Analysis
- user interaction
yes - max time kernel
425s - max time network
429s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 23:03
General
- Target Lunar Client - Installer.exe
- Size 3.1MB
- Sample260807-21vsfsad65
- SHA256 cd0c903598e533e15543b4089c9fc366eafd18a9d66acfcda16ea045a7138bff
Malware Config
Signatures
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Checks computer location settings 2 TTPs 12 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to get system information.
- Drops file in System32 directory 28 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Windows directory 12 IoCs
- Executes dropped EXE 19 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Loads dropped DLL 57 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 12 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe"C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe" Sel=0&Extension=jilehohlakeokncafogkgnicgndeecdiengddbcc&UtmSource=badlion-site&UtmMedium=download-modal&UtmCampaign=direct&Referer=www.badlion.net&Browser=chrome -partnerCustomizationLevel 1 -customPromoPages --owelectronUrl=https://launcherupdates.lunarclientcdn.com/latest-ow.yml -AllowWindowsInsider --disable-change-location --disable-ow-shortcut-ui --disable-app-shortcut-ui --enable-app-shortcut --eula-url=https://www.lunarclient.com/terms --privacy-url=https://www.lunarclient.com/privacy --silent-setup --app-name="Lunar Client" --auto-close -exepath C:\Users\Admin\AppData\Local\Temp\Lunar Client - Installer.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\DxDiag.exe"C:\Windows\System32\DxDiag.exe" /xC:\Users\Admin\AppData\Local\Overwolf\Temp\DxDiagOutput.xml3⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --high-dpi-support=1 --mojo-named-platform-channel-pipe=3944.4212.124609004215774068813⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffbea4fb078,0x7ffbea4fb084,0x7ffbea4fb0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1712,i,6168565182842927109,7279246617384712053,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,6168565182842927109,7279246617384712053,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2356,i,6168565182842927109,7279246617384712053,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3584,i,6168565182842927109,7279246617384712053,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nsm17D9.tmp\OWinstaller.exe.WebView2\EBWebView" --webview-exe-name=OWinstaller.exe --webview-exe-version=2.304.0.13 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-device-scale-factor=1 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3908,i,6168565182842927109,7279246617384712053,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-jilehohlakeokncafogkgnicgndeecdiengddbcc\ow-electron-setup.exe"C:\Users\Admin\AppData\Local\Temp\ow-electron-setup-jilehohlakeokncafogkgnicgndeecdiengddbcc\ow-electron-setup.exe" /S --force-run /d="C:\Users\Admin\AppData\Local\Programs\Lunar Client"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"4⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Lunar Client', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\lunarclient /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\lunarclient\Crashpad --url=https://f.a.k/e --annotation=_productName=lunarclient --annotation=_version=3.7.13-ow --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.8.12 --initial-client-data=0x54c,0x57c,0x548,0x4cc,0x540,0x7ff61992610c,0x7ff619926118,0x7ff6199261282⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1960 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=cs --cs-app=lunarclient --uid=jilehohlakeokncafogkgnicgndeecdiengddbcc --phase=45 --muid=0c9b19db-25f6-4394-87f5-1d973edbc80d --muidv2=aa3f8970-4b07-48ad-9c6f-b95c0f61944d --version=39.8.12 --first-run2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lunar Client"2⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3268 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Lunar Client" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe\" --hidden" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3772 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3712 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4748 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Version"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v Version3⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4676 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --js-flags=--expose_gc --disable-crash-reporting --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4920 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5624 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --app-user-model-id=com.moonsworth.client --app-path="C:\Users\Admin\AppData\Local\Programs\Lunar Client\resources\app.asar" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5440 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\lunarclient" --standard-schemes=owepm,lc-asset --secure-schemes=lc-asset,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=lc-asset,sentry-ipc --streaming-schemes=owepm,lc-asset --field-trial-handle=1964,i,10839512780994250313,12800076791923342292,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5432 /prefetch:82⤵
- Executes dropped EXE
-
-
C:\Users\Admin\.lunarclient\jre\d093c370fc8eaa3e6743d7f61fb633adac4344f2\zulu21.48.17-ca-jre21.0.10-win_x64\bin\javaw.exeC:\Users\Admin\.lunarclient\jre\d093c370fc8eaa3e6743d7f61fb633adac4344f2\zulu21.48.17-ca-jre21.0.10-win_x64\bin\javaw.exe --add-modules jdk.naming.dns --add-exports jdk.naming.dns/com.sun.jndi.dns=java.naming -Dlog4j2.formatMsgNoLookups=true --add-opens java.base/java.io=ALL-UNNAMED -XX:+UseStringDeduplication "-DTrickNvidiaDriversForPerformance=' net.minecraft.client.main.Main '" -XX:FlightRecorderOptions=repository=jfr "-Dichor.filteredGenesisSentries=.*lcqt.*|.*Some of your mods are incompatible with the game or each other.*" -Dlunar.webosr.url=file:index.html -Xmx3072m -Dichor.fabric.localModPath=C:\Users\Admin\.lunarclient\profiles\1.21\mods -Djava.library.path=C:\Users\Admin\.lunarclient\offline\multiver\natives -Dlog4j.configurationFile=C:\Users\Admin\.lunarclient\profiles\1.21\logs\config.xml -Dichor.logsFile=C:\Users\Admin\.lunarclient\profiles\1.21\logs\ichor-boot.log -Dichor.usingIsolatedProfiles=true -XX:+DisableAttachMechanism -XX:-CreateCoredumpOnCrash -XX:-CreateMinidumpOnCrash -cp C:\Users\Admin\.lunarclient\offline\multiver\common-0.1.0-SNAPSHOT-all-nomappings.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-platform-mappings-v1_21_11.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-fabric-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-flashback-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-modmenu-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-replaymod-fabric-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-skyhanni-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-sodium-mixins-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\genesis-0.1.0-SNAPSHOT-all.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar-lang.jar;C:\Users\Admin\.lunarclient\offline\multiver\lunar.jar;C:\Users\Admin\.lunarclient\offline\multiver\modern-0.1.0-SNAPSHOT-all-nomappings.jar com.moonsworth.lunar.genesis.Genesis --version 1.21.11 --launcherVersion 3.7.13-ow --launcherFeatureFlags "{\"enabled\":[\"ServersCTA\",\"SocialMessaging\",\"LunarOAuthApp\",\"LaunchCancelling\",\"SelectModpack\",\"ServerRecommendedModpack\",\"EmbeddedBrowserOpens\",\"MissionControl\",\"ExternalLinkSSO\",\"HomeAdOverwolf\",\"MissionControlAdOverwolf\",\"Radio\",\"RadioPremium\",\"AMDDriverFix\",\"ExploreModsAdOverwolf\",\"MissionControlTopAdOverwolf\",\"OverwolfCRN\",\"YoutubeLinking\",\"HomeTopAdOverwolf\",\"SatelliteGifPicker\",\"VersionsCreateProfile\"],\"disabled\":[\"CustomizableQuickPlay\",\"CommunityServers\",\"ProfileModsExploreCTA\",\"LoaderVersionSetting\",\"InstallVCRedistributable\",\"OverwolfOverlay\",\"TopbarOutplayedPromotion\"]}" --installationId 9b4c1eda-b69c-4523-9828-94309f595c81 --overwolfMuid 0c9b19db-25f6-4394-87f5-1d973edbc80d --sentryTraceId cbde084226053e541c9e85da954a0eaf --launchId 469aaf40-c03a-48c4-83c0-1278eba02ef5 --canaryToken control:b1fd678cda479218af63499aca1a480c --accessToken 0 --userProperties {} --assetIndex 29 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\.lunarclient\shared\assets --texturesDir C:\Users\Admin\.lunarclient\textures --uiDir C:\Users\Admin\.lunarclient\ui\ab970b3a04057bdcabcb58c162de861d05dcdeaf --webosrDir C:\Users\Admin\.lunarclient\offline\multiver\natives --workingDirectory . --classpathDir C:\Users\Admin\.lunarclient\offline\multiver --width 1280 --height 720 --ipcPort 28190 --ichorClassPath common-0.1.0-SNAPSHOT-all-nomappings.jar,lunar-platform-mappings-v1_21_11.jar,lunar-fabric-mixins-0.1.0-SNAPSHOT-all.jar,lunar-flashback-mixins-0.1.0-SNAPSHOT-all.jar,lunar-modmenu-mixins-0.1.0-SNAPSHOT-all.jar,lunar-replaymod-fabric-mixins-0.1.0-SNAPSHOT-all.jar,lunar-skyhanni-mixins-0.1.0-SNAPSHOT-all.jar,lunar-sodium-mixins-0.1.0-SNAPSHOT-all.jar,genesis-0.1.0-SNAPSHOT-all.jar,lunar-lang.jar,lunar.jar,modern-0.1.0-SNAPSHOT-all-nomappings.jar --ichorExternalFiles tier-tagger.json,waypoint-patterns.json,kill-sound-chat-patterns.json,vanilla_capes.json,user-message-patterns.json,hypixel/bedwars.json,hypixel/teamview.json,hypixel/quickplay.json,hypixel/skyblock/hoppity-eggs.json,hypixel/skyblock/metal-detector-locations.json,hypixel/skyblock/adblock-websites.json,hypixel/skyblock/api-items-override.json,hypixel/skyblock/minions.json,hypixel/skyblock/splits.json,hypixel/skyblock/vendor-items.json,hypixel/skyblock/important-items.json,hypixel/skyblock/fairy-souls.json,hypixel/skyblock/stacking-enchants.json,hypixel/skyblock/item-abilities.json,hypixel/skyblock/skyblock-vanilla-items.json,hypixel/skyblock/enchants.json,hypixel/skyblock/important-npc-locations.json,hypixel/skyblock/skill-xp.json,hypixel/skyblock/chocolate-factory-prices.json,hypixel/skyblock/commands.json,hypixel/skyblock/sphinx-key.json,hypixel/skyblock/kuudra-waypoints.json,hypixel/skyblock/modern-islands.json,hypixel/skyblock/api-materials-override.json,hypixel/skyblock/tab-widgets.json,hypixel/skyblock/middle-click.json,hypixel/skyblock/max-levels.json,hypixel/skyblock/garden.json,hypixel/skyblock/item-shop-prices.json,hypixel/skyblock/mineshaft-corpse-waypoints.json,hypixel/skyblock/glacite-tunnels.json,hypixel/skyblock/autocomplete-warps.json,hypixel/skyblock/fishing/trophy-frog-fillet.json,hypixel/skyblock/fishing/trophy-fish-fillet.json,hypixel/skyblock/fishing/baits.json,hypixel/skyblock/fishing/sea-creatures.json,hypixel/skyblock/dungeon/waterboard-solutions.json,hypixel/skyblock/dungeon/rooms.json,hypixel/skyblock/dungeon/quiz-key.json,hypixel/skyblock/dungeon/trash-items.json,hypixel/skyblock/dungeon/routes.json2⤵
- Network Service Discovery
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe"C:\Users\Admin\AppData\Local\Programs\Lunar Client\Lunar Client.exe" --hidden1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
ui-ab970b3a04057bdcabcb58c162de861d05dcdeaf.zip
3dSkinLayers.md
ASM.txt
AppleSkin.md
Blur.md
DSM.txt.part
Emojibase.txt
GeckoLib-Core.txt
Hermes.txt
Java-WebSocket.txt
KyoriPowered_Adventure.md
LWJGL.txt
Lombok.txt
LunatriusCore.txt.part
MCP.txt
McLib.txt
MinecraftForge-Authors-1.8.9.txt
MinecraftForge-FML-Credits.txt
MinecraftForge-FML-License.txt
MinecraftForge-License-1.8.9.txt
Mixin.md
MixinExtras.txt
OptiFineVboFix.txt
Paulscode-IBXM-Library-License.txt
Paulscode-SoundSystem-CodecIBXM-License.txt
README.txt
ReplayMod.md
Resource-Exploit-Fix.txt
SkyblockAddons.txt
Twemoji.txt
geckolib.txt
jGui.txt
jackson-core.txt.part
junixsocket.txt.part
netty.txt
particleman.txt
procbridge.txt
sentry-java.txt
toxiclibs.txt
uniform-fix.txt
assetserver.log
gameipc.log
main.log
main.log
main.log
main.log
overwolf.log
promotions.log
styngr.log
updater.log
updater.log
window.log
window.log
client-natives-win-x86-v1_21_11.zip
bedwars.json
quickplay.json
adblock-websites.json
api-items-override.json
api-materials-override.json
autocomplete-warps.json
chocolate-factory-prices.json
commands.json
quiz-key.json
rooms.json
routes.json
trash-items.json
waterboard-solutions.json
enchants.json
fairy-souls.json
baits.json
sea-creatures.json
trophy-fish-fillet.json
trophy-frog-fillet.json
garden.json
glacite-tunnels.json
hoppity-eggs.json
important-items.json
important-npc-locations.json
item-abilities.json
item-shop-prices.json
kuudra-waypoints.json
max-levels.json
metal-detector-locations.json
middle-click.json
mineshaft-corpse-waypoints.json
minions.json
modern-islands.json
skill-xp.json
skyblock-vanilla-items.json
sphinx-key.json
splits.json
stacking-enchants.json
tab-widgets.json
vendor-items.json
teamview.json
kill-sound-chat-patterns.json
tier-tagger.json
ul-natives-x86-win.zip
ul-resources.zip
user-message-patterns.json
vanilla_capes.json
waypoint-patterns.json
webosr-natives-x86-win.zip
base-modpack.mrpack.download
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
ichor-boot.log
fabric-biome-api-v1-17.1.1+4fc5413f3e-e85e52e6bab1dbc6.jar
fabric-command-api-v2-2.4.7+6b42a6003e-a6d7072552922485.jar
fabric-content-registries-v0-10.+4fc5413f3e-3ef11710b6112069.jar
fabric-data-generation-api-v1-23+ae1056283e-2e1ed3dd5d568312.jar
fabric-game-rule-api-v1-2.0.3+4fc5413f3e-ce5cefd1b81e72ef.jar
fabric-item-group-api-v1-4.2.36+4fc5413f3e-ce64fcbb9607019.jar
fabric-lifecycle-events-v1-2.6.1+4ebb5c083e-97226f6338f6a9c9.jar
fabric-model-loading-api-v1-6.0.+4fc5413f3e-63570138ef63f65c.jar
fabric-networking-api-v1-5.1.5+ae1e07683e-f589ae94fe2ede61.jar
fabric-object-builder-api-v1-21.+4fc5413f3e-ce3616235af883a0.jar
fabric-particles-v1-4.2.11+4fc5413f3e-c7e36916cb850848.jar
fabric-recipe-api-v1-8.2.3+4ebb5c083e-3ed43747fcd849d9.jar
fabric-registry-sync-v0-6.2.4+4ebb5c083e-915c11f8eaebb7cb.jar
fabric-renderer-api-v1-8.0.0+f4ffd2e53e-5db9ab629dcaa72b.jar
fabric-renderer-indigo-5.0.0+f4ffd2e53e-ea01cd3fb8e7f758.jar
fabric-resource-conditions-api-v+4fc5413f3e-92d482f4da036509.jar
fabric-resource-loader-v1-1.0.10+78c8b4663e-cf77ab1cb7b42be8.jar
fabric-screen-handler-api-v1-1.3+4fc5413f3e-8d9b2077bc284d17.jar
fabric-tag-api-v1-1.2.20+4fc5413f3e-b8a504e7b7a385f.jar
fabric-transitive-access-widener+0107c3da3e-eb004487e6c41487.jar
fabric-api-0.140.0+1.21.11.jar.part
ferritecore-8.0.3-fabric.jar.part
iris-fabric-1.10.4+mc1.21.11.jar.part
modmenu-17.0.0-alpha.1.jar.part
placeholder-api-2.8.1+1.21.10.jar.part
sodium-fabric-0.8.2+mc1.21.11.jar.part
cache.json
cache.json
cache.json
cache.json
cache.json.tmp-614398237115793a
cache.json.tmp-614406439049f04e
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json
launcher.json.tmp-6143981793ae0ad2
launcher.json.tmp-61439818017c8f15
launcher.json.tmp-6143981879d89254
launcher.json.tmp-6143981896c968d6
launcher.json.tmp-6143981951dc638a
launcher.json.tmp-61439820174de1d2
launcher.json.tmp-6143982025ba41e9
launcher.json.tmp-61440649011a36ca
590470ab0f17afb73a4e41d9cb56fdbe069d275a.part
779a25f18a4e46176467a600a13904b4accd01b8.part
badges.json
76.webp
apex.webp
ballone.webp
ballthree.webp
balltwo.webp
blackmoon.webp
chat-diamond.webp
chat-gold.webp
chat-plain.webp
christmas-tree.webp
dancing.webp
diamond.webp
dog.webp
easter-egg.webp
fistbronze.webp
fistdiamond.webp
fistgold.webp
fistsilver.webp
hat.webp
icecream.webp
jordan.webp
lunar-diamond.webp
lunar-gold.webp
lunar-plain.webp
lunar7.webp
macguy.webp
medal.webp
physci.webp
plus.webp
pumpkin.webp
pvphq.webp
shirt-diamond.webp
shirt-gold.webp
shirt-plain.webp
snake.webp
snowflake.webp
trophy.gif
trophy.webp
trophy.webp.mcmeta
tux_black.webp
tux_gold.webp
tux_silver.webp
tuxedo_badge.webp
wrench.webp
cosmetics.json
compat.json
constants.molang
functions.molang
index
bodywear.json
cosmetic_morphs.json
hats.json
shader_textures.json
emotes.json
10.webp
100.webp
11.webp
12.webp
13.webp
134.webp
135.webp
136.webp
137.webp
138.webp
139.webp
14.webp
15.webp
16.webp
167.webp
168.webp
169.webp
17.webp
170.webp
171.webp
172.webp
173.webp
174.webp
175.webp
176.webp
177.webp
178.webp
179.webp
18.webp
180.webp
181.webp
182.webp
183.webp
184.webp
185.webp
186.webp
187.webp
188.webp
189.webp
19.webp
190.webp
191.webp
192.webp
193.webp
20.webp
200.webp
201.webp
202.webp
21.webp
22.webp
23.webp
233.webp
234.webp
235.webp
236.webp
237.webp
238.webp
239.webp
24.webp
240.webp
241.webp
242.webp
25.webp
26.webp
266.webp
267.webp
268.webp
269.webp
27.webp
270.webp
271.webp
272.webp
273.webp
274.webp
275.webp
276.webp
277.webp
28.webp
29.webp
30.webp
309.webp
31.webp
310.webp
311.webp
312.webp
313.webp
314.webp
315.webp
316.webp
317.webp
318.webp
319.webp
32.webp
320.webp
321.webp
322.webp
33.webp
34.webp
342.webp
35.webp
36.webp
37.webp
375.webp
376.webp
377.webp
378.webp
379.webp
38.webp
380.webp
39.webp
40.webp
408.webp
409.webp
41.webp
410.webp
42.webp
43.webp
44.webp
45.webp
46.webp
47.webp
48.webp
49.webp
50.webp
51.webp
52.webp
53.webp
54.webp
55.webp
56.webp
57.webp
58.webp
63.webp
64.webp
65.webp
66.webp
67.webp
68.webp
69.webp
7.webp
70.webp
71.webp
72.webp
73.webp
74.webp
75.webp
76.webp
77.webp
78.webp
79.webp
8.webp
80.webp
81.webp
82.webp
83.webp
84.webp
85.webp
86.webp
88.webp
89.webp
9.webp
90.webp
91.webp
92.webp
93.webp
94.webp
95.webp
96.webp
97.webp
98.webp
99.webp
actions-1.bobj
actions-2.bobj
actions-3.bobj
actions-4.bobj
actions-5.bobj
actions-6.bobj
actions-7.bobj
actions-8.bobj
actions.bobj
default.bobj
default.json
default_1_7.bobj
default_simple.bobj
default_simple.json
legacy.json
slim.bobj
slim.json
slim_simple.bobj
slim_simple.json
props-10.bobj
props-11.bobj
props-12.bobj
props-13.bobj
props-2.bobj
props-3.bobj
props-4.bobj
props-5.bobj
props-6.bobj
props-7.bobj
props-8.bobj
props-9.bobj
props.bobj
props_simple.bobj
6.webp
7.webp
bench_press.webp
broom.webp
bubbles.webp
candy_box.webp
cauldron.webp
christmas_bell.webp
christmas_cup.webp
christmas_ice_skates.webp
christmas_present.webp
christmas_reindeer.webp
christmas_sled.webp
christmas_snowman.webp
christmas_tree.webp
coffin.webp
dollar.webp
drumset.webp
dumbbell.webp
guitar.webp
hat.webp
heads.webp
keys.webp
mm_feelin_alive_1.webp
mm_feelin_alive_2.webp
mm_lava_chicken.webp
mm_lava_chicken.webp.mcmeta
oak_boat.webp
pandora_box.webp
paper.webp
particles.webp
popcorn.webp
pull_up_bar.webp
pumpkin.webp
rocket.webp
sax.webp
shears.webp
soccer_ball.webp
stone.webp
tails.webp
tone_coin.webp
trombone.webp
vacuum_tube.webp
wand.webp
bullhorn.webp
discord.webp
gift.webp
heart.webp
shopping_cart.webp
star.webp
twitch.webp
twitter.webp
youtube.webp
arcade.webp
arena.webp
bedwars.webp
blitzsg.webp
build_battle.webp
classic_games.webp
cops_and_crims.webp
duels.webp
housing.webp
lobby.webp
megawalls.webp
murder_mystery.webp
paintball.webp
pit.webp
prototype.webp
skyblock.webp
skywars.webp
smash_heroes.webp
smp.webp
speed_uhc.webp
tnt_games.webp
uhc.webp
unknown.webp
warlords.webp
wool_wars.webp
jit_index
wrapped-2022-button.webp
youtooz-bubble.webp
youtooz-character.webp
configuration.json
around.particle.json
avatar_air1.particle.json
avatar_air2.particle.json
avatar_air3.particle.json
avatar_earth1.particle.json
avatar_earth2.particle.json
avatar_earth3.particle.json
avatar_fire1.particle.json
avatar_fire2.particle.json
avatar_fire3.particle.json
avatar_water.particle.json
blow_kiss_hearts.particle.json
breathing_aura.particle.json
bubbles.particle.json
candies.particle.json
candies_puke.particle.json
cauldron_bubbles.particle.json
cauldron_fire.particle.json
charge_up1.particle.json
charge_up2.particle.json
charge_up3.particle.json
charge_up4.particle.json
charge_up5.particle.json
charge_up6.particle.json
charge_up7.particle.json
christmas_ice_shatter.particle.json
christmas_iceberg.particle.json
christmas_icespray.particle.json
christmas_snow.particle.json
christmas_snowballs.particle.json
christmas_snowpuffs.particle.json
cobra_kick_trail.particle.json
cold_breath.particle.json
crying.particle.json
easter_petals.particle.json
fireworks.particle.json
ghosts.particle.json
green_sparkles.particle.json
heart_aura.particle.json
heart_fountain.particle.json
high_five_clap.particle.json
jetpack_fire.particle.json
js_heart.particle.json
js_letter_j.particle.json
js_letter_plus.particle.json
js_letter_s.particle.json
karate_chop_aura.particle.json
karate_chop_smoke.particle.json
loading.particle.json
lucky_day.particle.json
lucky_day_vacuum.particle.json
make_it_rain.particle.json
money.particle.json
music_notes.particle.json
music_notes_1.particle.json
popcorn_kernels.particle.json
pure_salt.particle.json
pwr_flare.particle.json
pwr_jump.particle.json
pwr_sparks.particle.json
rainbow.particle.json
rocket_start.particle.json
rocket_trail.particle.json
sneeze.particle.json
sparkleaura.particle.json
sparkles.particle.json
spit.particle.json
star_power_rainbow.particle.json
star_power_ring.particle.json
vomit.particle.json
wand_spell.particle.json
zen_aura.particle.json
zen_aura_2.particle.json
zen_aura_3.particle.json
around.webp
bubble.webp
candies.webp
charge_up1.webp
charge_up2.webp
charge_up6.webp
charge_up8.webp
cold.webp
default_particles.webp
easter_petals.webp
ghost.webp
green_sparkles.webp
heart.webp
ice_fragments.webp
pixel.webp
popcorn_kernels.webp
pwr_ring.webp
pwr_sparks.webp
rocks.webp
snowflakes.webp
sparkleaura.webp
sparkles.webp
spit.webp
star_power_rings.webp
vomit.webp
lunarplus_glow_logo.fsh
testerplus_rainbow.fsh
sprays.json
DMSans-Black.ttf
DMSans-BlackItalic.ttf
DMSans-Bold.ttf
DMSans-BoldItalic.ttf
DMSans-ExtraBold.ttf
DMSans-ExtraBoldItalic.ttf
DMSans-ExtraLight.ttf
DMSans-ExtraLightItalic.ttf
DMSans-Italic.ttf
DMSans-Light.ttf
DMSans-LightItalic.ttf
DMSans-Medium.ttf
DMSans-MediumItalic.ttf
DMSans-Regular.ttf
DMSans-SemiBold.ttf
DMSans-SemiBoldItalic.ttf
DMSans-Thin.ttf
DMSans-ThinItalic.ttf
MeltedMonster.ttf
MinecraftBold.ttf
MinecraftBoldItalic.ttf
MinecraftItalic.ttf
MinecraftRegular.ttf
Panton-BlackCaps.ttf
Panton-BlackitalicCaps.ttf
badlion.png
bg.png
broom.png
cloak-thumbnail.png
curtains.png
end.png
grass.png
index.css
nether.png
overworld.png
palm-tree.png
placeholder.png
planet.png
powered-by-klipy.png
santa-hat.webp
space-purple.webp
space.png
spray-32x32.png
starburst-bg.png
tada.png
transition.ogg
unknown_server.png
witch-hat.png
SettingsPageBasic.xml.bak
chrome_100_percent.pak
__PSScriptPolicyTest_1vltddqu.0uj.ps1
LICENSE.electron.txt
LICENSES.chromium.html
chrome_200_percent.pak
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
owutility.dll
resources.pak
app-update.yml
app.asar
7x.sh
index.js
7za
7za
7za
7za
build.sh
do-build.sh
7za
7za
package.json
7za.exe
7za.exe
7za.exe
bsdiff.node
index.js
package.json
better_sqlite3.node
database.js
index.js
aggregate.js
backup.js
function.js
inspect.js
pragma.js
serialize.js
table.js
transaction.js
wrappers.js
sqlite-error.js
util.js
package.json
diskusage.node
fallback.js
index.js
package.json
iselevated.node
index.js
mise.toml
package.json
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
WinShell.dll
nsExec.dll
CommandLine.dll
Microsoft.Web.WebView2.Core.dll
Microsoft.Web.WebView2.WinForms.dll
Newtonsoft.Json.dll
OWInstaller.exe
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index
the-real-index
data_2
data_0
data_1
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe596056.TMP
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity~RFe58d23f.TMP
Preferences
Preferences
Preferences
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State~RFe5827f5.TMP
OWinstaller.exe.config
OverWolf.Client.CommonUtils.dll
SharpRaven.dll
System.dll
UserInfo.dll
WebView2Loader.dll
messages.json
close-hover.png
close-normal.png
icon.ico
minimize-normal.png
index.html
app.js
block_inputs.js
cmp.bundle.js
notifications.js
analytics.js
commands.js
cookies.js
modal-events-delegate.js
strings-loader.js
utils.js
cri-controller.js
template.js
cris-controller.js
template.js
finish-with-recommended-app-controller.js
template.js
finish-controller.js
template.js
main-controller.js
template.js
modal-controller.js
privacy-controller.js
template.js
progress-1-controller.js
template.js
settings-controller.js
template.js
template.js
welcome-controller.js
manifest.json
log4net.dll
partner-custom-asset.png
uac.dll
utils.dll
ow-electron-setup.exe
InstallerTrace_2026-08-08_00-04_3944.log
InstallerTrace_2026-08-08_00-04_3944.log
genesis.log
genesis.log
genesis.log
genesis.log
genesis.log
1.21.11.jar
default.dic
f_000002
f_000011
f_000013
f_00001c
f_00001d
f_00001e
f_00001f
f_000020
f_000021
f_000022
f_000023
f_000024
f_000025
f_000026
f_000027
f_00002c
f_00002e
f_000032
f_000040
f_000048
f_00004c
f_00004d
f_00004e
f_000056
f_000057
f_000058
f_000067
f_00006a
f_000071
f_000075
the-real-index
the-real-index~RFe5c0a87.TMP
index
Network Persistent State
Network Persistent State
Preferences
Preferences~RFe59b164.TMP
scope_v3.json
scope_v3.json
scope_v3.json
session.json
owpm.log
memory/452-491-0x0000019A82B20000-0x0000019A82B8B000-memory.dmp
memory/1380-421-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-418-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-417-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-422-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-423-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-419-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-420-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-412-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-413-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1380-411-0x00000298346D0000-0x00000298346D1000-memory.dmp
memory/1732-247-0x00007FFC11980000-0x00007FFC11981000-memory.dmp
memory/1732-246-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp
memory/1840-221-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp
memory/2920-637-0x000000006FD20000-0x000000006FD6C000-memory.dmp
memory/2920-646-0x00000000704A0000-0x00000000707F4000-memory.dmp
memory/2932-337-0x00007FFC107A0000-0x00007FFC107A1000-memory.dmp
memory/2932-490-0x000001B85E620000-0x000001B85E68B000-memory.dmp
memory/3780-592-0x00000000079F0000-0x00000000079FA000-memory.dmp
memory/3780-578-0x0000000006670000-0x00000000066BC000-memory.dmp
memory/3780-567-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/3780-579-0x0000000006C10000-0x0000000006C42000-memory.dmp
memory/3780-577-0x0000000006630000-0x000000000664E000-memory.dmp
memory/3780-566-0x0000000005690000-0x00000000056B2000-memory.dmp
memory/3780-565-0x0000000005970000-0x0000000005F98000-memory.dmp
memory/3780-589-0x0000000007830000-0x00000000078D3000-memory.dmp
memory/3780-576-0x0000000006080000-0x00000000063D4000-memory.dmp
memory/3780-594-0x0000000007BA0000-0x0000000007BC4000-memory.dmp
memory/3780-588-0x0000000007810000-0x000000000782E000-memory.dmp
memory/3780-568-0x0000000006010000-0x0000000006076000-memory.dmp
memory/3780-564-0x0000000003050000-0x0000000003086000-memory.dmp
memory/3780-591-0x0000000007980000-0x000000000799A000-memory.dmp
memory/3780-595-0x000000006FE90000-0x00000000701E4000-memory.dmp
memory/3780-590-0x0000000007FD0000-0x000000000864A000-memory.dmp
memory/3780-580-0x000000006FD20000-0x000000006FD6C000-memory.dmp
memory/3780-593-0x0000000007B70000-0x0000000007B9A000-memory.dmp
memory/3944-173-0x0000018E34880000-0x0000018E34910000-memory.dmp
memory/3944-190-0x0000018E34820000-0x0000018E34842000-memory.dmp
memory/3944-146-0x0000018E19110000-0x0000018E19124000-memory.dmp
memory/3944-193-0x0000018E34800000-0x0000018E3480E000-memory.dmp
memory/3944-147-0x0000018E33660000-0x0000018E33B88000-memory.dmp
memory/3944-148-0x0000018E1A930000-0x0000018E1A940000-memory.dmp
memory/3944-473-0x0000018E1A930000-0x0000018E1A940000-memory.dmp
memory/3944-166-0x0000018E33470000-0x0000018E33520000-memory.dmp
memory/3944-150-0x0000018E1A940000-0x0000018E1A986000-memory.dmp
memory/3944-144-0x0000018E33080000-0x0000018E3312A000-memory.dmp
memory/3944-154-0x0000018E1A900000-0x0000018E1A918000-memory.dmp
memory/3944-140-0x0000018E18B60000-0x0000018E18BB4000-memory.dmp
memory/4208-600-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/4208-608-0x000000006FD20000-0x000000006FD6C000-memory.dmp
memory/4208-625-0x0000000007790000-0x00000000077A1000-memory.dmp
memory/4208-624-0x0000000007820000-0x00000000078B6000-memory.dmp
memory/5400-8489-0x00007FFC11980000-0x00007FFC11981000-memory.dmp
memory/5400-8488-0x00007FFC10810000-0x00007FFC10811000-memory.dmp
memory/10496-14987-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14991-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14989-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14978-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14986-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14977-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14979-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14990-0x0000020139B90000-0x0000020139B91000-memory.dmp
memory/10496-14988-0x0000020139B90000-0x0000020139B91000-memory.dmp