Analysis
- max time kernel
1088s - max time network
1194s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 16:14
General
- Target download
- Size 21KB
- Sample240409-tpl26sfc9s
- SHA256 10ae48e6369d61389dbc6c8abdbaa0dc79cb0169a91ac5536b3443a2902af8cf
Score
9/10
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 13 IoCs
- Modifies Installed Components in the registry 2 TTPs 13 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Sets file execution options in registry 2 TTPs 2 IoCs
- Sets service image path in registry 2 TTPs 14 IoCs
- Checks computer location settings 2 TTPs 50 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 52 IoCs
- Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks for any installed AV software in registry 1 TTPs 46 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 8 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 14 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks system information in the registry 2 TTPs 26 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 28 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 42 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 56 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 15 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Internet Explorer settings 1 TTPs 24 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 64 IoCs
- NTFS ADS 1 IoCs
- Runs ping.exe 1 TTPs 6 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 25 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 18 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 8 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\download2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9c1489758,0x7ff9c1489768,0x7ff9c14897783⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4828 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5380 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3052 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5368 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5732 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5588 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5192 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5612 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5852 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6116 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=6288 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6404 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6416 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6776 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=7000 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6036 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6560 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7224 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7156 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5552 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=6932 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=2732 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=3932 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=1808 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6416 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4628 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6760 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6056 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\liquidlauncher_0.2.5_x64_en-US.msi"3⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5692 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3160 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1656 --field-trial-handle=1876,i,3641076909259561088,6498616151557979944,131072 /prefetch:83⤵
-
-
-
C:\Users\Admin\Downloads\MentalMentor.exe"C:\Users\Admin\Downloads\MentalMentor.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B9IAE.tmp\MentalMentor.tmp"C:\Users\Admin\AppData\Local\Temp\is-B9IAE.tmp\MentalMentor.tmp" /SL5="$20366,2483749,845312,C:\Users\Admin\Downloads\MentalMentor.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\zip_libs.7z" -o"C:\Users\Admin\mentalmentor\" * -r -aoa4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\zip_bin.7z" -o"C:\Users\Admin\mentalmentor\" * -r -aoa4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\zip_lum.7z" -o"C:\Users\Admin\mentalmentor\luminati\" * -r -aoa4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\zip_html.7z" -o"C:\Users\Admin\mentalmentor\settings\temp\inst_gui\" * -r -aoa4⤵
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Mental Mentor" dir=in action=allow program="C:\Users\Admin\mentalmentor\mentalmentor.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall add rule name="Mental Mentor" dir=in action=allow program="C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Users\Admin\mentalmentor\luminati\luminati.exe"C:\Users\Admin\mentalmentor\luminati\luminati.exe" switch_on4⤵
- Checks computer location settings
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exeC:\ProgramData\BrightData\d1bab175a2a8d47f9b561f4c58dc046b93194db0\test_wpf.exe5⤵
-
-
-
C:\Users\Admin\mentalmentor\mentalmentor.exe"C:\Users\Admin\mentalmentor\mentalmentor.exe" install4⤵
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\mentalmentor\mentalmentor_crashpad_handler.exeC:\Users\Admin\mentalmentor\mentalmentor_crashpad_handler.exe --no-rate-limit --database=C:\Users\Admin\mentalmentor\sentry --metrics-dir=C:\Users\Admin\mentalmentor\sentry --url=https://o4505329939513344.ingest.sentry.io:443/api/4506451695239168/minidump/?sentry_client=sentry.native/0.4.6&sentry_key=0cb1bfe551768937b10a49cd2122722e --attachment=C:/Users/Admin/mentalmentor/sentry/log --attachment=C:\Users\Admin\mentalmentor\sentry\f65bc1ec-2c88-4f99-4eb7-f1159852bb78.run\__sentry-event --attachment=C:\Users\Admin\mentalmentor\sentry\f65bc1ec-2c88-4f99-4eb7-f1159852bb78.run\__sentry-breadcrumb1 --attachment=C:\Users\Admin\mentalmentor\sentry\f65bc1ec-2c88-4f99-4eb7-f1159852bb78.run\__sentry-breadcrumb2 --initial-client-data=0x53c,0x540,0x544,0x508,0x548,0x734e7b7c,0x734e7b90,0x734e7ba05⤵
-
-
C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe"C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" --type=utility --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --service-sandbox-type=network --use-gl=angle --application-name=mentalmentor --webengine-schemes=qrc:sLV --mojo-platform-channel-handle=3192 /prefetch:85⤵
-
-
C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe"C:\Users\Admin\mentalmentor\QtWebEngineProcess.exe" --type=renderer --disable-speech-api --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,ConsolidatedMovementXY,DnsOverHttpsUpgrade,FormControlsRefresh,MojoVideoCapture,PictureInPicture,SmsReceiver,UseSkiaRenderer,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=3224 /prefetch:15⤵
- Checks computer location settings
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe" --silent --allusers=04⤵
- Enumerates connected drives
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exeC:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x69c2e1d0,0x69c2e1dc,0x69c2e1e85⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_inst.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_inst.exe" --version5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=7632 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409163048" --session-guid=fd73d8df-a125-46ef-bac8-c96dd4d78113 --server-tracking-blob=OGUyN2E5OWJhNmI4ZTM4YjljNWZlZTM0MjEwYzQyMjY1MjczOWUyOTNjMmNiN2ExMmZlZTY1NmJlN2FiNTJmNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPW1ndCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249bWVudG9yIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyNjgwMjQ0Ljc1MzIiLCJ1c2VyYWdlbnQiOiJtZW50b3JfaW5zdGFsbGVyIiwidXRtIjp7ImNhbXBhaWduIjoibWVudG9yIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWd0In0sInV1aWQiOiJkOGM2NmFhNi0wZWEyLTQwMzUtYjlmMC02Nzk0MzVkZjZkNWUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=40040000000000005⤵
- Enumerates connected drives
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exeC:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\opera_inst.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2d4,0x2d8,0x2dc,0x280,0x2e0,0x690fe1d0,0x690fe1dc,0x690fe1e86⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\assistant_installer.exe" --version5⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091630481\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x490040,0x49004c,0x4900586⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\av360_inst.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\av360_inst.exe" /s4⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\360TS_Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SI2IC.tmp\360TS_Setup.exe" /c:WW.Mediaget.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s5⤵
-
C:\Program Files (x86)\1712680348_0\360TS_Setup.exe"C:\Program Files (x86)\1712680348_0\360TS_Setup.exe" /c:WW.Mediaget.CPI202403 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstall6⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: LoadsDriver
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set {bootmgr} flightsigning on7⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set flightsigning on7⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"7⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\MenuEx64.dll"8⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe"C:\Program Files (x86)\360\Total Security\Utils\PowerSaver.exe" /flightsigning7⤵
-
-
C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe" /installsrv7⤵
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe" /install7⤵
- Drops file in Drivers directory
- Sets service image path in registry
-
-
C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"C:\Program Files (x86)\360\Total Security\modules\KB931125-rootsupd.exe"7⤵
- Modifies Installed Components in the registry
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst8⤵
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst8⤵
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst8⤵
- Modifies system certificate store
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst8⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll"7⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll"8⤵
-
-
-
-
-
-
-
-
C:\Program Files (x86)\360\Total Security\QHSafeMain.exe"C:\Program Files (x86)\360\Total Security\QHSafeMain.exe"2⤵
- Checks computer location settings
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\PromoUtil.exe"C:\Program Files (x86)\360\Total Security\PromoUtil.exe"3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe/lang=en4⤵
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.0.742584874\1234033504" /prefetch:15⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.1.1970821166\1700819476" /prefetch:15⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.2.2050429700\408580795" /prefetch:15⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=utility --channel="8776.3.821847393\909851591" --lang=en-US --no-sandbox --no-sandbox --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable /prefetch:85⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.4.1884935490\1545710793" /prefetch:15⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.5.1825269048\1132040386" /prefetch:15⤵
-
-
C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe"C:\Program Files (x86)\360\Total Security\Utils\cef\cefutil.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Program Files (x86)\360\Total Security\Utils\cef\debug.log" --log-severity=disable --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="8776.6.2011279160\805730646" /prefetch:15⤵
-
-
-
-
C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe"C:\Program Files (x86)\360\Total Security\softmgr\360InstantSetup.exe" /tools_src=page3⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\PromoUtil.exe/tp:10094⤵
-
-
-
C:\Program Files (x86)\360\Total Security\Utils\360DrvMgr\DriverUpdater.exe"C:\Program Files (x86)\360\Total Security\Utils\360DrvMgr\DriverUpdater.exe" /silent_check3⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanvyhldkih3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanvyhldkih3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanvyhldkih3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanyibqvlar3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "explorer.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna64.exe"C:\Program Files (x86)\360\Total Security\360DeskAna64.exe" EnumProcDLL: "iexplore.exe","","0"3⤵
-
-
C:\Program Files (x86)\360\Total Security\TraceClean.exe"C:\Program Files (x86)\360\Total Security\TraceClean.exe" /patchup /mainwnd=1048616 /pid=14128 /silent_idle_scan_showresult /tools_src=cleanup3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanatquuplz3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanatquuplz3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanatquuplz3⤵
-
-
C:\Program Files (x86)\360\Total Security\360DeskAna.exe"C:\Program Files (x86)\360\Total Security\360DeskAna.exe" lspscan 32 \\.\pipe\lspscanatquuplz3⤵
-
-
C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exe"C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus.exe" /tj3⤵
-
C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exe"C:\ProgramData\360TotalSecurity\DesktopPlus\DesktopPlus64.exe" /lowrun /tj4⤵
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe"C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /PromoteApp=(4003) /AppProvider=(360tool.VPNMaster) /ResourceType=(3)3⤵
-
C:\Users\Admin\Downloads\TS Recommended Apps\VPNMasterInst_guard.exe"C:\Users\Admin\Downloads\TS Recommended Apps\VPNMasterInst_guard.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\tempMasterVpn\VPNMasterInst_guard.exe"C:\Users\Admin\AppData\Local\Temp\tempMasterVpn\VPNMasterInst_guard.exe" "C:\Users\Admin\Downloads\TS Recommended Apps\VPNMasterInst_guard.exe" --blue_page --show_center1 --channel=guard5⤵
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 178.128.31.1816⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 162.243.166.1286⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 206.189.196.256⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 128.199.145.1246⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 213.183.53.1746⤵
- Runs ping.exe
-
-
C:\Windows\SysWOW64\ping.exeping.exe -n 1 -w 1000 5.188.181.46⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\tempMasterVpn\VPNMaster_setup.exe"C:\Users\Admin\AppData\Local\Temp\tempMasterVpn\VPNMaster_setup.exe" /S6⤵
-
C:\Windows\SysWOW64\TASKKILL.exe"TASKKILL " /F /IM VPNMaster.exe /T7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\TASKKILL.exe"TASKKILL " /F /IM masterconfig.exe /T7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\TASKKILL.exe"TASKKILL " /F /IM tun2socks.exe /T7⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\TASKKILL.exe"TASKKILL " /F /IM xpntroj.exe /T7⤵
- Kills process with taskkill
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.360totalsecurity.com/blog/en/a-txt-file-can-steal-all-your-secrets/?cid=WW.Mediaget.CPI202403&sch=02⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x2bc,0x2e4,0x2e8,0x2e0,0x354,0x7ff9ac4a4e48,0x7ff9ac4a4e54,0x7ff9ac4a4e603⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2160,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1996,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2548,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3536,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3540,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4688,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:23⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5212,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4168,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5472,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5408,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4540,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5920,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5544,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5900,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5856,i,5353635705622229753,10484540649780776755,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:13⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ff9ac4a4e48,0x7ff9ac4a4e54,0x7ff9ac4a4e604⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3004,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1932,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4428,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4868,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4876,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5348,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5380,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5768,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=6044,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6068,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5920,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6328,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6600,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5968,i,11434916901005014225,5603381697730609572,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x254,0x258,0x25c,0x250,0x270,0x7ff9ac4a4e48,0x7ff9ac4a4e54,0x7ff9ac4a4e605⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2316,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1912,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2320,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4328,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4460,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4504,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4504,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4480,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4424,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4432,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4876,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5232,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5240,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5500,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=1076 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5488,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3716,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5464,i,6874903940253200183,8773086020592917619,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:85⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.360totalsecurity.com/blog/en/a-txt-file-can-steal-all-your-secrets/?cid=WW.Mediaget.CPI202403&sch=02⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4381⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BB3F97BC3FF698A916740032AE14D75F C2⤵
- Loads dropped DLL
-
C:\Program Files\liquidlauncher\liquidlauncher.exe"C:\Program Files\liquidlauncher\liquidlauncher.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5188.5172.164605979462454266264⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=123.0.2420.81 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff9ac4a4e48,0x7ff9ac4a4e54,0x7ff9ac4a4e605⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=1880,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:35⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=2100,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3012,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3908,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4396,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5052,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5224,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5352,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5444,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5908,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6200,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6152,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5472,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5980,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6448,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6716,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6776,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5496,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6480,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5092,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6780,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5148,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6952,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6280,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6996,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6332,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5932,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6884,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6760,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:85⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=4648,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=5204,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6504,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=5988,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=5924,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6744,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=5268,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6816,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6860,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=6888,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:15⤵
- Checks computer location settings
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=308,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\123.0.2420.81\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --field-trial-handle=6392,i,8117060427424521945,502929770198176126,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:85⤵
-
-
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_17\jdk-17.0.10+7-jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_17\jdk-17.0.10+7-jre\bin\javaw.exe" -Xmx6871M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M "-DFabricMcEmu= net.minecraft.client.main.Main " -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dminecraft.launcher.brand=LiquidLauncher -Dminecraft.launcher.version=0.2.5 -cp C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\versions\fabric-loader-0.15.3-1.20.4\fabric-loader-0.15.3-1.20.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-tree/9.6/asm-tree-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-analysis/9.6/asm-analysis-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm/9.6/asm-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-commons/9.6/asm-commons-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-util/9.6/asm-util-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/intermediary/1.20.4/intermediary-1.20.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/sponge-mixin/0.12.5+mixin.0.8.5/sponge-mixin-0.12.5+mixin.0.8.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/fabric-loader/0.15.3/fabric-loader-0.15.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/code/gson/gson/2.10.1/gson-2.10.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/brigadier/1.2.9/brigadier-1.2.9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/authlib/6.0.52/authlib-6.0.52.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-codec/commons-codec/1.16.0/commons-codec-1.16.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/text2speech/1.17.9/text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/logging/1.1.1/logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/github/oshi/oshi-core/6.4.5/oshi-core-6.4.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-io/commons-io/2.13.0/commons-io-2.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-resolver/4.1.97.Final/netty-resolver-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-native-unix-common/4.1.97.Final/netty-transport-native-unix-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-handler/4.1.97.Final/netty-handler-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-classes-epoll/4.1.97.Final/netty-transport-classes-epoll-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-common/4.1.97.Final/netty-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-codec/4.1.97.Final/netty-codec-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport/4.1.97.Final/netty-transport-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-compress/1.22/commons-compress-1.22.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna-platform/5.13.0/jna-platform-5.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/datafixerupper/6.0.8/datafixerupper-6.0.8.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-api/2.19.0/log4j-api-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-slf4j2-impl/2.19.0/log4j-slf4j2-impl-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-lang3/3.13.0/commons-lang3-3.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-buffer/4.1.97.Final/netty-buffer-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/joml/joml/1.10.5/joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna/5.13.0/jna-5.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/guava/32.1.2-jre/guava-32.1.2-jre.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-core/2.19.0/log4j-core-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\it/unimi/dsi/fastutil/8.5.12/fastutil-8.5.12.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/ibm/icu/icu4j/73.2/icu4j-73.2.jar; net.fabricmc.loader.impl.launch.knot.KnotClient --username MateSquad --version fabric-loader-0.15.3-1.20.4 --gameDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen --assetsDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\assets --assetIndex 12 --uuid 5c94f0ce-ceda-4ca2-a955-7645833725b3 --accessToken - --clientId 0add8caf-2cc6-4546-b798-c3d171217dd9 --xuid 45a5c683-5c1e-44d9-a5e1-332b418b64ac --userType legacy --versionType release4⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_17\jdk-17.0.10+7-jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_17\jdk-17.0.10+7-jre\bin\javaw.exe" -Xmx2233M -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M "-DFabricMcEmu= net.minecraft.client.main.Main " -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\natives -Dminecraft.launcher.brand=LiquidLauncher -Dminecraft.launcher.version=0.2.5 -cp C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\versions\fabric-loader-0.15.3-1.20.4\fabric-loader-0.15.3-1.20.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-analysis/9.6/asm-analysis-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-tree/9.6/asm-tree-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-util/9.6/asm-util-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/sponge-mixin/0.12.5+mixin.0.8.5/sponge-mixin-0.12.5+mixin.0.8.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/fabric-loader/0.15.3/fabric-loader-0.15.3.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/github/oshi/oshi-core/6.4.5/oshi-core-6.4.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/code/gson/gson/2.10.1/gson-2.10.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm/9.6/asm-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/ow2/asm/asm-commons/9.6/asm-commons-9.6.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/google/guava/guava/32.1.2-jre/guava-32.1.2-jre.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/ibm/icu/icu4j/73.2/icu4j-73.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/authlib/6.0.52/authlib-6.0.52.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/fabricmc/intermediary/1.20.4/intermediary-1.20.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/brigadier/1.2.9/brigadier-1.2.9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/datafixerupper/6.0.8/datafixerupper-6.0.8.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/text2speech/1.17.9/text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-codec/commons-codec/1.16.0/commons-codec-1.16.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-buffer/4.1.97.Final/netty-buffer-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-common/4.1.97.Final/netty-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\com/mojang/logging/1.1.1/logging-1.1.1.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-resolver/4.1.97.Final/netty-resolver-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-classes-epoll/4.1.97.Final/netty-transport-classes-epoll-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\commons-io/commons-io/2.13.0/commons-io-2.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\it/unimi/dsi/fastutil/8.5.12/fastutil-8.5.12.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-codec/4.1.97.Final/netty-codec-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-handler/4.1.97.Final/netty-handler-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport-native-unix-common/4.1.97.Final/netty-transport-native-unix-common-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\io/netty/netty-transport/4.1.97.Final/netty-transport-4.1.97.Final.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna-platform/5.13.0/jna-platform-5.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/java/dev/jna/jna/5.13.0/jna-5.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-compress/1.22/commons-compress-1.22.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/commons/commons-lang3/3.13.0/commons-lang3-3.13.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-api/2.19.0/log4j-api-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-core/2.19.0/log4j-core-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/apache/logging/log4j/log4j-slf4j2-impl/2.19.0/log4j-slf4j2-impl-2.19.0.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/joml/joml/1.10.5/joml-1.10.5.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-glfw/3.3.2/lwjgl-glfw-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-jemalloc/3.3.2/lwjgl-jemalloc-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-openal/3.3.2/lwjgl-openal-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-opengl/3.3.2/lwjgl-opengl-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-stb/3.3.2/lwjgl-stb-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl-tinyfd/3.3.2/lwjgl-tinyfd-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/lwjgl/lwjgl/3.3.2/lwjgl-3.3.2-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\libraries\org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar; net.fabricmc.loader.impl.launch.knot.KnotClient --username MateSquad --version fabric-loader-0.15.3-1.20.4 --gameDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\gameDir\nextgen --assetsDir C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\assets --assetIndex 12 --uuid 5c94f0ce-ceda-4ca2-a955-7645833725b3 --accessToken - --clientId 0add8caf-2cc6-4546-b798-c3d171217dd9 --xuid 69053bd3-e92a-4794-b0e1-d635b98f203a --userType legacy --versionType release4⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -Wait2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Temp\EUE4B4.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUE4B4.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEMwRkQxOEEtQjg1Qi00NTI4LUFBNEItNjc4REFFMkFFMjQ2fSIgdXNlcmlkPSJ7QTY1NUU0MjItOUFFNS00Mjg1LTgxRUItNUU4ODJGMDYwQjUwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InswRDcxNUI2Qy02NjFDLTREMzYtQjUyNC0wMUY2QTg5OTVBMUR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODUuMTciIG5leHR2ZXJzaW9uPSIxLjMuMTg1LjI5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTQ2ODA2MDI5IiBpbnN0YWxsX3RpbWVfbXM9IjQzNyIvPjwvYXBwPjwvcmVxdWVzdD45⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{4C0FD18A-B85B-4528-AA4B-678DAE2AE246}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEMwRkQxOEEtQjg1Qi00NTI4LUFBNEItNjc4REFFMkFFMjQ2fSIgdXNlcmlkPSJ7QTY1NUU0MjItOUFFNS00Mjg1LTgxRUItNUU4ODJGMDYwQjUwfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RTI1RjdCREItQkVGOC00Q0FDLTkxQTYtQTlERjVGNkRBMEYzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDsrMGpVbVllS3RaQUY1QzNnMjJwQkI1RjBSeWR0ZjFTSDdibndzbm9VK2ZrPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMDYuMC41MjQ5LjExOSIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNDMiIGluc3RhbGxkYXRldGltZT0iMTcwODk2NDEyOSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzUzNDY1NDQ1MDAwMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxMTQwNjgiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NTMwNTU5MDYiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\MicrosoftEdge_X64_123.0.2420.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\EDGEMITMP_3FFB5.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\EDGEMITMP_3FFB5.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\EDGEMITMP_3FFB5.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\EDGEMITMP_3FFB5.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1ED241AD-6371-4D1D-B629-E402B905EFC2}\EDGEMITMP_3FFB5.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x110,0x104,0x108,0x264,0x130,0x7ff62832baf8,0x7ff62832bb04,0x7ff62832bb104⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NEMwRkQxOEEtQjg1Qi00NTI4LUFBNEItNjc4REFFMkFFMjQ2fSIgdXNlcmlkPSJ7QTY1NUU0MjItOUFFNS00Mjg1LTgxRUItNUU4ODJGMDYwQjUwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQUE4NTVEOS0yN0E4LTRFNzAtQUI1Qy1DOENFOEIzREFENkF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMy4wLjI0MjAuODEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY5NjY0OTM3NDgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI2OTY2NjUwMDE5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQxOTk4NDYzNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2EwYTBiZDYtYjljOS00YzU2LTk2NDktZTllOWMyMmZiZTQzP1AxPTE3MTMyODQ0NjEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9QTVVVGpCOWdUY1BKY281dFBwREZoRm45OVVBYVBmb1c1SE8ydUI2TkYyU1JkYlhSJTJiUmlNUlhXbWxrUHlMQlNWdjc0VWlNaHI2bnQ2aTRxSEY5VyUyZldBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBkb3dubG9hZF90aW1lX21zPSIzODYzMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0MjAxNDA3ODciIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDM0MDM4MDg2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODkxMjg3OTY1IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzA0IiBkb3dubG9hZF90aW1lX21zPSI0NTM0OSIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NTcyNSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95EDD7F3-3A56-4483-82A3-62578CFCB483}\BGAUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{95EDD7F3-3A56-4483-82A3-62578CFCB483}\BGAUpdate.exe" --edgeupdate-client --system-level2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzExNzQ4NUEtMzcyMC00NzhGLUI3NjEtMzUyNzQzMDBGQTM2fSIgdXNlcmlkPSJ7QTY1NUU0MjItOUFFNS00Mjg1LTgxRUItNUU4ODJGMDYwQjUwfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsyOEEwNzM3QS0xOUE4LTQyRjctOEVCMC1CN0Q2MjJGRDdGNEV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90OyswalVtWWVLdFpBRjVDM2cyMnBCQjVGMFJ5ZHRmMVNIN2Jud3Nub1UrZms9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MH0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjIuMC4wLjMzIiBsYW5nPSIiIGJyYW5kPSJFVUZJIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTk1NDA2MTI1MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk5NTQzNzM5MTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTk5OTg0MjQ0NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2RhMDE3ZGVhLTM0ZjgtNGE5Zi1hM2ZkLTI3ZjFiOTUzODYwMD9QMT0xNzEzMjg0NzYwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUlTM3J4ZnU0QzZwdmJTRUJ1JTJmU1RpZnpvMVNVU3dOSkhNVm9jcUM5REpTWGhyaXFGZzFmcTNaMkpRRTBhMEdRMndNYW9NN3EwWEQ5d0M1cGJWeFFIaUElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMTUiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5OTk5ODQyNDQ0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9kYTAxN2RlYS0zNGY4LTRhOWYtYTNmZC0yN2YxYjk1Mzg2MDA_UDE9MTcxMzI4NDc2MCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1JUzNyeGZ1NEM2cHZiU0VCdSUyZlNUaWZ6bzFTVVN3TkpITVZvY3FDOURKU1hocmlxRmcxZnEzWjJKUUUwYTBHUTJ3TWFvTTdxMFhEOXdDNXBiVnhRSGlBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTgwNDcwMDgiIHRvdGFsPSIxODA0NzAwOCIgZG93bmxvYWRfdGltZV9tcz0iNDIzNCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijk5OTk4NDI0NDQiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDAwNTc3OTg4OCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMDA4OTY4MzU5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDUzIiBkb3dubG9hZF90aW1lX21zPSI0NTE1IiBkb3dubG9hZGVkPSIxODA0NzAwOCIgdG90YWw9IjE4MDQ3MDA4IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIzMTkiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\MicrosoftEdge_X64_123.0.2420.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7c1f7baf8,0x7ff7c1f7bb04,0x7ff7c1f7bb104⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0AC0509D-B7B6-4185-A26D-2E18BFACE0C0}\EDGEMITMP_24D51.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7c1f7baf8,0x7ff7c1f7bb04,0x7ff7c1f7bb105⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff79e91baf8,0x7ff79e91bb04,0x7ff79e91bb105⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY5QTJFOUYtOTMzQS00Mjg3LTkyQUUtMkRBOUE2MEMwMUFEfSIgdXNlcmlkPSJ7QTY1NUU0MjItOUFFNS00Mjg1LTgxRUItNUU4ODJGMDYwQjUwfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswNDc2OThERC1DQzgxLTRCNEItOUNCMi04NDYwQzgyNEY2QTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90OyswalVtWWVLdFpBRjVDM2cyMnBCQjVGMFJ5ZHRmMVNIN2Jud3Nub1UrZms9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODUuMjkiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2O1Byb2R1Y3RzVG9SZWdpc3Rlcj0lN0IxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDAlN0QiIGluc3RhbGxhZ2U9IjQyIiBjb2hvcnQ9InJyZkAwLjI5Ij48dXBkYXRlY2hlY2svPjxwaW5nIHI9IjQzIiByZD0iNjI2NSIgcGluZ19mcmVzaG5lc3M9Ins4MkE3REQxQS02N0NFLTRENzctOEJCMS00RTY4RkJGREYxRjJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTIzLjAuMjQyMC44MSIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSI0MiIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzUzNDQwMTc2NTQ3NjkxMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAxMzQ4NjcwMTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAxMzUwMjI2NTUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAxNjQ4MDk5ODgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAxNzkyNTQ2NTIiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwNjQ4MDg1MDk4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTEwMSIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSI0Njg4MyIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9IjQzIiBhZD0iLTEiIHJkPSI2MjY1IiBwaW5nX2ZyZXNobmVzcz0iezg0MzhGNDY1LTA2ODEtNDlCRS05ODg3LTk3MUIzNzA2QjQ1OH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTIzLjAuMjQyMC44MSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjMwNyIgY29ob3J0PSJycmZAMC43MyIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzU3MTUzMzYwNjQyNzQ5MCI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9Ii0xIiByPSItMSIgYWQ9Ii0xIiByZD0iLTEiIHBpbmdfZnJlc2huZXNzPSJ7RjA4QUI3QTQtQUVGQS00QjA5LTk4M0UtM0E0QzUwQUQxRTA4fSIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Checks system information in the registry
-
-
C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"C:\Program Files (x86)\360\Total Security\safemon\WscReg.exe"1⤵
-
C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe"C:\Program Files (x86)\360\Total Security\SoftMgr\EaInstHelper64.exe" /Install_run2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Drops file in Windows directory
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe/showtrayicon2⤵
- Sets service image path in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /install3⤵
-
-
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /cleantip=13⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe"C:\Program Files (x86)\360\Total Security\safemon\PopWndLog.exe" /ExShowTrayIcon4⤵
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe" /ExShowTrayIcon3⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files (x86)\360\Total Security\safemon\safemon.dll"3⤵
-
-
C:\Program Files (x86)\360\Total Security\deepscan\DSMain.exe"C:\Program Files (x86)\360\Total Security\deepscan\DSMain.exe" -ScanTrust3⤵
- Writes to the Master Boot Record (MBR)
-
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe"C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe" /watch2⤵
-
-
C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe"2⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\bdfltlib.dll"2⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\360\Total Security\safemon\scan.dll"2⤵
-
-
C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe"C:\Program Files (x86)\360\Total Security\360TsLiveUpd.exe" /delay:302⤵
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\gpupdate.exeC:\Windows\system32\gpupdate.exe /force2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\123.0.2420.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
5Browser Extensions
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
5Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
9Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5ad302.rbs
360ssTS.dat
config.ini
7_48.png
acrobat_48.png
adguard-f5598671.png
kmplayer_48.png
t013ba71743dbe55a54.png
t0163e5619e44cf48ef.jpg
t016586c9b278a3f881.png
t016d81994da4104f3a.png
t018e9bad3ef94288d4.png
t01ddc97398de0a67e4.jpg
t01e37764cd3690cab9.jpg
t01eb17dcb4de33f24a.jpg
t01fcc087310810811b.png
vlc_48.png
netconf.dat
speedmem2.hg
i18n.ini
pop.log
instantsetup.dat
ignorelist.ini
somextrainfo.ini
somextrainfo.ini
softdetect_241600921.dat
setup.exe
BGAUpdate.exe
MicrosoftEdge_X64_123.0.2420.81.exe
SETUP.EX_
EdgeUpdate.dat
MicrosoftEdgeComRegisterShellARM64.exe
MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdateComRegisterShell64.exe
MicrosoftEdgeUpdateCore.exe
NOTICE.TXT
msedgeupdate.dll
msedgeupdateres_af.dll
msedgeupdateres_am.dll
msedgeupdateres_ar.dll
msedgeupdateres_as.dll
msedgeupdateres_az.dll
msedgeupdateres_bg.dll
msedgeupdateres_bn.dll
msedgeupdateres_en.dll
settings.dat
manifest.json
manifest.json
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
liquidlauncher.exe
f_000001
f_000002
f_000003
C42C00DAAEC150CCB583162E4DF031D9.png
ToolVoteInfo.ini
New360_formal_148212443667_7472_1.log2
New360_tmp_1712680450_7472.log2.mg2
brd_sdk32_clr.dll
lum_sdk_install_id
lum_sdk_session_id:LUM
MicrosoftEdgeUpdate.log
liquidlauncher.lnk
liquidlauncher.lnk~RFe5ad66c.TMP
f_000017
f_000019
f_00001c
f_000021
f_000023
f_000024
f_000029
307104ac33b5da49_0
3ee6f0030e5128e5_0
873c5551c3a3611f_0
the-real-index
000001.dbtmp
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt
index.txt~RFe59ebae.TMP
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache~RFe5a4864.TMP
persisted_first_party_sets.json
settings.dat
settings.dat
settings.dat
3c0aa581-fb55-471e-9a28-4a8c6dfeec42.tmp
f_000019
f_000021
f_000022
the-real-index
the-real-index
ExtensionActivityComp
content.js
6a25ae1b-9b89-4c29-892a-17acabf65974.tmp
Network Persistent State
Network Persistent State
TransportSecurity
aa7c91be-9a61-456e-8915-66371144457b.tmp
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Local State
Local State
Local State
Local State
Local State
Local State
Local State
downloadCache_
uriCache
Variations
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
setup.ini
Assistant_108.0.5067.20_Setup.exe_sfx.exe
opera_package
360base.dll
360ECB4.tmp
360ECB5.tmp
360ECB6.tmp
360ECB7.tmp
360ECC7.tmp
360ECC8.tmp
360ECD9.tmp
360ECDA.tmp
360ECDB.tmp
360ECDC.tmp
360ECED.tmp
360ECEE.tmp
360ECEF.tmp
360ECFF.tmp
360ED00.tmp
360ED11.tmp
360ED12.tmp
360ED23.tmp
360ED24.tmp
360ED34.tmp
360ED35.tmp
360ED36.tmp
360ED47.tmp
360ED48.tmp
360ED49.tmp
360ED69.tmp
360ED6A.tmp
360ED7B.tmp
360ED7C.tmp
360ED7D.tmp
360ED8D.tmp
360ED8E.tmp
360ED8F.tmp
360EDA0.tmp
360EDA1.tmp
360EDB2.tmp
360EDB3.tmp
360EDC3.tmp
360EDC4.tmp
360EDC5.tmp
360EDC6.tmp
360EDD7.tmp
360EDD8.tmp
360EDD9.tmp
360Base64.dll
360Central.exe
360Common.dll
360Conf.dll
360DeskAna.exe
360DeskAna64.exe
360NetBase.dll
360NetBase64.dll
360NetUL.dll
360P2SP.dll
360ShellPro.exe
360SkinView.exe
360TSCommon.dll
360TSCommon64.dll
360TsLiveUpd.exe
360Util.dll
360Util64.dll
360Verify.dll
360bps.dat
360net.dll
360rcbase.dat
360ss2map.ini
3GIdentify.dll
LibOui.dat
AntiAdwa.dll
AntiCe.dll
BrowseringProtection.exe
CombineExt.dll
CrashReport.dll
CrashReport64.dll
DailyNews.exe
DumpUper.ini
Dumpuper.exe
EfiMon.sys
EfiProc.dll
FastAnimation.dll
FeedBack.exe
FeedBack.ini
HomeRouterMgr.exe
I18N.dll
I18N64.dll
LargeFileFinder.exe
LeakFixHelper.dll
LeakFixHelper64.dll
LeakFixHelper64.exe
LiveUpd360.dll
LiveUpdate360.exe
MedalWall.exe
MenuEx.dll
MenuEx64.dll
MiniUI.dll
PDown.dll
PatchUp.exe
PromoUtil.exe
QHAccount.exe
QHFileSmasher.exe
QHSafeMain.exe
QHSafeScanner.exe
QHVer.dll
Repair.exe
Safelive.dll
Sites64.dll
ToolBox.dll
TraceClean.exe
Uninstall.exe
360AdvToolExecutor.exe
360AntiTrack.exe
360LibDrvmgr.dat
DownloadMgr.dll
DriverUpdater.exe
DrvInst64.exe
DrvmgrCore.dll
ScriptExecute.exe
360WifiProtect.dll
AntiTrack.dll
AntiTrack64.dll
CondrvFix.exe
360desktoplite_config.xml
DesktopPlus.exe
DesktopPlus64.exe
360ScreenCapture.exe
360searchlite.exe
search_file_type.json
bell.wav
DuplicateFile.exe
DuplicateFileCfg.xml
ModuleUpdate.exe
PopTip.exe
PowerSaver.exe
SimpleIME.exe
SiteUIProxy.dll
SysCleaner.dll
SysCleanerUI.exe
cef.pak
cef_100_percent.pak
cef_200_percent.pak
icudtl.dat
libcef.dll
en-US.pak
natives_blob.bin
snapshot_blob.bin
cefutil.exe
ver.ini
lang.lang
act.dat
backupsrv.dat
cacert.dat
cacert.pem
MiniUI.xml
defaultskin.ui
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
SysSweeper.ui.dat
360AV_theme.ui
360AntiTrack_theme.ui
360Central_theme.ui
360EvtMgr_theme.ui
360InternationSafe_theme.ui
360InternationTray_theme.ui
360UDisk_theme.ui
360hipsPopWnd_theme.ui
360leakfix_theme.ui
360liveupdate_theme.ui
360sandbox_theme.ui
360searchlite_theme.ui
360searchlite_theme.xml
360skinview_theme.ui
360wdui_theme.ui
pwlog_theme.ui
account_theme.ui
BrowserPro_theme.ui
DailyNews_theme.ui
DataShield_theme.ui
DesktopPlus_theme.ui
DeviceMgr_theme.ui
driverupdater_theme.ui
DuplicateFile_theme.ui
HomeRouterMgr_theme.ui
InstantSetup_theme.ui
MedalWall_theme.ui
pw_theme.ui
PromoUtil_theme.ui
SysCleaner_theme.ui
TraceClean_theme.ui
account_theme.xml
admgr_theme.xml
datashield_theme.xml
default_theme.ui
desktopplus_theme.xml
devicemgr_theme.xml
driverupdater_theme.xml
FeedBack_theme.ui
popwndtracker_theme.xml
promoutil_theme.xml
theme.xml
theme_DuplicateFile.xml
Tools_config.dat
Tools_theme.ui
smurf.ui
smurf.xml
AdvTools.xml
360AntiTrack.xml
360Central.xml
360NetRepair.xml
360Netmon.xml
360SafeWallet.xml
360Win10App.xml
360Zip.xml
AdBlocker.xml
BrowserProtection.xml
BusinessVersion.xml
CleanUp.xml
DailyNews.xml
DataShield.xml
DesktopAssistance.xml
DiskAnalyzer.xml
DriverUpdater.xml
DuplicateCleaner.xml
FileProtector.xml
FileSmasher.xml
FirstPrioritySupport.xml
FirstPriorityUpdate.xml
GameBooster.xml
InstantSetup.xml
MobileSecurity.xml
NoAds.xml
PatchUp.xml
PremiumTheme.xml
QuickSearch.xml
RansomwareDecryptor.xml
Sandbox.xml
ScheduledClean.xml
SpecialOffer.xml
SuperKiller.xml
SysCleaner.xml
SystemCompact.xml
SystemRegClean.xml
TraceClean.xml
send.xml
360FsFlt.sys
360FsFlt_old.sys
360Quarant.dll
360QuarantPlugin.dll
360netcfg.exe
360KP.dll
360KPBase.dll
360ave_ex.def
360ave_ex2.def
360ave_fp.def
AVEI.dll
AVEngine.dll
UpFltr.def
BAPI.dll
BAPIDRV.sys
BAPIDRV64.sys
BAPIDRV64_old.sys
BAPIDRV_old.sys
BlackMirror.dat
CQhCltHttpW.dll
CheckSM.dll
CheckSM.exe
Cloudsec3.dll
DSFScan.dll
DsArk.dll
DsArk.sys
DsArk_win10.sys
DsSysRepair.dll
ImAVEng.dll
MiniRame.dat
PopSoftEng.dll
360AQVM.dll
360QVM.dll
Qshieldz.dat
bifdb.dat
cloudcom2.dll
csp.dat
deepscan.dll
dsark64.sys
dsark64_old.sys
dsark64_win10.cat
dsark_win10.cat
dsbs.dat
dserror.dat
dsmain.exe
dsns.dat
dswc.dat
dsws.dat
dswtb.dat
heavygate.dll
jcloudscan.dll
lcrd.dat
lsv.dat
MacroDef.enc
PHPEX.dll
patt.enc
qex.dll
qex.vdb.enc
xyar.dat
qutmdrv.sys
qutmdrv_win10.sys
qutmload.dll
ramengine.dll
rmt.exe
sbx.dll
sc.con
sndw.dat
stx.dll
sysfilerepS.dll
uiitem.dat
dynlbase.dll
dynlenv.dll
h_1.dat
h_2.dat
h_3.dat
lm_1001.dat
360AvFlt.dll
360AvFlt.sys
360AvFlt_old.sys
360avflt64.sys
360avflt64_old.sys
360rp.dll
AVCheck.dll
AVLib.dat
DataDriv.dat
FsrMgr.dll
WhiteCache.dll
fr1.dat
fr4.dat
fr5.dat
fr6.dat
fr7.dat
fr8.dat
fr9.dat
ptype.dat
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
360webshield.exe.locale
udisk.locale
wdk.ini
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
360ipc.dat
360netd.dat
360netr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libdefa.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
360netd.dat
libaw.dat
libvi.dat
360SafeCamera.tpi.locale
pic_01.jpg
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
udisk.locale
wd.ini
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
cloudsec3.dll.locale
dsconz.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
nptswp.dll.locale
Antiadwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libsdi.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
filemgr.dll.locale
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
safemon.dll.locale
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
dsurls.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdi18n.sign
wdk.ini
nptswp.dll.locale
AntiAdwa.dll.locale
Dumpuper.exe.locale
LibSDI.dat
UrlSettings.dll.locale
DsRes.dll
DsRes64.dll
art.dat
cloudsec3.dll.locale
dsconz.dat
dsr.dat
ssr.dat
NetDefender.dll.locale
Sxin.dll.locale
Sxin64.dll.locale
appd.dll.locale
appmon.dat
filemgr.dll.locale
filemon.dat
regmon.dat
yhregd.dll.locale
libaw.dat
libvi.dat
360SPTool.exe.locale
360SafeCamera.tpi.locale
360procmon.dll.locale
pic_01.jpg
Safemon.dll.locale
Safemon64.dll.locale
SelfProtectAPI2.dll.locale
UDiskScanEngine.dll.locale
bp.dat
360webshield.exe.locale
drvmon.dat
spsafe.dll.locale
spsafe64.dll.locale
udisk.locale
wd.ini
wdk.ini
nptswp.dll.locale
i18ngi.dll
360AntiHacker.dll
360AntiHacker.sys
360AntiHacker64.sys
360AntiHacker64_win10.sys
360AntiHacker_win10.sys
360Box.dll
360Box.sys
360Box64.sys
360Box64_old.sys
360Box64_win10.sys
360Box_old.sys
360Camera.sys
360Camera64.sys
360Camera64_win10.sys
360Camera_win10.sys
360boxld.exe
360boxld64.exe
360boxmain.exe
360hvm.dat
360hvm.dll
360hvm64.sys
360hvm64_old.sys
DrvUtility.dll
FileMgr.dll
NetDefender.dll
SXIn.dll
SXIn64.dll
SxWrapper.dll
TS.dat
X64For32Lib.dll
appd.dll
appdef.dat
appdext.dll
cleancfg.dat
clsid.dat
ipcService.dll
kmconfig.dat
qutmipc.dll
qutmipc.sys
qutmipc_win10.sys
qutmvd.dll
sbmon.dll
signbwl.dat
yhregd.dll
leakrepair.dll
libleak-64.dat
libleak.dat
libleakres.dat
libredlist.dat
360EvtMgr.exe
360PatchMgr.exe
360PatchMgr64.exe
KB931125-rootsupd.exe
Strings.dat
360GameIdentify.dll
360gmoptm.dat
360netctrl.dll
Netgm.dll
NetworkMon.exe
NetworkMonUI.dll
gameidentify.dat
360netmon_50.sys
360netmon_60.sys
360netmon_wfp.sys
360netmon_x64_wfp.sys
360netmon_x64.sys
netmstart.dll
sysoptm.dll
rpi.dat
360.dat
360AV.tpi
360Connect.tpi
360GuardBase.dll
360PrivacyGuard.exe
360SPTool.exe
360SafeCamera.tpi
360SelfProtection.sys
360SelfProtection_win10.sys
360Tray.exe
360UDisk.tpi
360bsmon.tpi
360calaInt.dat
360calaInt.dll
360compro.dll
360disproc.sys
360disproc64.sys
360disproc64_win10.sys
360disproc_win10.sys
360drwht.dat
360hipsPopWnd.dll
360procmon.dll
360realpro.exe
360safemonpro.tpi
360scovec.dll
360scovec64.dll
360uac.dat
360zipc.dll
7z.dll
AdPopBlocker.tpi
AntiTrack.dat
BootLeakFixer.tpi
CleanPrivacy.xml
DiagScanTips.tpi
DsTpi.tpi
EdgeVerLib.dat
FilePrivacy.tpi
PopWndLog.exe
PopWndTracker.exe
QHActiveDefense.exe
QHSafeTray.exe
QHToasts.exe
QHWatchdog.exe
AdPopWnd.dll
PopWndInit.dat
PopWndTracker.dat
SafeWrapper.dll
SafeWrapper32.dll
SelfProtectAPI2.dll
SomProxy.dll
UDiskScanEngine.dll
VWallet.dll
WDPayPro.exe
WDRecord.dll
WDSafeDown.exe
WscReg.exe
acls.ini
chrmsafe.dat
360webshield.exe
manifest.json
manifest_firefox.json
chromesafe.dll
chromesafe64.dll
cuconfig.dat
disproc.dll
dlproc.dll
drvmk.dat
drvms.dat
execrule.dat
gamemode.tpi
hookport.sys
hookport_win10.cat
hookport_win10.sys
iNetSafe.dll
libzdtp.dll
libzdtp64.dll
netmon.tpi
psconfig.dat
qutmvd.tpi
router.ini
safehmpg.dll
safehmpg64.dll
safemon.dll
safemon64.dll
safemonhlp.dll
spsafe.dll
spsafe64.dll
svcMonitor.dll
swverify32.dll
swverify64.dll
udiskscan.dat
urllib.dat
urlproc.dll
wdblockij.dat
wdui2.dll
wdui3.dll
wduicfg.dat
webprotection_firefox.xpi
safescan.dll
scanbase.dll
scanproxy.dll
scanstub.dll
sites.dll
360Downloads.ini
360InstantSetup.exe
360Opt.dll
360SoftMgrS.dll
360elam.sys
360elam64.sys
EaInstHelper.exe
EaInstHelper64.exe
GroupMaps.ini
Optadn.dat
OptadnNet.dat
SMLCore.dll
SMLHelper64.exe
SMLLauncher.dll
SMLLauncher64.dll
SMLProxy64.exe
SML_SpeedNet.uiz
SML_TaskBar.uiz
SoftMgrLite.exe
SomAdvUtils.dll
SomAdvUtilsWrap.dll
SpeedUp.dll
commonbase.dll
SoftDetect.dat
lockkrnl.dll
optconfig.ini
safespeedboot.dat
somkernl.dll
stsuglist.dat
360FastFind.dll
360OKCleanNew.dat
CleanHelper64.exe
RemoteTrashInterface.dll
SysSweeper.dat
SysSweeper.dll
TEngine.dll
Tracehelper.exe
TrashClean.dll
WhiteList.dat
tracesweeper.dat
3tv895B.tmp
45d20124-6a89-48d6-bf7b-d1964f5fc78b.tmp
480E.tmp
7a3d53c39a0d7501f40fb91693e464cf_VPNMasterInst_guard.bmp
ADVPACK.DLL
rootsupd.inf
MSI94FE.tmp
MicrosoftEdgeWebview2Setup.exe
Opera_installer_2404091630482038360.dll
__PSScriptPolicyTest_uikkf0rg.p2e.ps1
a0141e90-ef31-4060-8109-b6be7f642c35.tmp
360TS_Setup.exe
idp.dll
myinternet.dll
nsExec.dll
nsProcess.dll
ohl471E.tmp
ohl47AB.tmp
ohl480A.tmp
ohl4878.tmp
ohl48E7.tmp
1d22546f-a78d-47c0-a128-0eda40a85393.tmp
360P2SP.dll
protocols.json
settings.dat
settings.dat
9e25d99e-046b-40f6-a1ca-99836f06296c.tmp
f_00000a
f_00000b
f_00000c
f_00001d
f_000020
f_000021
f_000024
f_000025
f_000029
f_00002c
f_00002d
f_000032
f_000034
f_000035
f_000036
f_000057
00e664aeba516f65_0
09497b25c5366dcc_0
1e7189c6771487ea_0
2336f7a1e9698190_0
2db69c3672f0504e_0
5a1d147f56324bb1_0
d7e00dfa92f557c4_0
da0f7817ac33dc01_0
ec8806316e9b5773_0
f0fec9381a0647d5_0
the-real-index
the-real-index
the-real-index~RFe5d7571.TMP
index
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State~RFe5d8fdf.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5ccf3e.TMP
d0007fa0-ea8e-4750-966a-16c8aebcc42c.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences~RFe5cd7d9.TMP
the-real-index
the-real-index~RFe5e1e63.TMP
index.txt
index.txt
index.txt
index.txt~RFe5cb86a.TMP
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe5c7c4c.TMP
crs.pb
ct_config.pb
Ruleset Data
Filtering Rules
LICENSE
metadata.pb
keys.json
hyph-as.hyb
Config.ini
DTFenceData.dtf
360DrvMgr_20240409.dat
360DrvMgr_20240409.dat
TrashClean.ini
client-intermediary.jar.tmp
baritone-api-fabric-1.10.2.jar
liquidbounce-1.20.4-0.2.0+e46d279d1e08f2d28388bba588d6e8b9e884e247.jar
fabric-api-0.91.3+1.20.4.jar
ferrite-core-6.0.3-fabric.jar
immediatelyfast-1.2.11+1.20.4-forge.jar
iris-1.6.17+1.20.4.jar
lithium-mc1.20.4-0.12.1.jar
modmenu-9.0.0.jar
no-chat-reports-Fabric-1.20.4-v2.5.0.jar
reeses-sodium-options-mc1.20.4-1.7.2.jar
sodium-extra-mc1.20.4-0.5.4.jar
sodium-mc1.20.4-0.5.8.jar
viafabricplus-3.1.0.jar
fabric-language-kotlin-1.10.17+kotlin.1.9.22.jar
javaw.exe
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
Unconfirmed 469073.crdownload
030922d6-aab8-40ee-8e22-ce26ae509b74.tmp
0d92d92c-b1ae-400e-9bac-f2de0b7c7243.tmp
0e5473cf-5903-4b7b-a0e2-5cfccc0f88ee.tmp
1382aef5-b297-42eb-91fa-97840a6df2a5.tmp
23c23347-22af-49f7-b4e1-a5b5cc36fb60.tmp
2702b70d-9806-47d4-9ec8-d7595d4c3873.tmp
28cdfd7a-b7f4-4ecb-855e-de765c474b79.tmp
3fde729c-4de2-443d-a584-81c90c64900b.tmp
405f9587-477d-49d9-acba-0d7f526f492e.tmp
4d38db6f-f551-4e66-9af0-f713648499d5.tmp
59d76d91-a094-4acc-b416-5ad68a5499ce.tmp
653b9a0c-8073-4e2a-876f-4d3776069886.tmp
68206366-714e-41f8-a025-bfeae0f13668.tmp
77a8ad32-4b56-4f04-99ae-7a35f4324e8c.tmp
TransportSecurity~RFe6439cd.TMP
b067607b-32bc-4095-8d4e-fba12fa49fec.tmp
c3b6b5c0-702d-4eb0-9a19-3d20adf1033e.tmp
c69828b8-efd5-4f4b-8b40-6c0de8187a10.tmp
d32cb837-9cbb-44e3-b6e6-1e49b0180abc.tmp
user_prefs.json~RFe6442a7.TMP
c_volume.PNF
bks5CC9.tmp
memory/952-1662-0x0000029A684D0000-0x0000029A68825000-memory.dmp
memory/2260-26007-0x00000000046A0000-0x00000000046A1000-memory.dmp
memory/2592-1807-0x000001AF36400000-0x000001AF36755000-memory.dmp
memory/3412-1277-0x00007FF9CFDA0000-0x00007FF9CFDA1000-memory.dmp
memory/3412-1269-0x00007FF9CF190000-0x00007FF9CF191000-memory.dmp
memory/3476-27769-0x0000000002100000-0x0000000002101000-memory.dmp
memory/3512-27584-0x0000000002590000-0x0000000002591000-memory.dmp
memory/3700-18155-0x0000000007230000-0x0000000007584000-memory.dmp
memory/3700-18195-0x000000000AA60000-0x000000000AA68000-memory.dmp
memory/3700-18148-0x00000000019A0000-0x00000000019B0000-memory.dmp
memory/3700-18176-0x0000000008290000-0x00000000087BC000-memory.dmp
memory/3700-18153-0x00000000019A0000-0x00000000019B0000-memory.dmp
memory/3700-18199-0x000000000D9C0000-0x000000000DB46000-memory.dmp
memory/3700-18197-0x000000000CDA0000-0x000000000CE32000-memory.dmp
memory/3700-18151-0x0000000071EF0000-0x00000000726A0000-memory.dmp
memory/3700-18194-0x00000000019A0000-0x00000000019B0000-memory.dmp
memory/3700-18152-0x0000000006B20000-0x000000000722C000-memory.dmp
memory/3700-18154-0x0000000006090000-0x00000000060B2000-memory.dmp
memory/3700-18150-0x0000000006400000-0x0000000006B20000-memory.dmp
memory/3700-18225-0x0000000071EF0000-0x00000000726A0000-memory.dmp
memory/3716-28051-0x00000000611B0000-0x000000006123E000-memory.dmp
memory/3716-32457-0x00000000611B0000-0x000000006123E000-memory.dmp
memory/3720-2045-0x0000024BA68D0000-0x0000024BA6C25000-memory.dmp
memory/3908-1742-0x00000198C2600000-0x00000198C2955000-memory.dmp
memory/4048-1999-0x000002C2A2200000-0x000002C2A2555000-memory.dmp
memory/4608-1947-0x00000281906D0000-0x0000028190A25000-memory.dmp
memory/4980-8223-0x000001F6E7EC0000-0x000001F6E8EC0000-memory.dmp
memory/4980-8250-0x000001F6E7EC0000-0x000001F6E8EC0000-memory.dmp
memory/4980-8261-0x000001F6E7EC0000-0x000001F6E8EC0000-memory.dmp
memory/4980-10091-0x000001F6E7EC0000-0x000001F6E8EC0000-memory.dmp
memory/5228-1950-0x00000241A0C00000-0x00000241A0F55000-memory.dmp
memory/5232-1529-0x000001DD09230000-0x000001DD09585000-memory.dmp
memory/5232-1260-0x00007FF9CFFB0000-0x00007FF9CFFB1000-memory.dmp
memory/5488-1222-0x00007FF9AD9C0000-0x00007FF9AE481000-memory.dmp
memory/5488-943-0x00007FF9AD9C0000-0x00007FF9AE481000-memory.dmp
memory/5488-1120-0x00007FF9AD9C0000-0x00007FF9AE481000-memory.dmp
memory/5488-933-0x000001C0D37E0000-0x000001C0D3802000-memory.dmp
memory/5488-944-0x000001C0EB960000-0x000001C0EB970000-memory.dmp
memory/5580-18419-0x0000000004110000-0x0000000004111000-memory.dmp
memory/5636-1531-0x000001CF81C00000-0x000001CF81F55000-memory.dmp
memory/5656-1649-0x0000021CA3200000-0x0000021CA3555000-memory.dmp
memory/5716-1530-0x00000238396D0000-0x0000023839A25000-memory.dmp
memory/5716-1270-0x00007FF9CFFB0000-0x00007FF9CFFB1000-memory.dmp
memory/5844-1944-0x00000245F8800000-0x00000245F8B55000-memory.dmp
memory/5864-1536-0x00000184FB4D0000-0x00000184FB825000-memory.dmp
memory/5904-1703-0x000001D154A00000-0x000001D154D55000-memory.dmp
memory/6432-27785-0x0000000002990000-0x0000000002991000-memory.dmp
memory/6608-27600-0x0000000003020000-0x0000000003021000-memory.dmp
memory/6728-18720-0x0000000009250000-0x0000000009251000-memory.dmp
memory/7208-18114-0x0000000000920000-0x0000000000921000-memory.dmp
memory/7208-17691-0x0000000000920000-0x0000000000921000-memory.dmp
memory/7428-17688-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/7428-18032-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/7428-18456-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/7876-27599-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/7876-27767-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/8392-18116-0x0000000072700000-0x0000000072EB0000-memory.dmp
memory/8392-18117-0x0000000005890000-0x00000000058B2000-memory.dmp
memory/8392-18118-0x0000000003430000-0x0000000003440000-memory.dmp
memory/8392-18122-0x0000000072700000-0x0000000072EB0000-memory.dmp
memory/8392-18115-0x0000000000F50000-0x0000000000F58000-memory.dmp
memory/8392-18119-0x0000000005A50000-0x0000000005A88000-memory.dmp
memory/8392-18120-0x00000000059E0000-0x00000000059EE000-memory.dmp
memory/8776-27784-0x0000000004130000-0x0000000004131000-memory.dmp
memory/8776-27611-0x0000000004130000-0x0000000004131000-memory.dmp
memory/9016-15525-0x0000017480000000-0x0000017481000000-memory.dmp
memory/9016-15545-0x0000017480000000-0x0000017481000000-memory.dmp
memory/9016-15546-0x0000017480000000-0x0000017481000000-memory.dmp
memory/9016-16889-0x0000017480000000-0x0000017481000000-memory.dmp
memory/9016-17460-0x00000174802A0000-0x00000174802B0000-memory.dmp
memory/9048-18236-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/9048-18405-0x0000000005720000-0x0000000005730000-memory.dmp
memory/9048-18645-0x0000000005720000-0x0000000005730000-memory.dmp
memory/9048-18688-0x0000000005720000-0x0000000005730000-memory.dmp
memory/9048-25898-0x0000000005720000-0x0000000005730000-memory.dmp
memory/9572-27768-0x0000000009A90000-0x0000000009A91000-memory.dmp
memory/9572-25987-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/9572-27583-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/14128-27746-0x00000000039B0000-0x00000000039B1000-memory.dmp
memory/14128-32076-0x00000000611B0000-0x000000006123E000-memory.dmp
memory/14128-27523-0x00000000039B0000-0x00000000039B1000-memory.dmp
memory/14128-27864-0x00000000611B0000-0x000000006123E000-memory.dmp