204 msedgewebview2.exe 126 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 PID 4204 wrote to memory of 4908 4204 msedgewebview2.exe 127 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedgewebview2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/CCBlueX/LiquidLauncher/releases/download/0.1.6/LiquidLauncher-Windows_0.1.6_x64_en-US.msi.zip1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4280
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4676
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\LiquidLauncher-Windows_0.1.6_x64_en-US.msi\" -spe -an -ai#7zMap25602:146:7zEvent32021⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1100
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\LiquidLauncher-Windows_0.1.6_x64_en-US.msi\LiquidLauncher_0.1.6_x64_en-US.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4936
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1E35550016A1156806557F57260E7A63 C2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files\LiquidLauncher\LiquidLauncher.exe"C:\Program Files\LiquidLauncher\LiquidLauncher.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=MojoIpcz,msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=448.4392.78244854090843239494⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4204 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=114.0.5735.110 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=114.0.1823.43 --initial-client-data=0x164,0x168,0x16c,0x144,0x170,0x7ffabbb34210,0x7ffabbb34220,0x7ffabbb342305⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4908
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2380 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=1980 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3264 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:4496
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4696 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4708 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5888
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4708 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4052 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4128 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=744 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5860
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=748 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4724 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
PID:5144
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4868 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
PID:4572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4908 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:5244
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4144 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:3712
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4728 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:4712
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=5376 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:85⤵
- Executes dropped EXE
PID:4968
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5540 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Executes dropped EXE
PID:5600
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5372 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:1120
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5684 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:5552
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=6172 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:3336
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=6356 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:6056
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5344 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:3232
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=6544 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:4832
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=6568 --field-trial-handle=1864,i,6683700853870958630,18191993165228659519,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:4576
-
-
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\17\jdk-17.0.7+7-jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\17\jdk-17.0.7+7-jre\bin\javaw.exe" -Xmx6871M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M "-DFabricMcEmu= net.minecraft.client.main.Main " -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump "-Dos.name=Windows 10" -Dos.version=10.0 -Djava.library.path=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dminecraft.launcher.brand=LiquidLauncher -Dminecraft.launcher.version=0.1.6 -cp C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\versions\fabric-loader-0.14.19-1.19.4\fabric-loader-0.14.19-1.19.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-tree/9.4/asm-tree-9.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-commons/9.4/asm-commons-9.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/access-widener/2.1.0/access-widener-2.1.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-analysis/9.4/asm-analysis-9.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-util/9.4/asm-util-9.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/tiny-mappings-parser/0.3.0+build.17/tiny-mappings-parser-0.3.0+build.17.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm/9.4/asm-9.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/tiny-remapper/0.8.2/tiny-remapper-0.8.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/intermediary/1.19.4/intermediary-1.19.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/sponge-mixin/0.12.4+mixin.0.8.5/sponge-mixin-0.12.4+mixin.0.8.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/fabric-loader/0.14.19/fabric-loader-0.14.19.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/authlib/3.18.38/authlib-3.18.38.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/code/gson/gson/2.10/gson-2.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/brigadier/1.0.18/brigadier-1.0.18.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/logging/1.1.1/logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-codec/commons-codec/1.15/commons-codec-1.15.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/text2speech/1.16.7/text2speech-1.16.7.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-io/commons-io/2.11.0/commons-io-2.11.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-resolver/4.1.82.Final/netty-resolver-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/datafixerupper/6.0.6/datafixerupper-6.0.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-buffer/4.1.82.Final/netty-buffer-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-codec/4.1.82.Final/netty-codec-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-handler/4.1.82.Final/netty-handler-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/github/oshi/oshi-core/6.2.2/oshi-core-6.2.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-common/4.1.82.Final/netty-common-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-native-unix-common/4.1.82.Final/netty-transport-native-unix-common-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-classes-epoll/4.1.82.Final/netty-transport-classes-epoll-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport/4.1.82.Final/netty-transport-4.1.82.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-lang3/3.12.0/commons-lang3-3.12.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpcore/4.4.15/httpcore-4.4.15.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-api/2.19.0/log4j-api-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna/5.12.1/jna-5.12.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-slf4j2-impl/2.19.0/log4j-slf4j2-impl-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.1/lwjgl-glfw-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.1/lwjgl-glfw-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.1/lwjgl-jemalloc-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.1/lwjgl-jemalloc-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-compress/1.21/commons-compress-1.21.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.1/lwjgl-glfw-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.1/lwjgl-jemalloc-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/joml/joml/1.10.5/joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.1/lwjgl-jemalloc-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.1/lwjgl-glfw-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.1/lwjgl-openal-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.1/lwjgl-opengl-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.1/lwjgl-opengl-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.1/lwjgl-openal-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.1/lwjgl-openal-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna-platform/5.12.1/jna-platform-5.12.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-core/2.19.0/log4j-core-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.1/lwjgl-openal-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.1/lwjgl-opengl-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/guava/31.1-jre/guava-31.1-jre.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.1/lwjgl-opengl-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.1/lwjgl-stb-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.1/lwjgl-tinyfd-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.1/lwjgl-stb-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.1/lwjgl-stb-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.1/lwjgl-tinyfd-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.1/lwjgl-tinyfd-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.1/lwjgl-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.1/lwjgl-tinyfd-3.3.1-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.1/lwjgl-3.3.1-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/slf4j/slf4j-api/2.0.1/slf4j-api-2.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.1/lwjgl-stb-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.1/lwjgl-3.3.1-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.1/lwjgl-3.3.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/ibm/icu/icu4j/71.1/icu4j-71.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\it/unimi/dsi/fastutil/8.5.9/fastutil-8.5.9.jar; net.fabricmc.loader.impl.launch.knot.KnotClient --username s --version fabric-loader-0.14.19-1.19.4 --gameDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen --assetsDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\assets --assetIndex 3 --uuid - --accessToken - --clientId 0add8caf-2cc6-4546-b798-c3d171217dd9 --xuid x --userType legacy --versionType release4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1640
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUBE9D.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3024
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2544
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:2172
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.175.27\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:3972
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDhDNkE4MEItRjYyNi00OTU0LTg1OTctRDE1N0RBRkE0NTNEfSIgdXNlcmlkPSJ7OERENUZDRTMtRTY5RC00QThFLTg3OTktRDdFQkFFRjU1RERGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4MzAwMzhGNS1FM0QwLTQ2OTQtQTlGMC01OUJCNzY5MTU3MUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzMuNDUiIG5leHR2ZXJzaW9uPSIxLjMuMTc1LjI3IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODk5MzU3MDUyIiBpbnN0YWxsX3RpbWVfbXM9Ijk2OSIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1796
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{08C6A80B-F626-4954-8597-D157DAFA453D}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3964
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4364
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDhDNkE4MEItRjYyNi00OTU0LTg1OTctRDE1N0RBRkE0NTNEfSIgdXNlcmlkPSJ7OERENUZDRTMtRTY5RC00QThFLTg3OTktRDdFQkFFRjU1RERGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsyRkI4RkU4RC1GMTY2LTRCN0QtOTMyQi0xOTNEOTY1NkNCNzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIzIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTA4NzMyMDY3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4556
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCC8313C-B650-4949-8A95-8183A9A922DA}\MicrosoftEdge_X64_114.0.1823.43.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCC8313C-B650-4949-8A95-8183A9A922DA}\MicrosoftEdge_X64_114.0.1823.43.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCC8313C-B650-4949-8A95-8183A9A922DA}\EDGEMITMP_00DDC.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCC8313C-B650-4949-8A95-8183A9A922DA}\EDGEMITMP_00DDC.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CCC8313C-B650-4949-8A95-8183A9A922DA}\MicrosoftEdge_X64_114.0.1823.43.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:2752
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDhDNkE4MEItRjYyNi00OTU0LTg1OTctRDE1N0RBRkE0NTNEfSIgdXNlcmlkPSJ7OERENUZDRTMtRTY5RC00QThFLTg3OTktRDdFQkFFRjU1RERGfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntCNERBMTNFQS0yQTlBLTQ3Q0EtQTc4Ni0zOUI0OTE1QjJBQkJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjExNC4wLjE4MjMuNDMiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ5MjAxMzgxMDciIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTIwMjk0NTM3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEwNjIzMjIwMyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYTNhNGRkYTMtMWE2ZS00MWQ0LWFiOTktMGJiZTQzYzNmNjg0P1AxPTE2ODcyNjcxMjAmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RENTSHdseGRBNWp2clJ1QWlwVXlCM3pWZ1hueU5weVZXc1RsNjd0SiUyZmJQc0NFQkF2N1RuQWVSNWFIdnlSV245RFE3OGElMmI3SVhsUnJWRFlnMkNXaHpBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTQ3MjQzOTc2IiB0b3RhbD0iMTQ3MjQzOTc2IiBkb3dubG9hZF90aW1lX21zPSI5OTUyIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTEwNjU0NDY2NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMjU3NjM5NDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MDkiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU0MTIzMjUzNzAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzNjAiIGRvd25sb2FkX3RpbWVfbXM9IjE4NjA5IiBkb3dubG9hZGVkPSIxNDcyNDM5NzYiIHRvdGFsPSIxNDcyNDM5NzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjI4NjU2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffabad79758,0x7ffabad79768,0x7ffabad797782⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:22⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:1752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:12⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3304 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:12⤵PID:636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4648 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:12⤵PID:5296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5180 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5344 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:5988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:6040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5356 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:82⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5264 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:12⤵PID:5812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5560 --field-trial-handle=1840,i,7123884362156369241,11335894510257438223,131072 /prefetch:12⤵PID:6016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
PID:4980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffabad79758,0x7ffabad79768,0x7ffabad797782⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1808,i,5416283955988643682,1267987726054505011,131072 /prefetch:22⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1808,i,5416283955988643682,1267987726054505011,131072 /prefetch:82⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5156
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:4812
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1920 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.0.2695656\1016913986" -parentBuildID 20221007134813 -prefsHandle 1836 -prefMapHandle 1832 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26404ef5-7b47-45df-9a77-9fb5333941a4} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 1936 1b70f2f7558 gpu3⤵PID:2684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.1.168034342\1142830722" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2292 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94edf90b-0eb5-492b-9815-b43172c6bfe7} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 2316 1b702572b58 socket3⤵
- Checks processor information in registry
PID:928
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.2.931575539\1740680610" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3256 -prefsLen 21009 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5ce296e-4402-40b1-93f0-fb8a0b63639a} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 3164 1b7131ece58 tab3⤵PID:5244
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.3.147945269\865509384" -childID 2 -isForBrowser -prefsHandle 3688 -prefMapHandle 3684 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ba8b078-4f3a-435d-98b4-56849dabaef7} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 3696 1b702562558 tab3⤵PID:6072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.4.437356728\1833595898" -childID 3 -isForBrowser -prefsHandle 4580 -prefMapHandle 4576 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f2d9ed7-acbc-4c61-8924-7c9662dbde13} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 4592 1b7150cfb58 tab3⤵PID:5208
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.5.2139848152\1172664052" -childID 4 -isForBrowser -prefsHandle 5176 -prefMapHandle 5272 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bb2c9a0-0cb9-406f-80e4-625dd9e42a24} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 1668 1b716365158 tab3⤵PID:5840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.6.1901722505\2035129993" -childID 5 -isForBrowser -prefsHandle 5384 -prefMapHandle 5388 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aa31a1c-42a6-468b-8e91-04770a645716} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 1668 1b716366358 tab3⤵PID:2428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.7.1175146203\612749102" -childID 6 -isForBrowser -prefsHandle 5056 -prefMapHandle 5288 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c8a55b4-b114-498f-8176-1d8673fdb340} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 5480 1b713719c58 tab3⤵PID:5124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1920.8.1656167202\688985882" -childID 7 -isForBrowser -prefsHandle 5736 -prefMapHandle 3192 -prefsLen 26832 -prefMapSize 232675 -jsInitHandle 1428 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2a64ae7-ae2a-4f29-a6c8-19d234459bff} 1920 "\\.\pipe\gecko-crash-server-pipe.1920" 5288 1b711ef0e58 tab3⤵PID:1752
-
-
-
C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"1⤵
- Executes dropped EXE
PID:4328
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x2f41⤵PID:928
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
PID:5584
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2272 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\MicrosoftEdge_X64_114.0.1823.43.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\MicrosoftEdge_X64_114.0.1823.43.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
PID:3700 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\EDGEMITMP_4075C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\EDGEMITMP_4075C.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\MicrosoftEdge_X64_114.0.1823.43.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- System policy modification
PID:5924 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\EDGEMITMP_4075C.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\EDGEMITMP_4075C.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\114.0.1823.43\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzUuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0Q5QjlBQjYtQTgwNi00RDYwLUExMjItQ0I5OEIzNjQwQjgxfSIgdXNlcmlkPSJ7OERENUZDRTMtRTY5RC00QThFLTg3OTktRDdFQkFFRjU1RERGfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InszMjJBMUE4MS00OTAwLTQxNUEtODY2OS1BODIyN0NEOUZBNkJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzUuMjciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iUHJvZHVjdHNUb1JlZ2lzdGVyPSU3QkYzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNSU3RCIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC4yMCI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxMTIiIHJkPSI1ODk1IiBwaW5nX2ZyZXNobmVzcz0iezg1NTZCOTU4LUUzQjYtNDRFQi1CMkNFLTFGMTA0RjI1NEVERn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMTQuMC4xODIzLjQzIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg0OTMxNTQwMjUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODQ5MzE1NDAyNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTI1OTY3MjEyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NDI2ODY5NDAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY2MTAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1Nzg3NzkwNzIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIxNTk0IiBkb3dubG9hZGVkPSIxNDcyNDM5NzYiIHRvdGFsPSIxNDcyNDM5NzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjM1NzgiLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSIxMTIiIGFkPSItMSIgcmQ9IjU4OTUiIHBpbmdfZnJlc2huZXNzPSJ7MUZCQ0VDQUQtRkU4MC00NkZELTg3NTktNzY5MjgwQjkzRTg3fSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMTQuMC4xODIzLjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2MDA2IiBjb2hvcnQ9InJyZkAwLjgxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzMzExMzYwMTA2NTc5NTUwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9IntBODNBNDhGNS04NTA4LTRFRjktOUM2OC1BMDRGMTU1MENEQjl9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Checks system information in the registry
PID:3868
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:968
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5876
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4336
-
C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"1⤵
- Executes dropped EXE
PID:1920
-
C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"C:\Users\Admin\Downloads\detection-tool-0-0-2-win.exe"1⤵
- Executes dropped EXE
PID:3972
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:9048
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:6784
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2912 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.0.1519421815\951960502" -parentBuildID 20221007134813 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 21327 -prefMapSize 232814 -appDir "C:\Program Files\Mozilla Firefox\browser" - {868344d4-b167-4a30-beb3-2425c2ee46c5} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 1812 13efef0d558 gpu3⤵PID:7724
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.1.1634294876\1513904686" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21327 -prefMapSize 232814 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3fccacc0-12dd-4211-9a65-aa553af4984a} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 2152 13efe846c58 socket3⤵
- Checks processor information in registry
PID:6116
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.2.913846344\789084840" -childID 1 -isForBrowser -prefsHandle 3028 -prefMapHandle 3024 -prefsLen 21723 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81b9f2f-778f-4d11-a7ef-42ffea1a7c3e} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 3036 13e89ecf358 tab3⤵PID:7796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.3.105126555\1998919868" -childID 2 -isForBrowser -prefsHandle 1292 -prefMapHandle 1460 -prefsLen 27148 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a49af683-a0cc-478f-a732-f59305837bfc} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 1204 13e8a2ddb58 tab3⤵PID:7068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.4.1723199245\1207040037" -childID 3 -isForBrowser -prefsHandle 3940 -prefMapHandle 3936 -prefsLen 27148 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {acf5aca1-61ed-4730-9f35-44a04942972d} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 3952 13e8aedf858 tab3⤵PID:7124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.5.694573685\1658512445" -childID 4 -isForBrowser -prefsHandle 4972 -prefMapHandle 4988 -prefsLen 27207 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3caa95c2-9d5f-4c0a-b36a-c1c1d4f9cea7} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 5028 13e8caa6758 tab3⤵PID:3220
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.7.1996731071\1599553818" -childID 6 -isForBrowser -prefsHandle 5368 -prefMapHandle 5380 -prefsLen 27207 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52eafceb-4e43-41d0-bfb4-3bea6370c4b5} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 5360 13e8caa7c58 tab3⤵PID:7308
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.6.1741167188\1650325039" -childID 5 -isForBrowser -prefsHandle 5168 -prefMapHandle 5172 -prefsLen 27207 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {924613ad-7c89-4586-b978-2f2effcb64d6} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 5156 13e8caa6d58 tab3⤵PID:532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.8.1788560151\191894244" -childID 7 -isForBrowser -prefsHandle 5780 -prefMapHandle 5836 -prefsLen 27288 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {40156c38-9b71-4dbf-bb59-91678cbb45fa} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 5772 13e8e9dd758 tab3⤵PID:7276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.9.497767716\1455434857" -childID 8 -isForBrowser -prefsHandle 5636 -prefMapHandle 5632 -prefsLen 27288 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6161e5e5-baae-4cea-887e-f8b3017800ca} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 6004 13e8f30d558 tab3⤵PID:8684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.10.1164568433\1860911316" -childID 9 -isForBrowser -prefsHandle 6256 -prefMapHandle 6260 -prefsLen 27288 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76a62064-140d-45cc-9198-878509a54c94} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 6248 13e8f310258 tab3⤵PID:5300
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.11.1237877547\1980425104" -childID 10 -isForBrowser -prefsHandle 2996 -prefMapHandle 2968 -prefsLen 27288 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cde89800-ee3d-4a48-8aa1-aff52bab801a} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 3332 13e89104458 tab3⤵PID:8728
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2912.12.145027671\616287487" -childID 11 -isForBrowser -prefsHandle 6212 -prefMapHandle 6208 -prefsLen 27288 -prefMapSize 232814 -jsInitHandle 1468 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5517c94b-8bd3-4ff0-9d80-c377d797da98} 2912 "\\.\pipe\gecko-crash-server-pipe.2912" 6200 13e87b88d58 tab3⤵PID:3900
-
-
-
C:\Program Files\LiquidLauncher\LiquidLauncher.exe"C:\Program Files\LiquidLauncher\LiquidLauncher.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2856 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=MojoIpcz,msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2856.816.119033265367259591402⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
PID:2996 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=114.0.5735.110 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=114.0.1823.43 --initial-client-data=0x184,0x188,0x18c,0x160,0x19c,0x7ffabbb34210,0x7ffabbb34220,0x7ffabbb342303⤵
- Executes dropped EXE
PID:2768
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:23⤵
- Executes dropped EXE
PID:4632
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2128 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:33⤵
- Executes dropped EXE
PID:1388
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=2276 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:83⤵
- Executes dropped EXE
PID:5624
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2420 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
PID:9164
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3952 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Executes dropped EXE
PID:1492
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4496 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
PID:6812
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4632 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
PID:6684
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4412 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
PID:5168
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4996 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:1516
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4884 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:5704
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=4980 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:83⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5140 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:5572
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5344 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:3588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5104 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:3532
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=5336 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:13⤵
- Checks computer location settings
PID:5996
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\114.0.1823.43\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=LiquidLauncher.exe --webview-exe-version=0.1.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5720 --field-trial-handle=1856,i,6527314750930490517,9267367696868518288,262144 --disable-features=MojoIpcz,msPdfOOUI,msSmartScreenProtection,msWebOOUI /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:5692
-
-
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\8\jdk8u372-b07-jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\8\jdk8u372-b07-jre\bin\javaw.exe" -Xmx6871M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M -Djava.library.path=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -cp C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\versions\1.8.9-forge1.8.9-11.15.1.1722\1.8.9-forge1.8.9-11.15.1.1722.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/minecraft/launchwrapper/1.12/launchwrapper-1.12.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-all/5.0.3/asm-all-5.0.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/plugins/scala-continuations-library_2.11/1.0.2/scala-continuations-library_2.11-1.0.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\jline/jline/2.13/jline-2.13.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/plugins/scala-continuations-plugin_2.11.1/1.0.2/scala-continuations-plugin_2.11.1-1.0.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-actors-migration_2.11/1.1.0/scala-actors-migration_2.11-1.1.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-parser-combinators_2.11/1.0.1/scala-parser-combinators_2.11-1.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\lzma/lzma/0.0.1/lzma-0.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/minecraftforge/forge/1.8.9-11.15.1.1722/forge-1.8.9-11.15.1.1722-universal.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/jopt-simple/jopt-simple/4.6/jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\java3d/vecmath/1.5.2/vecmath-1.5.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/netty/1.8.8/netty-1.8.8.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-xml_2.11/1.0.2/scala-xml_2.11-1.0.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\oshi-project/oshi-core/1.1/oshi-core-1.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/typesafe/config/1.2.1/config-1.2.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/trove4j/trove4j/3.0.3/trove4j-3.0.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/jopt-simple/jopt-simple/4.6/jopt-simple-4.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/paulscode/codecjorbis/20101023/codecjorbis-20101023.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/paulscode/codecwav/20101023/codecwav-20101023.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/platform/3.4.0/platform-3.4.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna/3.4.0/jna-3.4.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-all/4.0.23.Final/netty-all-4.0.23.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/paulscode/libraryjavasound/20101123/libraryjavasound-20101123.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/paulscode/librarylwjglopenal/20100824/librarylwjglopenal-20100824.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/paulscode/soundsystem/20120107/soundsystem-20120107.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-io/commons-io/2.4/commons-io-2.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-lang3/3.3.2/commons-lang3-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-codec/commons-codec/1.9/commons-codec-1.9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/jutils/jutils/1.0.0/jutils-1.0.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/authlib/1.5.21/authlib-1.5.21.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/jinput/jinput/2.0.5/jinput-2.0.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/code/gson/gson/2.2.4/gson-2.2.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-compress/1.8.1/commons-compress-1.8.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-logging/commons-logging/1.1.3/commons-logging-1.1.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/guava/17.0/guava-17.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpcore/4.3.2/httpcore-4.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-api/2.0-beta9/log4j-api-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpclient/4.3.3/httpclient-4.3.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-core/2.0-beta9/log4j-core-2.0-beta9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/lwjgl_util/2.9.4-nightly-20150209/lwjgl_util-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/lwjgl/2.9.4-nightly-20150209/lwjgl-2.9.4-nightly-20150209.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\tv/twitch/twitch/6.5/twitch-6.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/ibm/icu/icu4j-core-mojang/51.2/icu4j-core-mojang-51.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-library/2.11.1/scala-library-2.11.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/realms/1.7.59/realms-1.7.59.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-reflect/2.11.1/scala-reflect-2.11.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-swing_2.11/1.0.1/scala-swing_2.11-1.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/scala-lang/scala-compiler/2.11.1/scala-compiler-2.11.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/typesafe/akka/akka-actor_2.11/2.3.3/akka-actor_2.11-2.3.3.jar; net.minecraft.launchwrapper.Launch --username s --version 1.8.9-forge1.8.9-11.15.1.1722 --gameDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\legacy --assetsDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\assets --assetIndex 1.8 --uuid - --accessToken - --userProperties {} --userType legacy --tweakClass net.minecraftforge.fml.common.launcher.FMLTweaker2⤵PID:2080
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x320 0x2f41⤵PID:1984
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:6892
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵PID:5700
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5000a99d15f81047e265cf5f63741c33a
SHA1dc317eb1a6fb3e13ecf19d1bb7152b69cbc30a02
SHA2567d1efe3085d5ce35018d5f407855a250136a56b47468a53235f09c9c2ad67d9d
SHA512ac27c2adfdc8e3962a931fd11ce32b95a54b50e33ee0bba12a05bfe853f8f670daca126a91f7a292a3db7f88cdfad11135386da981980c7c5c6cde7d3fc708c4
-
Filesize
3.9MB
MD5f50898b32e6015acc79c2d51e0d71c2d
SHA1f2ba0aded11419cfeb194cf3d4563ff824748b15
SHA256d78c5bc9972b06ce256c5ecf9f63be48baae41d5b65250733b56dc4ddedf7cb1
SHA512dc28bd07283e265e94e67b016b543b02c677ab54faa80c279013f262d398c58c6c54c403b44879ea6dee750287b1b9652c7586b8c421efed0097292f3be6d056
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\114.0.1823.43\MicrosoftEdge_X64_114.0.1823.43.exe
Filesize140.4MB
MD598d0fcbbe8c9e1a5bb9d0a7a8ee8294f
SHA1c53ae3208919e43a4bf3e7bedefeb8a915d177ca
SHA256fb6af04add2dc7627135325efa7eaa2b4d83c78d4fe0eaf0e0a67d45f7e81387
SHA5123d20bf8ee7d3300689f422820ea9dc6c3db89cf633691f8781c229bd8aa034cf9cc3afc4c6dfa40d382c785667116f84b35ae7e22dffc24fb0d9e00b655e4def
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0A983E0D-A8E9-4347-8B29-6D66CB361C47}\EDGEMITMP_4075C.tmp\SETUP.EX_
Filesize1.5MB
MD5597473cdac90dc618d94a88ad9968884
SHA1b9830fb240d1e51368a146f8369ede82f4e3dd9e
SHA25678281cbdc12a95822cdf6f048fa36b8c2fb0c3a188acdd971e204d1532354ba3
SHA5120841f1570b4db2bfcc955adf2c49ba1307e639ff4f8bd0a2349b8f343a9dc43d95d989a0ba908f847ae6a88fb59b846a5f495281d89318c1d21d061e9e97c0e2
-
Filesize
201KB
MD54cb326ff5bdb251b9f92b35e4a4d7741
SHA126442b959c62db6604f6d0bffaab38ca39050b62
SHA25638a44760c4b6fd553531d7f99f6f78110f488e57ee00d2fc498635ec7ab4a478
SHA5129d62f48be43de8e6a60ee40f9e982c1906273b65c96299ae68e1f72e31b8f78dd01199b36f62e61836a2c0d84fc106ae550cf94ffe2cb9b6a082774cb8eedea4
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD5cde0b043689701612c34a2207d6f19bc
SHA18136c9272876c5f47bd2e15ac8f18f46d2a7ffd7
SHA256521ec740311e90716250d61bf1e7c5b4aee3fa7b8a0ac7156457512aa4bd161d
SHA512f1e530d8f727dfd66cf4513303c29ea5f902f39ed5b435a1d21401405d159ddd268b7609d8467de3a1aaf9baef827b82792a2f75b2393250b4f2208a9a402fc9
-
Filesize
201KB
MD54cb326ff5bdb251b9f92b35e4a4d7741
SHA126442b959c62db6604f6d0bffaab38ca39050b62
SHA25638a44760c4b6fd553531d7f99f6f78110f488e57ee00d2fc498635ec7ab4a478
SHA5129d62f48be43de8e6a60ee40f9e982c1906273b65c96299ae68e1f72e31b8f78dd01199b36f62e61836a2c0d84fc106ae550cf94ffe2cb9b6a082774cb8eedea4
-
Filesize
201KB
MD54cb326ff5bdb251b9f92b35e4a4d7741
SHA126442b959c62db6604f6d0bffaab38ca39050b62
SHA25638a44760c4b6fd553531d7f99f6f78110f488e57ee00d2fc498635ec7ab4a478
SHA5129d62f48be43de8e6a60ee40f9e982c1906273b65c96299ae68e1f72e31b8f78dd01199b36f62e61836a2c0d84fc106ae550cf94ffe2cb9b6a082774cb8eedea4
-
Filesize
212KB
MD55b66418885b6e16363a52f3929e1106b
SHA1532245beddb1f2686f105a3ab5cab3bed18f6647
SHA2567d1c6c4c8f7ee030c318a86af954c97b914990a89da1f28ad02df84d569b8a90
SHA512ffba026cf991c6c86d5e22ede5df0139b85bd33255f8b890f39b4a7d9bb55eb42d88a7ca8199fb56ef395faae5fe24fd4d527042e3b18668839bee9d2e2bf4c8
-
Filesize
257KB
MD5ff4ec7cfa567f13b3d39f4421e51a9be
SHA1fb8e32097b408d9c48c866ed52a852904209b315
SHA256cbb0cc650fed59965de18beff97303b5e70d4602a5272029ce7935080e150b43
SHA512b28bc8b5cd500ea14321c32308b600432e0b43146dfcbbfe1d44551eef37d01f1bfe33eb5aeae497776a640efb1e6bc4d6842b61c73441cc4c024c5dcb46ec34
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.1MB
MD5dc025358d0e6146597a8381d38412fc1
SHA14ea48d01ab8a3d0156f56e62aed18e1effa76ac6
SHA25660177c766e9f32fad5158dd7f4e006835db66a418e6f0e6ae29a3b517c811892
SHA512bb7c4b19e7d81d839e5ff3d860e6a6d82e460ce790ff8277ad2887529a3a56822863772b608ca69d9d93c13386d23b883ec432055909c3b144271aee7dd6f187
-
Filesize
2.1MB
MD5dc025358d0e6146597a8381d38412fc1
SHA14ea48d01ab8a3d0156f56e62aed18e1effa76ac6
SHA25660177c766e9f32fad5158dd7f4e006835db66a418e6f0e6ae29a3b517c811892
SHA512bb7c4b19e7d81d839e5ff3d860e6a6d82e460ce790ff8277ad2887529a3a56822863772b608ca69d9d93c13386d23b883ec432055909c3b144271aee7dd6f187
-
Filesize
28KB
MD5a4b8f24d201402785f2ca163a4af2d27
SHA18c046a284bbf445f67098fa76ddb1a150bd4ddc0
SHA256992614574ee31aa50e038a35d5f501045d0febd80278dce0f2874facf2938cca
SHA512a728761d3470585ac4a642295383ee064a3e83c4aa3cf132f1f710d6e0e0edc35d3d8af0d24b208103ff305ef40ca6fd9847c7b9a9284fc4cb52dc0b80180682
-
Filesize
24KB
MD597ded7a9f936f7e6019c7625413debb7
SHA11fc734c9f940fc07170090c16a587dac65623261
SHA256df357cb62f57b95f57a52d665c92da6674b6cfbffb8c6ef33e58ce65742379a1
SHA5122b3175140d9f4bbf78a006ffe7c59bfdb315b1c51f765a1d2c5e71ecd16e3c95cd7b8cc671443a61a51dcd02df6d875235efc2f3b635ab68cf13757875a9a25a
-
Filesize
26KB
MD527668ea5d2ffb894b91ac78a38f010dd
SHA1b3ddc1db958cdf24aea6ba1273651815c6df9cab
SHA2563ca0191953302ac0f9d079b0610172ba1433a7ea2be8c87ebee098b131ec6fff
SHA5121b53983e24b06179fe4a5942cb58423f6e2315cb550b81e574460936b11bee26c35d1c08463047285b0ca4be4cb5f9f7d72b9f9c2448639f65ceaa81fc4edff0
-
Filesize
28KB
MD52f5d2e565d54543051a6ad62fa840947
SHA157c486e7377c0b06048cf43a791a330df68694f3
SHA25612d9210151de9c820eae139495ad438ca9010df27e43077b8e96c8b9f4a30c4a
SHA512d072101b5714a3a0ec5f0df4030b37d8e791364d370f592bb0a739a295c7755578a7bc9de6375ecd45882a6ab45f33e8d2c4c84bac1304f34e37c04e339dc959
-
Filesize
29KB
MD5c245242d173d0caeb11d281eb7db5673
SHA16a1e82b5505f231c5390815af18babe44668aa4f
SHA25625086eea02a58d0c0cee8e41a95861ca139fa5ef6e76a9e5a8b377b05942b2ff
SHA51221c6bcd58a283f6b0fce68aa46277d592cf4e2091d342bc68d0751036fbcf80d5cb1e135f83ef8cb0ee7f67cf3e7c48b95e36d3dcbefe63e8e71e687868fdc7d
-
Filesize
29KB
MD547c1b34fe823f224d21820a0d578b6ff
SHA11b289cec1b473127d3c076897f8c0e986b20b2c1
SHA25617a709938f9b8c3881e01a9d96d90fc5941f30f74b9e4465602593e99703f4d2
SHA512e7d129db5333a1d4604183a79f6053a1f9968d2e04511e580ac0c77446ac8a9a028ce75a87abda2c8e6e5bbed6b29634794087ac3b49acc93e2215e253384ee3
-
Filesize
29KB
MD5a1f77030addb6910d8aa0cf40cbbb9e9
SHA16abfe99973648f2923d7eaeac0b1d62548b81c1e
SHA256031e2895e7f691bf01b248b2b44f07dd3363801b5db547be2f0d8a2750bd49e7
SHA5128d84060e277835fa7f7b16e2c8b44bda0895b4281714f448451ae00b4a25bd45740e251c4f91cbafd07a0492eb1c283f0c9d0f279876e21db3226074a761fa38
-
Filesize
29KB
MD56ffa3f421d240d7fdc81a22c3a038081
SHA18ab2f56177102149c3303f3d4fefd750b7ff9d3c
SHA256b4c3e95222ab7c53e8d620f3e3774db2a7c418abea941fc193fe89aa1fd67f6f
SHA51297bdb6972cb8c209e71e36171011a387571fa26142fd9c8f9668857d93278125d57ab9f7c650baafaa3641191ed5d462ba66d03aa3d42370532f8711b739870b
-
Filesize
28KB
MD5935de4cd1430856f2ff7e159a58cadf2
SHA11e795b830eacb25b3c1fe65ef0049e33aedf5c01
SHA25675b59524b1cb010429df91a08bfe794f77d80504722bd2ba8cdba96ca0ce1820
SHA512ff12c59fd87797803c8936a9d6687e1f015f80d136cb83a9ede6681f892f59f2b28e86c77c499837f8326f43576aacc81b8b677453a0ce6a18a18e134edec52b
-
Filesize
29KB
MD59ebd49f46afd5b3084230d3bf2058850
SHA19b5533e8e385964c6415fd062f6185d4481e30b3
SHA25631f10f7dbd583c5b8c2df0cc10944dec2eaff0e0dfe21a96d198ad2dc446bde7
SHA512b335b7167a126eb7c6a4c145dbbe77075f130c1fa710e87d67731713632178973c3038a941349ab36e699ee22e2eed80170af4a1b1a5f3b358670fb768d29cd6
-
Filesize
30KB
MD54829f9d2f6b1dd8440b616984c409da9
SHA1035bcd9adec5eb744b0f38e34cf9f53a2892d71f
SHA256c8868a0635caf43e21d2d14c2a81039a5fc38d901adacc1b94a2d520537dd0d2
SHA5126b74daaaa90e2d3bbf27015b9747ec61a6e778278d055c4cdc95ae33eb34311a6071becdcd33d17270a7da8d1ee00806c902b12077c2d01cc79660c11aa4b245
-
Filesize
28KB
MD50d47d81663205d6846a9e6eeaa89d4df
SHA112fe024f51438239d0931daaa5bd8c27b1a56f01
SHA256a42322c4ab67989f27689895a24df0438cbc3ffb5b26ae1a832b30efdac6c5a8
SHA51221822e52b64aa32b2a1a86d9301bda8f2e9eed6ad2ff7e3c15e64f9791691fa02570c265135f77a87e5921f9e01ffff5d276635edaba212da27c0da2aea69da9
-
Filesize
28KB
MD53425e71f55cdc6051835beed4199745d
SHA199da19acda63467fc02498f87536986552340203
SHA256b1913cd16df93c185d087e37c01c9540655ccaec2c18ad06d79e474d6337f155
SHA5129367746a709f5624ecc41680b223159899d8c45703cbb90feac156e53394cf9bf56b965f12a87246386039f497b9ca4558622ad1fce8a42c72fb039f4a7c7f6d
-
Filesize
28KB
MD5c3ff030387d71c2035ee1ffd11783547
SHA178696063b1abcf28dad9416c97071e36697b1d60
SHA256af71a2b3acabf64e9513b85285ce0b10dfc2667b1df5a1b37a75b4fa4c9f940e
SHA512d924aa70fef83ae3be9a64b949f38d531b045f9b2f6c11516dd31761128f5ba145a0b74dedcd724298d4a0d469de8afacd41ac53cc6cd87571a569b1e8beae5e
-
Filesize
30KB
MD5f9c7a6c69d713670ac1e0e8f8d8064af
SHA1e560a37eace5b2fa8083ab42e37198c5697455bb
SHA256c5566148acf21deea8cc1bcca82946b00595fbf28ecb061a7a67c317acf85cde
SHA512a099d2738c7c03a194eb0f9bb7fac9732a8b678ea839f483ab7df93c8b36eafa0b5b50f05cf87feaf311ed3416b0c700d3d66d8f42bb4b61e4e7e51f2acd06f3
-
Filesize
30KB
MD5a37e2a4336f19e70670dc82953be6827
SHA1ab762209f11c5d44b741248526cb28f0d9919591
SHA256af0d99b12ad9a0c20e5057453c355c0a76d1cbff361cac11a060b1c0bd78c317
SHA5123bad1f05ed880b16e6972cb780b4b069bc5738b500f368fb46d565ee268b71c0f868bb69b17b1db811479c4ac7f3a07fa65be73c4372fa879029110b26d36b01
-
Filesize
27KB
MD5eadaf5bb7b175d757baf7ca015ac488e
SHA14a45f50d3833df9ee56bfbce60d6bbb3dea8ada7
SHA256ace499d750e6d2b7c8b88a4293d15337b3c4ca9b964df2b616cf7e0dcbf36f5a
SHA51214481a34811cd684a61e2fac6c882079922ec21bdd73989dd97a9ee8d302f235a600305e8f4e5521e40ac6712c2e73fc4eb29be10c0b226c91fcddf7b51cfe98
-
Filesize
27KB
MD5e8d05cc055f3bac201d94cfcfdf5bd0a
SHA17d0cc4e99dbfa0fdb1e562e145e10a0713d13adc
SHA256bd95ee3a9f10e36e027d2f642f39549ca3447f3049c8a95fa9b30aee4a9deacb
SHA512039b111cb02bfe0185403cbdde7dad38c7dc02b8d61fe65f76b21fffac94cc9b8c18310021f4e3c6449bc57faaef7bea8c980dbcd7084979e9b2ff3137a6d143
-
Filesize
29KB
MD51a7af59a8ad7bb644405f77b626e310e
SHA193b43a684ca88ad9f807b9940990a65bcc3b35d4
SHA256e8239f31b8d768f3eac28444b52bbf2bf6bfdfb386f356ab88df587a6348bf5e
SHA5129ff94b4707ca6dd80c89975a2c97db3592eb9cbb7921ae6adb4ddfbaaffe09261cc0516674c68ad428d3b7b13b979f8b01b4c6eecaa1481bb6ba6924fdc274a5
-
Filesize
28KB
MD518b6c5194cd2505fa3193b31c6c5e8a3
SHA11510bca0291ad6e682cf32c4540b3a66cb795e7d
SHA256fb32aebe44092217a6d112243c8ddec79d2d3aa9c283f25f9204f0ef76d647b8
SHA512b840d6cb8e47efe33510f58f51036be978e7a4339a0e5b91df1ec17494f809950e0f0f1b80b590fdaa2e8687f55ae337a0b0cb404ddb4df96a2ac8eae5e64e86
-
Filesize
28KB
MD5742d8f6ee54ccc9912e82b45034a290c
SHA11baec0e1450b4c00e5e4cabde53b560962942084
SHA256a7528be9560876cecb65b5fc561de818bf9255efa439c62b3db852c1a7aeb3df
SHA512f27fd6ea859bfa0aee971e1c8cb52dec58e5c78411642292166f7cbc84fe8ed77006d37699cf03c87394747dfea988b470f72920bc74a9593387d4740e9f1411
-
Filesize
28KB
MD535c5fbcc9f4b44609ad66bab8efd351c
SHA180c5315837deebcaca4bf2a67678b2943d7f7c56
SHA256b79d422d0cab1e5c24f09cec0dbda5954367e8158a2211e0535a0df822dc7f0d
SHA5120ec8e06622efa48d28da1a142db2af5c7075f92c8576a03023be5ab874b53e5022fa2f7d04f5f34ffc7f0a8e633a4f255a1285f6200c75e30a53ee6dbb2852bc
-
Filesize
27KB
MD5d4e4bbe139b9abf65e43a45a12ef0c11
SHA162dc16792f5fad24c9ea54758df1d9756faad0f3
SHA25684da26b420547eb828eaa8bfac57a9ade2a9c5bb827f3aae81db5ff4a1d20e9b
SHA512d9d3d185b2b531a3d981a3b5aa1df87588c335a736b7c720797d87b6876e39fc4c39e6e3f7ebc132960ace3e8b94e67a73f6cae04395494e958a0bce2133d458
-
Filesize
28KB
MD5528e5396b078d0a05962295d48629bbd
SHA122604fac1d9f1938a3104a9bab248b61d023dc26
SHA2564fe489f3ba58f608901117191b516b2f1f7ed5e144a72dc76a2ea4b99dc0f899
SHA512fda90b7255e071dfc0bc403faa72616870c19cf49454240cd5859e03ae0430a732a19451b095c5837589433de3927bcb7d79bd45645f4717c276eb9d217bbefa
-
Filesize
29KB
MD53849c32a7e24439972dc3b6b53fbd270
SHA138258d9aa8d9b7427181f50eeeed7345ed0e8b7b
SHA2568b3c4809ae4676ab7c6c5c5ab2107ed04d464fa9beeb10379915e5c6349540d6
SHA51249c513373390a9c421e996983a9bb73c841899299f4bb4515c7540b1bca2fd83da2cbe6cc787f6ed23e5d533aff03b54a04c44f6d22c6ac9085a94f6c9637378
-
Filesize
30KB
MD57ca8b6931bf364c298e205876f6c4790
SHA1994a675f1f72cacda38b8c5f66eef89e17708c7b
SHA25664f65b536a28267a9a60e14ea35c86726b81db0854b7043f478332d3393781d9
SHA512f55282a3fde07e8949e3fe095eb87c84840b410db3bf4430883685f2c48df3892de01843fa5070839b7e490f3e77a0cd7483666101c36e237f1428338ab9414e
-
Filesize
30KB
MD54b4729724bd113a8db246786513ce46d
SHA1476549b2f3e8abf85c18affd62344452dd50067c
SHA2563e4552ac2a546fd7e7017db43b2e5e753da9d8c3228e3881f6b9231dda85d8ee
SHA5126d4ecb0670b0282e552b793efa0306787a21da3794f9f1d2b72865265e1539693305377d85edb56e469aca44cd5550386386ae08612c8d7b94d39315192337fe
-
Filesize
28KB
MD5e2fdb53c6f65640b502778ee388a559d
SHA1a36ca1c03afe3b37bb494d980bd27dc1c599d0af
SHA25625a19560ade9e611255539ae3205c93bdcbe51e113b8c13ddd8cadfd0faf12de
SHA512a93be51d5b184b3ab4a78715bfa19549cfe8342e85866454d729d715ed0a8fa0b97e7ed72a68585a15c5245d4a468968b2a3325eeb121e7eb8f854866359bb23
-
Filesize
30KB
MD5f9506e84e4ec576bfc75fd10833f1c9e
SHA14c2ad674cabdb1b1cfa7266640ad2cde78005b31
SHA2565f13a77b07a2d377a00c562a597541257cc32c3962fc635665130147ec572c62
SHA512f716cc6216d313570ddd07fa5b068d331da64a8321885c6017749e0e119fa31b096b2106f2d3551f88d8271346a362e6b601e21c6d562f887047d94354f7f2fa
-
Filesize
28KB
MD57083fc568e6de8a8a2e167d050a6fbd5
SHA19875bf4725e81c7814f612534edf26aaba2e1817
SHA25634491d9535e96801e0acaef234f8a6eb7f300a7be7ec9a9c6f894e0189001cfe
SHA51283e028ae13d844b4f5d622bdfac19b059e705f3930a2f4b51536b85b151268bda8299f7e1f49429079d2be05b9d64ae40a89211c2760ed9515e72d31e353f18b
-
Filesize
28KB
MD5420f8e07623e3d066e6cac05c5549764
SHA1244e6ba39a4b2234edccb871c5c996e78948bc5f
SHA256cf547ccf34de9d510564f5cf2ce6975992016bad2543856da9526497c44d432b
SHA5128914817159d52659089de3e3454997eca591b72795d7a63f2edbdf2f72c6409853a7320b7d7e95df171394522ebd8727f23a5670b54427c38359a11c5bcc5b07
-
Filesize
28KB
MD5786fcb2f1d42f797b4fbb48996a2dc65
SHA143b073caed92275f81f3226c180385efd9249bb8
SHA256ffe90d060d1fe1c208be49cf208b0ffcad101964f1e022e2afc873fd15cd4ae9
SHA5128539e4ecffc64ce0d6fa44c4cacfb9457ed3a20b5174be4b1978fff6b7457e45a1b36cdf582c3e39a9181aa32037638d2011c4888ea91dbded59b52da4f03e2a
-
Filesize
29KB
MD5559ce98f3f7c19150d9b2b8eca1d8fdc
SHA11abf4b27d56b6755c5fa2e114f57ecbc35a264be
SHA256de8e29726663c94194bc63379891ef1fd52ae37da09dc5e3415fe3a3513ed669
SHA512c1312a35d496c4993f0a4e33f7d7a012ab6368ec2d00f86f05bbe28d5abf70092ecf96f41b8806bb0e793d8c55a4bf6a4c82c79320ee5685cfceb46ed31188a3
-
Filesize
29KB
MD5d540f4b97c793349c3a388b1bdc94bf8
SHA192cede16e098f3ee00e03241d4e098e83d6dd961
SHA256852964ea502b119e616cfa6e1739b2c308d2311c38f33f5761b4eb6d0dec9547
SHA512ee075614ac47b41232cbb694462a50bad653c0371effcf3d19977da85b696e7f2615cbefff4c949710e11c4e43db8def2a7d03bed5fb81446546e9ba0407323d
-
Filesize
27KB
MD5f2d14a220b1c5dfb0d2976eaadeac123
SHA19c45e3ac8d22d3f3b8bfcf73cc1d2ff92d13e806
SHA25691e8678616b6bc11a1bbb3b3b8906f4b69a707af88e4d97170295beb3e211790
SHA5126d5e9834f7e3e04fada045a848fb20c7afde2d8ae6c7ae2a48bb1c1db6a79e4f0cc6dab9a7fd7dc7880fc5e13210051222dafa53cfd5e5f9dfcc498197836c20
-
Filesize
28KB
MD577bbbdf2a7f69b230bc8cd4bb7f6ea20
SHA17ac98ece6e4c1d8f258e9737f9607276bb1136eb
SHA256a2ae1838e35a87b8ca604766c0166b84c7633845f2b45c936b3b0d1f6168acb9
SHA5120588efd3923f8443b99d2747121b4228edbcf4b6b5167b2d470702ecf7bf903ab01e001847cc706ffaab21086c51a59ced1d3bf7008a3fd15e1c1eeb49b715fc
-
Filesize
30KB
MD5ca2af40e8a967cab969659bd4bddc867
SHA18149bb92561fc3458f2c0fc7021fed50acc97efc
SHA2569138cc8e546198ce161dc1e78f7d28312636532d9117043c0daad580c0b69c9d
SHA512cb555265ec53d255e55c090b63bb7ab8504f2f71f0bccd7ccb42d5b8f24e4701e38b847785eaaeccc342ffa9c5aa9c7a13575b6b2ea9995a9335207f8720e103
-
Filesize
25KB
MD55da8a2bcc699f6d4abb1176d598df062
SHA1277368b217dbd9e3b76cf43e3783a99a5bc8933a
SHA2562a1c13cf54b574659a0459810b4ae97dc1e491c17f0b77c6de73fa47ce9995bd
SHA512b00ad2d15338f356e909dbd417f931bba5c3386382d682c341be91da14e7406d9f0b03063341f191f1ad00c167cac8e9409e2eed4dfdfe41e7aedef7f6a583d3
-
Filesize
24KB
MD56f787917be1b34c49961d8ae3c6e353f
SHA1657640c2c5365d9a2b768d71364a62c22783f012
SHA2568e991a90787569b3473d4c20e8dfda8afb62a346a6046b554b3a1b4fd8c292b8
SHA51219568d8092d617903d77629aa52ab0de1d33e3aeafa74e4c3e777811ec775d0df87074f59cc841abdf5927463e3b1f125dbcda2fd28c4292b5c36aff85c5a56f
-
Filesize
29KB
MD5c3df8d9b2d4cf15238672e327a79a36f
SHA1854a2bfd664c5ede2879b61db2ea9d7282da9481
SHA256e18f1628e80b8339b3e67fae68ad3505fdfed0fdbd52290f349c4c003eded39d
SHA5126a92f5ffcaa8142a2e5e6a143bcea8a41793644422033e391d9dfd9f823874a4812577bfc029c916b824c46ba381edada8ba208c7c128d5157f4830466aa31ae
-
Filesize
28KB
MD542ef71ad4298f3be9e1f0d3259014023
SHA1fedc8b64a2c7922631f33a3d693ccc06d7396409
SHA256835788c93c43e60c1c2ffe6ed65a7e6c2f4d07ede0276d00e8e0a24120cc8801
SHA512dbc855a67da485dd8e6d66a6cad607dd8c3f72103a4d7fe18d0e8fe0360ddf1639f08d8ed274fc26aee3fa462d90617ab16fd7c9f4b5e310275e740ed1c3510e
-
Filesize
27KB
MD5a4e4356dee5a8ab30f2b0e2691fcbaa2
SHA171e41d6d994cc2472a8727b6994b533c58567452
SHA25608cea072fa6424b340ef8e9042409b60b286ef0aeedbcad91b42745e1cf80e68
SHA51214974c1677e0d7e1125a1ddc29d5fa60df7f8d5e0290d81ba51e27431998ecb0e294be34ed8d6afacaf0021b4e59704c7008bd9863707b58a044062544d859ab
-
Filesize
29KB
MD59367c7b9191edee32cc8fb9949b66b13
SHA1bdb04b87de3ebba1f88debb1ddeaaf6505eda984
SHA25644780dfc2c08b6fe1911356e901ebf68f126e846c430c9d915d1f8f81b59c6c8
SHA51232ead64a8735d72a71005034700963a56d9d7acaaecad3838543cfaddf792486813858683ee004050473cce534b99f07a2c35705af15d3269c3424dfbb304571
-
Filesize
23KB
MD55b2cc862f5a3439d481451b3fb6faac5
SHA148eff8ea0f259fdb1d392bfe0347941896470562
SHA256d80dc235ef1558f3560d102d7fe66504b4c87ff5c757926e6b9f8ecf0413f509
SHA5121d16d84019f7d1859f2d7e352ed5080ff559041313fd8043fbd95dc18cfb9a59cacafaf88c66f471327427f97cecc7f22972ef4b9f4dbf57ce1d99c99f9cca0f
-
Filesize
28KB
MD5bdead45c46947785dca933563cdfee60
SHA116720f3d784cc6be03988a6d1b76f72992f93ba7
SHA2564098382bead86758fddc9a6e4cfac86350ebbbc6dcabaacc2eac79e9e78cc0de
SHA5126d600b559b95435ec318a906cd8b81bbd5bbdde9faea65ef73785872204ea1d7afc3447cf80fca21ef6ebf15d0a7eb32503fe455e6f27cbbf2dd03310961655b
-
Filesize
30KB
MD55ecb78b21e15323019eaf2257929d8ab
SHA1bdf4186d977cb5b7dea4cdabfd6211ac7387dc17
SHA2561de639e0e9ed005fbfc84a9818b36d9e98d467f7bb9920ba84f7b2f832723881
SHA512d3beb402a94c6c3770b420ee27bebc969924e6385210dd4ba4ab5e23e4da0f8ca463068612bc13f2e2bace09431aa93f36d05f9f9b27a7e6aad2b26955adb168
-
Filesize
27KB
MD5cc1d0b8cff87a7c9edbd48a78b2f4895
SHA17716d9ea696bf26da10a383383d1504d77c956ba
SHA25699a7f5804d320333149f8cf2ae9bd17e3a09cb4e1dc6f81a1fd6de5974b022b6
SHA512efee51839410f418a5937dbf7d84468651510794394e6bde454d37ea3627b86ec9614a9bb0f585cce0b5fa249251ee06693443497c0dcd87a203231ce6fa2682
-
Filesize
27KB
MD58e36ba5b9ffc5bac31589b6fbe1cdf84
SHA1921df491dac23b9ad62acc73454f09e591beb210
SHA2563f4b509349bf0504e4a124243a3ab552318fe162d38578573689fc04a01eaad4
SHA51263a8e82be2547dc9270dcb61b47b7fdc698de9a414b4a3c02c8c2298c1e11370f0035dbedfdd307c073302239132a8aaf878dd6f855076902064ac926c3d8e59
-
Filesize
28KB
MD5c331849b99482598fed3fde474304862
SHA146a2a227beb91804877b4fd92a732fb8a1a0d4de
SHA256dd8e4f957b46f9b3263658a2b566c7fc382a0f24f224caf6e69bdc2dfc242e74
SHA5127816cc72e1ab31531600ee05574627c68fd34ef7703e04062ab8f6f89f74f8bb6eaac8f25723b757fc56a6e5b090cae3357cbe603924aae72dd6966afdd2d534
-
Filesize
15.6MB
MD5bba6faf2b6c711fa41af4f180ddbce80
SHA13420e411aa7a5cba77c08269c2c1a387ef884e5c
SHA2566b86b1552de52f15ff6951b08f4e7bf0ba13479b55e6fe89ab7147d38c863ef3
SHA512c83b2d87680c069712e741032fde8b1bee81cab03f7f8badb8827e7b3a7fe496879aa611f4bdd5865f9a964c3b67582f42ea41fc84785108a44043b24efd85fb
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
179B
MD5273755bb7d5cc315c91f47cab6d88db9
SHA1c933c95cc07b91294c65016d76b5fa0fa25b323b
SHA2560e22719a850c49b3fba3f23f69c8ff785ce3dee233030ed1ad6e6563c75a9902
SHA5120e375846a5b10cc29b7846b20a5a9193ea55ff802f668336519ff275fb3d179d8d6654fe1d410764992b85a309a3e001cede2f4acdec697957eb71bdeb234bd8
-
Filesize
76B
MD5ba25fcf816a017558d3434583e9746b8
SHA1be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA2560d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA5123763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
-
Filesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7
-
Filesize
116B
MD5ae5b4e5ee859c7b57eaa14906c27daaa
SHA1ec6d0a28f0dbf1207da4bf1538e5dff2ac2c2289
SHA256154efaafa74d953325e3a110becd079b39c2b892f058c2f7d71bee3c5829214a
SHA512b640ca5627d1e5bc94c4ad11ef0054456fca9b3d133391bbaaa9b5a8b9c0ae2c8cb49a771867cf24178b053fd24f1fe80faa2eaa87672e89514cab4c92b2acc3
-
Filesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
Filesize
115KB
MD57d86022cc9999a4685ef43e99456d9b3
SHA1b3b8d37389ea57cfb25a8e6ef0fc0b4091142595
SHA2568a8471d54e348acd153e156265209cb65ce33b2f52e5b008af6dc830cd07d520
SHA512fadcf3bf6378bf68e3926deb1b507efc1accb1dd411ac9680194ae580a9d0af3777fcb22f030257293e957315636327db2bb7d40f9335e028a1021c25aca0cd7
-
Filesize
2KB
MD531815378a6c0b51350d07692fb64ad06
SHA1d3055535a0402033a2141b35e082ce03216420ed
SHA256bb086bbd499e0d42bae17bb9ca78a27ad1e35c3126b836c244a703a181c01999
SHA5120f5355e0e8f180019cbba29738d578e9e92dc0b2393f0b2011d95daa4011bb404fa0b772b8912f370ff8e43cfc3b7fc711076f369926301d4549a30b86a3edbd
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiquidLauncher\LiquidLauncher.lnk~RFe57a5f4.TMP
Filesize1KB
MD574c0baa142030228fe7a99ff978250c6
SHA1548267564ad70b5e5af0d0012a253ca70fcbbd9f
SHA256fb72429e6b78c0c7a3e6fe3389ba9555c3340ce84af12a3dd14afb27ab751b84
SHA5126b51e5b1def762018c8fcf70c0d6cd2e2ea69ad28a0a47e3165f3626419c9a3dd6f6917780349e5ea91139b50feef5c6cdf2c84d404ead0b3fe692cd5ea39f7d
-
Filesize
40B
MD552957d4bf2f5b79a0cf7b42e9eb1a954
SHA1c6ca0bc3ebd37a4a7a99b3ec8b4cc29368c5fac5
SHA256373963e79b7dd7a50576b9bf92f1a5c356e30bad53e25c44d245dfcc2f869d6b
SHA51290f957c13fe611b314c501d6cff5fa6d747ce1bb67d32b73997292c6c846c516e509ca76351f827bfaefe80960d4ba8ee89ac7a2a9330f4741f6dce9b4170036
-
Filesize
72B
MD5b25f9bd1f0bb7f7afcd48c4e8481de4e
SHA16f4f78f005288ad597bb0cc4eebe765b57538b90
SHA2560ddba2347871ebe11b724cc6ea309f31c88cb7d459e9848ab0275d71c6cbda48
SHA5129d6fe2a7a323231e3d44ecae8b47baae9e814571b704cad51e0b6dcbfb65a4a81df9b5df25a0c8e66899f2bc295927a9f6cf910a8d6489f11d630e9fd430512a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
2KB
MD578f5ea00ff9e72016b81a7e3c166d55f
SHA16b877ffea2a57c7488c11d3ed33e5b997d42e988
SHA256f3ea70e5620de5e4b3c7ad232e2a2161f3fa8232fbc192f54439c2295a9565bc
SHA512d499a809f45612f2d7792bf35d7e38bbcdec96e87d580abb8b09a6b02a6cbed8497af618492434074866dee4d91756274d21598ae4e75d8de3db1e9a0cbc8af0
-
Filesize
539B
MD5c9a783f7cc0796ed2d200893d87e61a0
SHA117027b94aa156253223531116a66562d7148abe5
SHA256adb1140c770c1fcb6e7201f9c3314b40008b6de488b3c9fd30d689a758e583df
SHA51206b9b888db4727fb3e3f5ee5aef586385e8446481838cee645e66844a71208c1bafe8bab9b88dde813516afc946983d159f411746e2d1ad5bb6665736a3e2a67
-
Filesize
6KB
MD52125df71839189fda3af546472555f8b
SHA1af664182f6760d21b81506eb96e15efe020e3c49
SHA2560f0b3483f691f1f2a7d2f1aaa323bc76f1d416c7f3a3785f20d325b379b28a79
SHA5123f803439b668f1f45dba97a10f0be311a762165687a2e3061c1194acf68884fa038329531cc9cf02015133c30be14a1808b49c76c5bcec4cdd911846da1a68f2
-
Filesize
6KB
MD53be97f031bf6570a665fea7bf760c420
SHA1cc80f5582476d28a5825af203f96917b30696e8d
SHA25612e4796016353414e6a213998cc6077f042ad938522506a1d5d12616c217bc9c
SHA5125875fc2a453ea1325896d82f8fde93eb6280ca1dbd4b0ddee784b007dddf6ddd91edc3d85855311bcb18a4768ef3e248a1728b78fb54f023ec42837010f89f58
-
Filesize
15KB
MD56392787d1c5fc150c7c9b11a42fa5e89
SHA12d44a8f3b8ea6c103a7963da83b608490d1d12e6
SHA25697c5b2cad6c671af42d9d8685e3fc6b7305eca0eea3526f233d5c66293b8d619
SHA51238c60f279c1cfc73c48907899d0c7fcd763adc0d50a013e42c6c4553d764ac418757c94fa663db9c269a8dd54efa1161ba91ed01326a12482c1857d2ab719735
-
Filesize
71KB
MD5a160bdfe55d9d1442f56bfa053a5e76d
SHA1e73175dab99c7889715b171cc90f0dee192b7882
SHA256176944df12361301c984bc1fe280a74d3c1738a7900a17f32d3dc43021d6251c
SHA5123b97acd299ab7e3b3fba02aa3a738c222c096a3da676232986279ae802d829cc2c0851b5dc6d92f88ae2f4a576484bbf2a09097a25c68acbc4cfefb81b96b73f
-
Filesize
159KB
MD529797a6dabe03d7cd209e9037eb37652
SHA1690726fa0d5e297ec4f47268f3b9e34f9784bfeb
SHA256ae5005c3213fd6d4e4ab3aa47946a4e67c94c9a92f5053df7a3c0a9d4a9a8c60
SHA512b54712bad8a1531211472e4c584d567fcf40640b4f83425df676e290228b89a1708edffe9b60f015fc4ef6928eacac1d21bd3731f501fec82432da968500a4d2
-
Filesize
159KB
MD505bac58a54f9570015cd9b2fec5bfc84
SHA13ae447ce284f315a8a5fe9535cbb7964b5c0f53c
SHA256f02ec2ac2bf46748e6b94e0101e20edb4f911b0a00f4d200437261134a299a38
SHA51289be6778bb716cd446d0442f86d9fe3ec0e63cdfbd1245d5966a9fce0c1de17a4acdb67dad6490b9b5b0963df2e1b097917e0d94977b35b3853679087a5de5df
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\LiquidLauncher-Windows_0.1.6_x64_en-US.msi[1].zip
Filesize6.2MB
MD57fc00c174fdc1d139f39f01c70f721f8
SHA1c3bb7f77ba218c1c3075bc911db2bd7e77ae7aa7
SHA256149f65e1388f4570754d0edfb589e0cbc419609e4e1991ea819cc974f6ee4286
SHA51248506a63607d1844367b943276407145ffce03a120cf55cdf46c91b863daaa01bef3450ccec5ecf8cfc1166a963982d5ae3616242c2ad5fceaba3d435053aacf
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\activity-stream.discovery_stream.json.tmp
Filesize147KB
MD5dc7c06eab648dc69e8f8760e175caae5
SHA1005489b39430fbf6a29e35fdff403e99781cfdc2
SHA2567cea9868930790ad9c772be89c1145c6e38739d80511c26bb56166b2010a7156
SHA512f817ac54d14c20b8c04d6aaee7217551948aae5a0507d78bf54ccdb83dae7cfd558155418f71a3721b4e81034b7ac8559bae110e9b156042076fef79c3b1a285
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\57nap2zl.default-release\safebrowsing-updating\ads-track-digest256-1.vlpset
Filesize54KB
MD54f9ef3d3a71d4cb49e623e3f4b7b1162
SHA1c2d65973b44b051d043475e9387fa7100514acbd
SHA25648ae004f3c542ac764dd5a1e894918ec4b250b5c1f7209256c191cae13106b1f
SHA512f7017204ad37ceedbff4e8b58ab4edac75748d2f36693e59ea9d9157f637d29b53c6405d994ac9fc62712f2574013e95c4817ff49229c78dcc23cac805b13ed7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.~tmp
Filesize104KB
MD5effecce1b6868c8bd7950ef7b772038b
SHA1695d5a07f59b4b72c5eca7be77d5b15ae7ae59b0
SHA256003e619884dbc527e20f0aa8487daf5d7eed91d53ef6366a58c5493aaf1ce046
SHA5122f129689181ffe6fff751a22d4130bb643c5868fa0e1a852c434fe6f7514e3f1e5e4048179679dec742ec505139439d98e6dcc74793c18008db36c800d728be2
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
113KB
MD54fdd16752561cf585fed1506914d73e0
SHA1f00023b9ae3c8ce5b7bb92f25011eaebe6f9d424
SHA256aecd2d2fe766f6d439acc2bbf1346930ecc535012cf5ad7b3273d2875237b7e7
SHA5123695e7eb1e35ec959243a91ab5b4454eb59aeef0f2699aa5de8e03de8fbb89f756a89130526da5c08815408cb700284a17936522ad2cad594c3e6e9d18a3f600
-
Filesize
1.5MB
MD5a743586a8a03b7ee728c772af030c19d
SHA1407f997430a635dda6ee92086b41acbf96144be9
SHA256d358fe2f4a382fee70198a7a2c5afa4fa98dc5b96296ab0e68d8a5854b0117f6
SHA51282d2408214ae7fb5dc037d741a0e8083c968b8d8cb5b1e04b397ad710bf33cb4fad98895ab6914a6d88a1f65dd4ebd7f06d21b08e62af634809a2e57ef81de77
-
Filesize
1.5MB
MD5a743586a8a03b7ee728c772af030c19d
SHA1407f997430a635dda6ee92086b41acbf96144be9
SHA256d358fe2f4a382fee70198a7a2c5afa4fa98dc5b96296ab0e68d8a5854b0117f6
SHA51282d2408214ae7fb5dc037d741a0e8083c968b8d8cb5b1e04b397ad710bf33cb4fad98895ab6914a6d88a1f65dd4ebd7f06d21b08e62af634809a2e57ef81de77
-
Filesize
1.5MB
MD5a743586a8a03b7ee728c772af030c19d
SHA1407f997430a635dda6ee92086b41acbf96144be9
SHA256d358fe2f4a382fee70198a7a2c5afa4fa98dc5b96296ab0e68d8a5854b0117f6
SHA51282d2408214ae7fb5dc037d741a0e8083c968b8d8cb5b1e04b397ad710bf33cb4fad98895ab6914a6d88a1f65dd4ebd7f06d21b08e62af634809a2e57ef81de77
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
88KB
MD52cc86b681f2cd1d9f095584fd3153a61
SHA12a0ac7262fb88908a453bc125c5c3fc72b8d490e
SHA256d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c
SHA51214ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
Filesize
280B
MD5d6156600831746391645297c366c642c
SHA1142406f0372eb8239a9575e22eec624103405438
SHA256f922410c5246d9fb804854f0c44f1bfcc9ee686b7fe127cb3fa8a550c077b66b
SHA512545d073f40bc78cdc6f76649dfcb2e902889cd43d2dcdb0047dabca7066e8d8385b634a99f4b914677bbd99795327e0e5f2a38920c29c09a73d02ad31a280572
-
Filesize
280B
MD51fed824d0df3301918b89a8cf048e071
SHA17838c81389d286f764ab174fe01ad320894f1259
SHA2566529610dcc3b1fe992de16b67f9783da29971f3d3ded389a6b208745a2e020a4
SHA512355fb9463f5ef0c9e5c6da57eedee4532d227c3122a12cf8cb9e52c1b1c2702d0f19a89a0997d4dd550d3599d03ad70260ff90bfbceb1b132bb55390f356fdbd
-
Filesize
280B
MD53764003d2874f21936f4bcd91817b6a1
SHA1749a0630047db206499ebe5e297df9cd564f9f13
SHA2560a55cee4fc59a2527561110c2f5482287fef4e3ef7e8f11db824674a8859c058
SHA512ed6ed8f41058327363c5322e1eccfc41141036e996564731258505d258aa25eb8610ef1294f39ec18bc7c8d2efc11a7d6ab148927693d99d179be2a31159e772
-
Filesize
280B
MD565cb8db20b960718892f24e78b740e05
SHA1e2282b45b0f4f729e25a30a05f445d1cbe97651c
SHA256721cec11137ca0320fd8b70467a6ba07f8f4f2449e776b4f1f37bcdbe8824c67
SHA512afe9059b166a4be75c79cb3d9ee1ebdcfcc25c5d8a3bdbbee6135f249e1a18aa848164e23a1a704516052848259baf8723f7d33c1dbc99ba71d18b224e8edc66
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\074d23b6-61ff-4aa2-afc7-252ee8035879.tmp
Filesize5KB
MD5877f9dbbcf1b5120164f2c1eaafcb331
SHA18e3a91669a0afe35ffc183c98cd2b6ddc1b775ed
SHA256ca21a4551b101a99e6dadb2ec86f9bbb9e6483a89ff22d904d80a6a36d168c0f
SHA512536567bedde5c21569dc521b77b0baa170beb19145b08d91b7ad6e62e7feda610743e7e056b417fcf74af5602d130b6d92c51c7ac23e133b2e35a56736da47b0
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
17KB
MD514f0f7bbd87caedd6889987777247f4f
SHA1fbf29f203e0857447ba3f5a4dd3979a1a0b27ff4
SHA2563059832c33be126dcc0dbf6b0d5bb62d015cb7ceab2db76cde304d5d0a5f269b
SHA5120b26e61cb4a299083f4b42764b9b35269d1ae900b19c7a227b7d05f7082458894d7af253bacfd9108aaafc2c91e91009209ff1bc210c74e2c4e23e88c2c757d1
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\5f7ef2f84d8e14f7_0
Filesize3KB
MD5b2fd4d32d4f840a43a44788b1763d9dc
SHA146914a186ebb4456c2616e0255ddabc714c11640
SHA25667cd9be857df8cb009866345a4f2d0b3b37e6f5b6a7eaf7800242e35c90cb53c
SHA5124c9f2ad2b959ca807e7f4285eef93c6afe20893f1966a57fb0088853877aeae5af065281b16ac2e4e3d3054f739476fd99394b21393f42a3e4dfe025a701dfc5
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\temp-index
Filesize1KB
MD508baf8a9bdc23f16c0400287bf3795ab
SHA1baa552379d456aedfcd8d3467b4c900ddd934149
SHA25653416996719be79804fa496bd6b00fa1540aa45ce7d54b1e89d5f49a2fc11886
SHA512bce08b824a219d4f5eeeab8303544091cbccb48fc7480bfa46eeddbcebacb8944912ecd999221d651a1aa525dd4d3ea38b9a5c9ccc337c202fc9496e25c7eb17
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD56a578daa8c947bbb8d94bc5505c05ea1
SHA1cfcae2d347c82a7caa96413e7364441814ca70fa
SHA256cffb93f63c9de17487c1bc1baa293b242567fc4299883494b5203ea8190ca46d
SHA512c6c8e4357fa5e5cf4640afaaea3aa389d56e9ac77fb8b1c5798a5a089a8d620b17dceaea21639511608630ebfa5738ffe087f89406f20b4b6234e0e3583c1ff8
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5267ae89201bca86ba87b10f0fde27c20
SHA1b360a4a6c54f5a18b024c3c2c6caa1f56aa47e8e
SHA256249f6b1abe236d1e80fe77da771e74d8efeb7fc720e1b7f8d5c886f9b672777c
SHA51205966fb681dd936a5bf1bca8771db738243d94daca22f55263bf081557de631c8784b8c186bb37c0cbc84a3f82c218edf8d7347a60f2b09cba497ab536161c0d
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD5de7ead9ea8496b30c4b2122343ab3f8b
SHA1a4c649ca7f2baedd1c7c59dbc07c1327d2a2f5f7
SHA256297f549d539131f656ecfeb48d2abd4a816dd5ae86b29523ab040cce033da56a
SHA512b50c8f4506a40b01dd8c62dcb3b236ad402102dba7b2fab49e651ee1dd78ebfdcc3788dec138570d8d1bd91132c5d377a8c069460412e543446f0df9db7ad713
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Filesize1KB
MD55ba3c9c3eec7a385c150e4ebf16f8b4d
SHA10361f5d2528ebcbe306e041ebcbbbd397d08b9ca
SHA2560f6694e358e07e197aaf1c16e99a3da871255d957a7853dfc32dd37e6b581568
SHA512ff1b8f7736e84cf3a6510ecd267e0097223fe6c5aedb0f027c03923b7925004138a510669d5f03d31bf8a792db5b035b2813c12713924e11c410e252635bbedb
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Extension Rules\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\5717be55-73e9-43cc-9550-0853e4538a07.tmp
Filesize10KB
MD5f4b33026c0118b114a52db09ebe2ee24
SHA122b6a7fdc0c2cb33dc5294cda28b8771b9a406fa
SHA256a8f47e71ee79dbc437f75c9db7ecd9a07ea808d7679aacf4766a6db110a32b48
SHA512d4816c7b148bd6a5c392f7e67c7a828965927235f41eaf8c18c66887ebe0484d1c320191d91cc1a23f850f4e222ac3e00f70a2420451b5d1f0704a766c2e2d6d
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State
Filesize10KB
MD5776b34567f230d4786b2b63e9eb95fa8
SHA1dbeb71d85ac0e0d3919c8b034d198ca78fd57953
SHA256eca6aa463b9bcc3b665f6962cb0959415610fc183328c12061c92f7bff3b57e3
SHA5124868310f2a36699d73a919a6e58eaebd8b9a4bab3e40ba44ea5b1469567fa2add5d20267e27ec3d92125852efb30054ee8732f5692ecfda09d7d45494f2c1f14
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State
Filesize111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State
Filesize9KB
MD5a785fb6540574732fef16f93fcb695b9
SHA1b195ff4ebf6255d6f2ef08936548aa11067ec24e
SHA25605ffde2ba8ebc00bd11404f43181937abf3cc2e75b72cecbb59fc9824e99dea6
SHA5129955b1a564b4f7f47376c7aa01ba8e5c8aa0dbe0a89c5a826dbed540a81c8115b6480bc40df4bea54892636067f1faf5f659f5e85b35669436c08ef8ff78433b
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State
Filesize9KB
MD5e827a952508ab354f8ae096f8ff55df7
SHA1859bbb5e6411eda3732644f6594edfaae6410f89
SHA256c15178e5d781fcdaf72e50f1000be4df865afaa473cc606fee9e2fd93814b6d7
SHA5123c83812c9125d77b44f99166c6fa8b121c09045ea9aeb0789a022483746b48bbf1243f4037410adffacf9e1866835ccafdafd52bbc52a37786fc88bf557421bf
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State
Filesize8KB
MD58a9c603008f6441b8459db030a0e5c6f
SHA14e8dd09e4233d6de4efd293680969e4d60c52341
SHA256279fcfe7ca75222cfc4cb29cc6b5a5e7452253b3252b8ae6f68e3224d27b76b5
SHA5128a8c60e25b753518d48333960c61d9de20e48998506c8e2497ac289742113ed34e267af0948d718bb519706e49c56ebfd3b87de29df848b2c339069a6f8cb6b1
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\Network Persistent State~RFe5a6217.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
859B
MD5604a04aa45252c399da5e5045286cb40
SHA153b4b67515c80e8adefcb6f8bcca4c663f1ebd99
SHA25683bbcb1682bb88f87bf1bd8a3fae66c57eb852fd80857eceae056aa13934eefa
SHA51284f5de6c1342983fce665349fbd59f693a11b286a767d1f1a0e913b9d15036e6aee70f7d6b64ae9ac320567af9bbc1a83d80f33e2211e695c6e2b4eba18dd73f
-
Filesize
859B
MD55ab5f64df157ca750c2165a71e8f83a9
SHA1b5e0c627aaf5c41ff39081c8abb96604c7fbad4b
SHA256afe02d975375d5d560150cd6b551c0c9c0cada43f463f18afdc4ba6dc810bc4d
SHA51261f22d880279817e246adb52579e9daf45b5e530efbceacbe3f4ecb6cfd0f318eea9b24e5adffa6e0d3c0ac140d67d70079b4395dcfece0a196bdaf26b1bc9c0
-
Filesize
859B
MD5481e5d3a55de30f447ec17b98aee98f4
SHA176a3a4998780cc238bf174b386bf2a0c84d8b27b
SHA25695767957e40a446ebd9f7a73338a3ed32bf2b3f5f2c402bd50b702789cc8acac
SHA5128734437624d17c0e803e39aafab20d76bf5c53393c799b34eb428454b9df5cbd81392e15b618d485dc745338e8503d444d7fac227dd407f57a27f15766c5d523
-
Filesize
859B
MD5f512d9ec27f29159aa85fa7ae8164606
SHA1369c639427f124b99022b669d7a2bb0118de5eef
SHA256ebc364e4ebf18bcc2f013c1a8f52564f815e071837afdc9f914311aa36f7d362
SHA512548d5b700500528d26b27e97a3d495812267b78f2b2dacb1ea417d56a86e48fe3355b3583aed3f169a4ce2c09377ea2e1677dcf925de93ba63eab82e178e0c73
-
Filesize
859B
MD50f81434bf2b0ab488858ed8955a218c3
SHA1a55f4aa8ec34625a2f68458a3156f881484015d3
SHA256a1dfab00ddd482c555e4f9c2235ef44eb0342de3f69f99fbde7e9345672fc192
SHA512ee5b05a4eaab1644b4df9da5f935008da8966a255b6ed6157d71d03cd6cf17b940e4314fa7c92b08d53d62f3775208e4729773dd5bfd721ffad38e9d61b58e92
-
Filesize
859B
MD5d4fbc13664ce542683bf28d967bc5cca
SHA15fa350a41dfb634ec772ffc00f047a1b258f7b5a
SHA256048001b3ec8553441f9e600d96554c1347d1db0ee78d22da26729beb0a361c65
SHA51291a7245b70cc13c92b6bb217c2cf911a4db6c23eb6e55aee91812a7225e3f18f1a5c5e2a74083474b98a10e014b5f08a5cd187daec55e65747069fc12fd0b120
-
Filesize
859B
MD5af2c72114f47d51d19ec938577ecb5aa
SHA1796508c5589408f299dbd161c776f38b24c6e823
SHA256b71ef63043e02cdb437df9f7abe4c325defe1e8ba5869ead23826c6dca84ad60
SHA512a8b295749e31bb3f0ddc913c22b9343025fb7b0f7c83efaedb0b05b977616d41337b3cce425f07a0ece43210955f4f4ba2dbde97da4360f6996263d77a90315a
-
Filesize
859B
MD5b8389b8e941292ed167a94c2e2585139
SHA15f88063be54d61a086a5f13e9f61bb63e761d806
SHA25637ee37f22d3c37e7a6d9440f8862934ed1d11371559145faebe55c8d3269b78a
SHA512c06ea556eaa23d985599ee5f7ba04645b8754dea0ce15e67099e8d00f88fadac0fb35b90f8f7c7477965ae305345f170271e425da5f92d0bc856da81f742ddbf
-
Filesize
356B
MD54060e5b73642677952432db25fcbbc9d
SHA1771300abc314c57b5f11f798be802f813626e4a6
SHA25671d5b5334117d3ac79af4469abf94355c1d15220d1ab75de5986d31a9ba1d7a2
SHA512563c8b6cd196d5cc0cb71a6b8ba8439dc82616c6457f1bdac55af4a8e766a7a588593ae2a0d01d8f9f3091c81b051b988f1d564eff38b2abe67c4a80b60715a6
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\TransportSecurity~RFe5bb0be.TMP
Filesize188B
MD5774c4bbd71ac06720a69f0f7033217f6
SHA1c0bfdf0350ba7f3a39f2b5a49f59573dd6c70fdc
SHA2566dc3dfeff67e49969bebbd18a0a3a265322057831bb5046ff4b50a0158303077
SHA512461a0c56a5287ce3a4a88232b063611bb2d27be0ed233bbba525664f2162d1ac0d70ee394f0f52b8cf60bc12276f743636919a7cf0b769bc2adb5323790a7a2a
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\e263587b-549b-4546-ab9f-d929ab2bb565.tmp
Filesize40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
8KB
MD5275bfd3a89d9875bac9eea5d3f94ac51
SHA1c0690659a70957a002ea56747ae0b90952425653
SHA256dca214a0d4af7b3bc20cd0fa1bc7e1aaed1ec6d3af4a93e2eee683f6f51e21de
SHA51235601cf07f1901950ef26e2e0f08d77c9cfc14322124405aeca5e40587da220bed9edf8382508e00cb1a00e78e2bc84eb28222aec4d691a796758b947a494a7e
-
Filesize
8KB
MD5f41692e2a5b4e4df9319e91724299bdf
SHA14f5624a8014c344df1e1829cf3ab14ecc063c6f6
SHA256a4219068e42ab6c38404412c75f54b00e082cb324d8aa8d6ef21372916569fa1
SHA5123e14e78f4d80874a42aea9ae1457c8a9916e675c6167e6d6e39e092bafeee02af6a7a18fbd98208149b0cab9a86a502f9636e0e5c567eba199bb28c4d1a3c2f9
-
Filesize
8KB
MD5102deda22c95ae1075c96c9e3e49dce5
SHA144cd5ce2dab4937ccba6fd9882b7649ff7921007
SHA256f22d54c137bc9932f382672a4d6622e3507f9b537e65055a0fa6458bdf071a10
SHA51201bab81e48781d646b941409b8d4b3537ac5821c22a76bbc184c46a3aeed42fa6415930943ab794c81fe03eab4d75c86b7df1f8365717008bea3ce643b8fcefa
-
Filesize
6KB
MD5a1cc9a9564083e29c815ca51b166c420
SHA1adfab4559c84e5ff2b233b8e0c6e5490158fbc0b
SHA256579140d98ea68d3414062680799aff88e0ffc103fe2767dcd0bcbf0be13206ed
SHA5121a375c42fea3092e79e8437d68162d1c7de5eefe2d88173db74786519c860ef1ad3b40e3a76cb09384336a290678021284e0d2cf155b6621e0c97d0312218476
-
Filesize
7KB
MD59fa924fb573bbd9221e0a26cead2116d
SHA1cf9f6c57da3f5a047e1ceac73478737c178a3ec8
SHA25686c7e8b349f931c45f79e41a70b9ce44c226f70b92f93355832b50c5d734d93c
SHA5126b2c141cdd931d188945127899258422b1dbf164803665b84682e1d791d80ee294dce62dae96483bc39abfe0f7cb60ab3e89f3e932d5604217257c88a05b2361
-
Filesize
7KB
MD59fc84e4956449d55c82b0accdfb7237d
SHA1f07f697646e56889d63644002d617f1e912f20d3
SHA256fd03804f6fa85363fe6dad6ed9848cf634126bd09960d31de14d00423c84d189
SHA512f926dd06e036b5b21760de8a4cfa8d9dd8cc497f3e5281e729ee850753e6b2fd5eedd467571574d1f70bd4c1e4237a5d4bd5509296050b3fca8e4817548c3b0a
-
Filesize
8KB
MD5dc271f84b5d88bf309af45fcccc9af56
SHA16a3756b0f591fa621c30d8b80f8592bb1422308a
SHA256b4d6003a5492fbdf95b6124d2c3cee5d5603812ac9adc057569fd0b1db49dbf8
SHA512ce9e12c3d424a0696667260537035da376cbe133170fd91222860efde70a0aa8dce3287b3b91d20e07f4dafb16d16d5c40fd7e324fd7cf93b3576ccffab5ef42
-
Filesize
15KB
MD55282346a8b774dc4b66aa170bcd153ae
SHA128badd5a95ced6aa8a0940857f8461bedfb356d5
SHA2560200a13176b07d45ed68aac75482eb0f6abdbae78bd9f784f272836d0d9462d3
SHA512873ed1e04ce938ac0115116cf57f158ec42ec536cac47fa73b50a515c75b87238bd5ce0de31e5e396b31478910c7aff075ffac7947992dbf19603d41d3860042
-
Filesize
1KB
MD5bccb9eaee91d25b9c72a01d76583083e
SHA1d6da87dc93ff1eef04e4f408bdd2b5a7ffe363c6
SHA256b892baca45ee459c97b6de6840141dcd265a289649632d92fe7b2382a243f4c9
SHA512392376faf8c3a091f492b97f0fbfbda411a3c5fc5998c2cbad2006bb4610ff10aacae64e200f56fddd5eb4167ff73273f68d86d0535d5a2eea22ddedc43af499
-
Filesize
15KB
MD5c8fd4d672089b6bc911b82bb4dfade52
SHA131be9e0a2bf3d1037f685f7b12010bf09e114b1a
SHA25699142fc7ca4159a2437520714ca4b5d63e182a42b13a20606360e9d3ba1d7ab1
SHA51205778170c962085c269c6350be7597d1041ae1e74deae9ee9be44d0f9c0f13094e2a5dcbcebbd6cd9677c5de45e817ee9fd9759d08fdc94559dbaa2d9613b753
-
Filesize
17KB
MD58236ea47464d4885b206a659d7a75d11
SHA189ae0c6bd6cdedcbe92bc9b86c104722c68103be
SHA25688d3f08497749f62626ee563a904606fcc2e7112edc11f021a28267fbebd13a9
SHA512a8b76e7b1a9a4c976ef0456e4a69fdbd22cb7e14de369b41aeb59714a7006e088e6638699ad9b5e3e274e6500c1f1572153a2ae58f1f922028784472e48ed195
-
Filesize
17KB
MD512d8bbb150c0c1ac4ad09cfd92fb61de
SHA134f4daadeaff9acbbcfe7bd5eebe75bd009303a9
SHA2566d3551cbca8c500108788133812c8ea43baaacfd19d90ac2faa9ba4956f6d53d
SHA5128bf09c9c5669883dedf3db89cc84c181a8ebfa81d7676746e2b2f874e0e5bfa01ecf7915bd0c6dc4ed141260b57d14d3cf1e2a1564f776267395f29437026553
-
Filesize
15KB
MD5b76789d0bf2b3feb96da7c688c73f7c0
SHA1fab76ba329ca50eea81578763f89d02b697b811d
SHA256a04942181a4a16836009ccd3af14b97027b272c321881333ad5c730fad6fcd95
SHA5120e017384dead10ac475835f88945ddd604304728c91f9b4891ad7390b0a02e3c666e9f194b2326bd7fbaaf13e1fca3a4a57bfcb8d197cbb07a5cb7aa3a43680a
-
Filesize
17KB
MD5ecefe05e7f818435d77eabf9304184bf
SHA18cf3fb806fad5a6e965f7d490e3428367c552efe
SHA256c1114e5f52df46166ba72bf3e9953de4b28a7ba5fe53e95eeaa2fe7f3202d33f
SHA512699ddb3a709684892d8eef1a4522687b61fa90bc7fd11f8e9b7b40d54559e2e97e3ed8ca6ed0077af5e013571910b2f6df3199b5613f46250fcf92d6e3f61bff
-
Filesize
17KB
MD5418c29ec3e34d2bfbca1ed70d5448a92
SHA1fd0fe1f81b6c10c2d342b9aee35fb7109ed5a6a8
SHA256bcc3b8b82b8c9cbd7132f37645b860544178586b5149de4b3fca29311c3f6767
SHA51289930be0e3e4c142f52b640ca1ad6c7228b281c9e5eb38463db706b3ba78472a155675836c4c7200cd718faf860d7278a0d81ab3329b477859be3c8326b04ab1
-
Filesize
17KB
MD56529d757f7d367e9a611fb2834a759bc
SHA15de92f9a44a5a251df01fc8ce2f8f0d2b2b54c48
SHA256e899831178798549ab0beef4a0ef4a7f1b6f7dfb434f10f281a89193c00caf4d
SHA512c6e6c858bc081952daeafb2dd46a7e281ac2b07d5584e718772a619320e962e0fd5d29bcfa6880624ec47fbb35c574e747e18f07f4c19c122fd01d19903551d1
-
Filesize
927B
MD5707f65a002a2c9d7897b53d7ce3901e5
SHA172e3bed0c5a534d256413296be3a17150ead4715
SHA25639983e084de7d937407ef85c26cd59394367f673ca4a032dc6eb02b32da81397
SHA512d800dc4c9329684ba8af7d5d39cb6a152795503f2294cc27e22934eb2049b87d649a64ad9f786ba576d517abb245e7da3c5483999898d13dab24ba3b530fc6c3
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Subresource Filter\Indexed Rules\36\10.34.0.48\Ruleset Data
Filesize2.8MB
MD516176aa639f8d0bf6c1a823f9d973d8c
SHA1f1f365a4705a3fcab04bc4aa8f080ed7ae2f372c
SHA25675da3c6add63a83efb735ae0f1f4e6578607ea33187753b0f65f750a1ab0ab34
SHA512d8711e8a2d417f1f9b81a13d04951420460d1be2dd0459916a3226f364b65cd77fc0feb4be22412df3da0a2433cd924df7d0684fab04a2c6cf3a6e9715ea9f84
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.48\Filtering Rules
Filesize1.8MB
MD5a97ea939d1b6d363d1a41c4ab55b9ecb
SHA13669e6477eddf2521e874269769b69b042620332
SHA25697115a369f33b66a7ffcfb3d67c935c1e7a24fc723bb8380ad01971c447cfa9f
SHA512399cb37e5790effcd4d62b9b09f706c4fb19eb2ab220f1089698f1e1c6f1efdd2f55d9f4c6d58ddbcc64d7a7cf689ab0dbbfae52ce96d5baa53c43775e018279
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.48\LICENSE
Filesize24KB
MD5aad9405766b20014ab3beb08b99536de
SHA1486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
-
C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\hyphen-data\101.0.4906.0\hyph-as.hyb
Filesize703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-biome-api-v1-13.0.6+348a9c64f4-e56c7148f530d97.jar
Filesize80KB
MD5c94e45c4c6016dadd5d086d1467b608f
SHA1b692bbe2ce84981222f6ef987d4c1c327bcb87dc
SHA256f580f9890a8644d65fc250383c2f3a03b7b57542176bf79f9c5756ca2fdf22d5
SHA512939b9f9e1dac0b14a1fd0b2fcffa7ddddfbc769c6c74acd03ff46d27c782b0cad818437a40d910f50c8043414989e6bcd6449b0546cb52b112ea4e77bef8718e
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-command-api-v2-2.2.4+ae0966baf4-fe8e058666fee870.jar
Filesize36KB
MD59a17587efae402f08b16516aee69472d
SHA157e780aa2cb6e367b1c19c69bd23cafff3abaf97
SHA2566ba21aa2d09566aad6492cbf9e018f8754315f13b7169fd17a0d92d184dec0f3
SHA51285b6c2759c77911e1e907bc34276bf80dd4b9cb51e5793f7099fc0e283e1e38f9cac473423dcc90966a4f7d4265f054c23f0203531c8f95a4e77a28f0fd714f5
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-content-registries-v0-3.5+ae0966baf4-87e2f021a82eb7fd.jar
Filesize61KB
MD5a50aef7c20353514b45d300ae708cc05
SHA1b78cd78e6adcce2050ab1dc65df2e40052b843d9
SHA25631a112de6f53af738915573e8a21e54b589d15ee5a62117bb6abcda07033c0ec
SHA51285a6fefe1a254303c7d33106780f8377482dc12f14ccb53a2e4ea7edd75267edb1d2457fc08ecefb729ba7430c23f77eea7c72b722923521d80ab24a682028b7
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-data-generation-api-v1-11+5da15ca1f4-25d17ca5136a82ae.jar
Filesize84KB
MD5d1e0d08c44548a7d15a5c68eb2335e80
SHA19ef399c8f571bf58f61b629585b558fe0d5baa2b
SHA25629b91a3005e7271e6ca8a9d7c7cb334059fce8543b3eec05f265150f65021d31
SHA512f5fa760ed7bde67892524a9c60d1188a6ba14b699a7ec11cc48e16dbf5b708095373d69f1d5eae015e86c888e51cd74f474da5a7f27a5f0ed27af86a87301883
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-game-rule-api-v1-1.0.32+a1ccd7bff4-e4497684a6494597.jar
Filesize53KB
MD5682e5dbf131bb1041ff8883ab295698c
SHA1bcb4f537ef627c5f0d2de72ae8fae02285361218
SHA256830a597746b1bec7789d1766a57544a966a0cebb2de5fd5ff9a91c030123eacd
SHA512439ac920cd35af3110abdbcb52647bb6bbb64a336bcb9d9acb32ad70f173fbe2113a9e307499c985571df35e1ae8c424bbca5c0dba131f4477f320211254cd38
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-item-group-api-v1-3.0.3+043f9acff4-50a4958d35b46575.jar
Filesize59KB
MD5eaea721cedd8f0bec6b28b4667e6f957
SHA1b37c500f8cf2f856ac896a412138c5b7b6214fb3
SHA2567d5d35f4c273e9e7abcddf8a68cb076db3b56039ae4bc415fc039de97f75a841
SHA512090abc6ebb655a003333d919b13485f303c434eddccb474594b0ba0e6cca0a1349adfcf8d0fab0d961bba4a699a50f0c8f2e430313d6f684705c606941664aa7
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-lifecycle-events-v1-2.2.1+5da15ca1f4-82e44bf02244b555.jar
Filesize93KB
MD5cc5502a074e00cb138131bb285b5e67d
SHA1aada6c26ca0e0254b93df5a7c776fd6820ae1a85
SHA2566adc8a8c8b3add0c9dbea5c992c35dc0175c8b0e43cc8e584d5c6e4b98645571
SHA5120d005bbf57c283f33947d46363ce8990401cd740bc05a998c6ed99855ed3665a64fc796433e0100b9f55fb1e41d5adcdaa56efb72b51180d775d484c5d986a8b
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-object-builder-api-v1-7.0+63b515f4f4-e69d70d1eb53075d.jar
Filesize68KB
MD53d3b21c23f4d0413aa2a6675ff6a9459
SHA19e7a756236d5f2180848ec57e1d51944bd863e79
SHA25610e5565f144292506b3edfb9ee7cdbcceb2f921cc31bf350b794bf6ca99059ea
SHA512e683ee6837573294b794b49ef22fbfbde5ecb61eaf895a2a2d98d3d210e77085eefb1e050692f2901c045cc127a23b7acc96fe33291a47088f3248f7686dd981
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-particles-v1-1.0.22+f1e4495bf4-a7c3daf8dc408cf8.jar
Filesize27KB
MD585d9778ac692a3c97220de29c8a2df97
SHA1654bf05e4ea78d3e5921daedcf5356540d5cef72
SHA256ab980bf991f7f9df568014e82c7d0cc4a070a09569109393cca12f76ba2ba756
SHA512d949b62712c58455eb93de3caa6ba47f37158df8b92b203a9bde7e9adca647faaf2ae785672b240fa215ee04b567ced768a15d4d9298579b8328384bfe54b3f9
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-recipe-api-v1-1.0.6+a1ccd7bff4-38705381c6f86ad7.jar
Filesize49KB
MD5ec6a384c492e54e275b53e7c731b29b1
SHA145e053f69f2721fd94dd50dbd97d135e6a26312e
SHA256b2a4c4aefe7d50a5efaac12b64c0e71788fc6d9d435c689b7139148032fd6b9e
SHA512abb44143756fcbf39300035dc865da6f010c09341760b99bb2dd193ae77ab614fd5367eb0126d377f1f6cb05d3afb0470b4d6976b53eb92a42b181537337db34
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-registry-sync-v0-2.1.2+a383ab97f4-4efb52b46f686a41.jar
Filesize101KB
MD5d6b949af6e1767e786000354f4eeba0d
SHA1eea83b00cdb43589050c082b8abb3b17d4c29669
SHA2560f482ed7206f60cfc5dbbe5d4860873711c857ed332738475c229233a995477d
SHA51245ff3136aae5c79b52d574c1202f1d175647d2639e048dd7d431c0050b83a437241383c8362d22207286cfea3559b6e6e9262a3052253885183e333ab4f379b6
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-renderer-indigo-1.1.0+81e8c576f4-6e4cffa91ff591e6.jar
Filesize122KB
MD5c4eb21dc6d71149faadf4aa2c556359f
SHA1e3a8f79ad403b4ae6e18a971a6cf336ae144de55
SHA256f4e16f139d7e6690cfac6861424f890e2cd2cc906dd044c3a0891ceaaacf6022
SHA512eaf769cfc550adaee09bd40a533ab823435f802308f87b5a5ee2a219ee9f0600719eb847d72cc65663b33fe15d2e6346c662f5a27fc3282e8e9455e898fd8134
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-rendering-data-attachment+afca2f3ef4-acba40cab99a5946.jar
Filesize23KB
MD56961c1034010a3e697ad6caba34ce8df
SHA15e2aefeb35ab5432d58dad13507769ee10a86de6
SHA256506baadf6ab3493ab5eed6f435b88d90f8679c3ea723b11e2b9b43827b3f358c
SHA51266bd164497fff94f1baa2b52a2252f86f7702f7338caa3d6f0df8d2460094f93f92df030db418f6cc60bbfbfd198bb4cbdb941a95a7b0ae3b7c5a5d01b724faa
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-resource-loader-v0-0.11.0+938a1d56f4-2d6e880f3b61b8fb.jar
Filesize89KB
MD512c16f186ba778a5c2ad646c20708c37
SHA1089e8f06a803792ce0b00807b1f5562f30e64fbc
SHA2562ccd333200663c42ad21fc67cca5b5357233bc5e37aacd575819ba79ca94da3a
SHA51251f2547726cf7b7daf5718ded83a8ae61d08475c4b0aa7ea2ff2b653697cfe8b6967b4c7dd958b039467f4f9cb08fabd8d775c985e051b85f4b69c69ed46262e
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-screen-handler-api-v1-1.3+5da15ca1f4-e431ab61d3a0a3a0.jar
Filesize30KB
MD54e892be38f3e77102542d6eea921ba73
SHA171fc216bd963dcfb925357b1aa6a3f471b29b768
SHA25661550c0d7e0dce8c99993d8b1d1193bffdd6bc8577d668c9a15afd40a97bb549
SHA512e4433b11102e7c9ed87872494973854fbfc220e5b0d1d23aad2c87a1a95baf7a466153898621cc4672454c09316cf776266381316a3ef31612ba527e5d8ddcc5
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\processedMods\fabric-transitive-access-widener+63b515f4f4-a9b7079f519e2cac.jar
Filesize11KB
MD594f40aefdcce7635aa493d9dd983c07e
SHA13603ea15e39d9bd39c6252457632cc5c435b044d
SHA256aabef62c18bdabfcf2f43bc41bbbb41d7a5a01b30a7fa1d7b47f46ef7d4519d4
SHA51213c07d461321da8d3018731f96419644443538c7496bef482f5ca30a48df5be7125f7ccf593d1d0072f9236764f94860f7ff23ed93e22fe6be08f6159a79b8f3
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\remappedJars\minecraft-1.19.4-0.14.19\client-intermediary.jar.tmp
Filesize22B
MD576cdb2bad9582d23c1f6f4d868218d6c
SHA1b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA2568739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA5125e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen\.fabric\remappedJars\minecraft-1.19.4-0.14.19\client-intermediary.jar.tmp
Filesize24.0MB
MD5a4df2b765ec2bf0d4ba86c2b5045e069
SHA189222fd12ec6ab206a36c032f899bff76ea08998
SHA25667b6bf87cd3055263a31a7c509a83bb7ef710e2d84b64311d39321348dff32eb
SHA51215a5e977b97d10b36f333fa57100f09954e1f0d04f2f2134f7f54fcc39af37dd6c7e7617d2aa14c35764bbb92247b62e1f9b9ed6a8da6fc2f59ac41ffb698781
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\mod_cache\liquidbounce-1.19.4-1.0.0+65baf4b8bfd65f346d1f014d7078b7c53d81bcc2.jar
Filesize26.9MB
MD520d444e2efc7696146307c2a879b76bb
SHA1ce378ee7fb3fc9db4e4254dcd4a8f99e1adee278
SHA25609f3539e718d72d2478ae596b4bbaa13be31e9d4945a33ccc2cd6704a8605fc0
SHA5124f0bdbf7bad7817f107a9f764904be35697cc8506718d421ad2d4007cf09b26d5d96711d41dcc3b0beeec166e7ccca6f7fdf1e84f186338f826382fd54c7ec6a
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\mod_cache\liquidbounce-1.8.9-b79+aaa03f09b84831f1d8907a574ad9e26e0200d47f.jar
Filesize7.2MB
MD58e161289bfd7f23be425ab8a1c46a949
SHA1cae885c0c928bf3437b2ab585a8b8d4adaf3266f
SHA256ed5a88a90b87d53061a4ee10db2bd903ac8b5dd73ebd3cfcee01760535a01046
SHA512e111a701fff9d3fdabb74fd519da9d1aba507491a682fa2d6bb1b8e2fd47eeea2a9ebd58d06619b7858b2f45f8fa14959c128cdb13e5f109d03cf019c6c1705a
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\17\jdk-17.0.7+7-jre\legal\java.logging\ADDITIONAL_LICENSE_INFO
Filesize49B
MD519c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA12db86ab706d9b73feeb51a904be03b63bee92baf
SHA256ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
SHA5127ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\17\jdk-17.0.7+7-jre\legal\java.logging\ASSEMBLY_EXCEPTION
Filesize44B
MD57caf4cdbb99569deb047c20f1aad47c4
SHA124e7497426d27fe3c17774242883ccbed8f54b4d
SHA256b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
SHA512a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\17\jdk-17.0.7+7-jre\legal\java.logging\LICENSE
Filesize33B
MD516989bab922811e28b64ac30449a5d05
SHA151ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA25686e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
SHA51286571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
-
Filesize
5.0MB
MD599623e5f922ed7264bfe9743785018bc
SHA1ce9a2640e71aaf25316f4eed5208f0ec64b00858
SHA256b30e468e1592fecf6ae39f3b16bde21518944eab5951382cf9c9b117cb1179b8
SHA512a83e8e616b045e2792fc69d7285e42da6fc75d3eb19e63a9a54c5b28bf72329572fd4b8908c31b7dac340602054673c96e09da91499b6060a186f0f914255b1d
-
Filesize
6KB
MD5592b5651541c46398cb3a34cbbee07cb
SHA198bccacdc92712096f94c73cb498993de7107488
SHA256d3af3a6329c781ac7003ef6079fa3f860af226025cec151988fbc1800a7be2a5
SHA5121c42d11d9b4f3245d56fc3369b3ec4526c19c45ebc29b19a5e7ce3d6e85ae631e77a77c9a95f76ed1aab4f537345e0e4205df8c94010437733af4380efb4103a
-
Filesize
7KB
MD5252e9d8d33b0d8078fd449c245a84b43
SHA15f29ead2cdc9036ee3613d934e89d1956d474e5b
SHA256db041a09631b9dbd31f0569bf8b29476431031f43c4cc08820d549505314c2ac
SHA51214cd3f0979ab59c01fcc8cf162d4bc3511c4b05aedc836122d76d24d7c6f71cddf7d451cd4fff56a440e24d5fafe91db2b1a2be0b95538d21b158f92db8d688a
-
Filesize
7KB
MD52c24f5d1fe5057609c101f779593f279
SHA153aa3075af455b86dd5d9366feda40d3a6dec3b3
SHA256aead125cda4a77b51a6969cdb1df5e2a7c95bd9142a2dbf6ecbb60f1be7713b0
SHA512dd511b0c70c30e5ed859caa08319f6d94758f79463a5139b5e58a0e5ecbacf6ceaf146eee92437292701e5b1b981a4dee5f5c01f3c8d71de0e2de4e33a459e4f
-
Filesize
7KB
MD555c715052fd9975c8a74a26ea4b0c6b7
SHA1398a0555590a57ce830f2385bd25b0d575cd70d0
SHA25668564917315421e67d28909a5cac393aca1a7fa54358bafbc5e55be7b6de1cb3
SHA5125dc9691890affe343c1ab5be39aee23eeedc4d983a99dae72cc2fa768a94caf6adaba36a804c31655a52c7ffe2d9e29a5391e0b775c97451e343e1349d50da9c
-
Filesize
7KB
MD5b73e3b47ed9b00455a574afc3b114bdb
SHA1b09744ce8e6bb9fef0c26fd6248cf7008b5c532e
SHA2567faa36b89be0e33b7b8f3aa5908b720cbe21ef9c74b60a26805e6b264cc433e5
SHA512f4b492b7e89f61ba38d2f8a472de0ce77c51789ae1b50732efc4d62d1caa5f4d1565c0930eed4f07d2090e6e56771eccdc76c3c77edd0bd964d1e74f135e34ef
-
Filesize
6KB
MD5feb8a52858c8167a58f36caa1b37f116
SHA17ae7f9d2721ae3c579f9e18e4fea679e8c848158
SHA256adbc4c7b5e775c3d401ae811d5be5a69b844f5937e3d0a416d374dd5a7ec227a
SHA512109d42ec5b9744b3561d29a9cabdcf2ffb81233935fa5c2d80c39f27b92ae55366c3c51ae3d26cc1a8936635662acbd11af89e54efac374aceaa279f13e7dc16
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionCheckpoints.json.tmp
Filesize122B
MD599601438ae1349b653fcd00278943f90
SHA18958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA25672d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
SHA512ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionCheckpoints.json.tmp
Filesize259B
MD5700fe59d2eb10b8cd28525fcc46bc0cc
SHA1339badf0e1eba5332bff317d7cf8a41d5860390d
SHA2564f5d849bdf4a5eeeb5da8836589e064e31c8e94129d4e55b1c69a6f98fb9f9ea
SHA5123fa1b3fd4277d5900140e013b1035cb4c72065afcc6b6a8595b43101cfe7d09e75554a877e4a01bb80b0d7a58cdcfe553c4a9ef308c5695c5e77cb0ea99bada4
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD526cf49c857688948ea7dd006338dfc39
SHA1ba7ca8c1fb16b098d56d6d6b46d1b4b059ec1c47
SHA2566fcf6e2e6ca7976ccf131d4cd38be51ee319427cb3177a83e73a2fcd7c96e13a
SHA5127571929d8bb93a061867b2b7b9ef6d09720b12c3a5e30947587ec19a096f9b714fecdd550ab293d29a351c610d8b4169770fcd38cae4a0e450d8fbe3c014990b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize8KB
MD5c6dfaa82de1d52bbaea36f289b4c701f
SHA1f07ac6f79d640a9095e72978fed6b4120bc8c063
SHA256291426e484848b6376e4c9f6eea53e8b49356bcb3cd2bdd1003912d010c4f88c
SHA512c3879b363ccca47b2c360f6d32cd4b5b09508a7a8fd36671a9c1bf0e5507e2eac67762bf4a697b2b951f93735a3c31341445d5ae01c32435f208426896df5a73
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore-backups\recovery.jsonlz4
Filesize2KB
MD5b8b9a18248c0d9a99b9b6e40a769119d
SHA14bdff71acce4dcd0a3fa43d1e81fd0824aaaa439
SHA2564de366446ac40f8b1d8da4a0ccc0e7635e03f22a95c11f6b5c650796069af49c
SHA5129af6ba11e35bfc52c022ef5a3e56680e1ee2020c1fca33dccf93100693fab753eeb2956ff26d6f3fa924d13a5ad7423405b5833a54c155b88d7cb5ebfa970a67
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore.jsonlz4
Filesize6KB
MD5cc99f39a31839884b7958a1b8462544c
SHA1c962f509c693b8653aa5dd9119cc9415f98862ce
SHA256662b2fc1aef1de702dc5cc21ff497ebf85867723194baaa300ffe249213d98c9
SHA5127fa098137ca805331f09305a5a005795c81f029436d88f22d2b9bc6bcde2cf4ddebbb7f5921b38cd2c11359f11f7dba084ef228ece49927ac921fe9db0c0427b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\57nap2zl.default-release\sessionstore.jsonlz4
Filesize3KB
MD58ba0ed4005b0c7a138ce66d731bc618f
SHA140d4f36523d464394ed394a5f6af6569a2c41781
SHA2564ebc598200fe271da355bed9cded558af4f86d92bbf65e9698769847e583859f
SHA5127da0d9ccd799457844d04f42862795404c3b0ef19b5370620875e0de5dbb4f1b8ba723c470941b62121e6885d42b2d7ebcd587f00a151400605a49408f60fb49
-
Filesize
6.2MB
MD57fc00c174fdc1d139f39f01c70f721f8
SHA1c3bb7f77ba218c1c3075bc911db2bd7e77ae7aa7
SHA256149f65e1388f4570754d0edfb589e0cbc419609e4e1991ea819cc974f6ee4286
SHA51248506a63607d1844367b943276407145ffce03a120cf55cdf46c91b863daaa01bef3450ccec5ecf8cfc1166a963982d5ae3616242c2ad5fceaba3d435053aacf
-
C:\Users\Admin\Downloads\LiquidLauncher-Windows_0.1.6_x64_en-US.msi\LiquidLauncher_0.1.6_x64_en-US.msi
Filesize6.2MB
MD5b929a227f9a73f5401580e52266d4724
SHA193e6db30455c98ce3449ac406e2b7ae079264e6b
SHA256c67be4c85a426fff9a9a14cc12a0194b328755355b2b7774416349013dd0fbbb
SHA51250b85dc3210d31e58f7e2822832db90d135a03cc580c8923629b7813ea252cdb92fff41206f74bdafe82fbcb6b3ffe6b684dcfb84a97e397b379efa6e1806ef6
-
Filesize
24KB
MD5ed52c3b3cc5ce2b0836ae3d0d8b219e9
SHA11673ed5d1b455482f097fac3187f2407a493bf1d
SHA2567721e8b5457f24228344a656ee220060be075d8b5f671dc565dfe185354b090f
SHA512d3bf37f98216f9e70fe514f270865f146c36c89017bc59057cc03afb181932ee15c749f0c773c60c72b051c4af0bb9615e8f73fd7fcc97b6a6a83529fcf36a26
-
Filesize
6.2MB
MD5b929a227f9a73f5401580e52266d4724
SHA193e6db30455c98ce3449ac406e2b7ae079264e6b
SHA256c67be4c85a426fff9a9a14cc12a0194b328755355b2b7774416349013dd0fbbb
SHA51250b85dc3210d31e58f7e2822832db90d135a03cc580c8923629b7813ea252cdb92fff41206f74bdafe82fbcb6b3ffe6b684dcfb84a97e397b379efa6e1806ef6