Analysis
- user interaction
yes - max time kernel
900s - max time network
881s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/08/2026, 03:25
General
- Target capcut_capcutpc_invitefission_1.2.29_installer.exe
- Size 2.7MB
- Sample260816-dy2afscl4x
- SHA256 93d01033730f0fcb912f341b37b4a2f3fef72fafaee69ecd0545ac2bb0cbf459
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger 27 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 38 IoCs
- Executes dropped EXE 27 IoCs
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 17 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 8 IoCs
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 5 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.29_installer.exe"C:\Users\Admin\AppData\Local\Temp\capcut_capcutpc_invitefission_1.2.29_installer.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\app_shell_cache_562354\app_package_5d5ac5a9dc.exe"C:\Users\Admin\AppData\Local\app_shell_cache_562354\app_package_5d5ac5a9dc.exe" /s /create_desktop=1 /create_right_click_menu=0 /right_click_menu_cannot_be_created_reason=NOT_IN_RANGE /install_path="C:\Users\Admin\AppData\Local\CapCut\Apps"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\CapCut.exeC:\Users\Admin\AppData\Local\CapCut\Apps\CapCut.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"3⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=gpu-process --no-sandbox --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --mojo-platform-channel-handle=2812 --field-trial-handle=2816,i,15880247300938454632,12823586492740393804,262144 --disable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:24⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic.exe diskdrive where index=0 get serialnumber4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\parfait_crash_handler.exeC:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\parfait_crash_handler.exe "--database=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash\\" "--metrics-dir=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash\\" --annotation=crop_type=6 --annotation=enable_crash_event=true --annotation=execute-if-childprocess-crash=true --annotation=is_debug=false --annotation=main_pid=4620 "--annotation=os_version=Windows NT 10.0.19041" --annotation=parfait_version=1.6.6.2 --annotation=posthandler-args= "--annotation=posthandler-copy-dir=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash/crash_post_reports" --annotation=posthandler-process-path=C:/Users/Admin/AppData/Local/CapCut/Apps/9.2.0.3931/VECrashHandler.exe --annotation=posthandler-wait-result=true --annotation=posthandler-wait-timeout=120 --initial-client-data=0x1064,0x1068,0x106c,0x1060,0xfe4,0x7fffd45023b0,0x7fffd45023c8,0x7fffd45023e04⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exeC:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic csproduct get Name,UUID /value5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get Name,UUID /value6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe" driverinfo5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe" -cmd_qt6render_dx_hw_support5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe" -cmd_qt6render_dx_sw_support5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exeC:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe /launch=detector5⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=gpu-process --no-sandbox --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --mojo-platform-channel-handle=2400 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:26⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Windows\system32\wbem\wmic.exeC:\Windows\system32\wbem\wmic.exe diskdrive where index=0 get serialnumber6⤵
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\parfait_crash_handler.exeC:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\parfait_crash_handler.exe "--database=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash\\" "--metrics-dir=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash\\" --annotation=crop_type=7 --annotation=enable_crash_event=true --annotation=execute-if-childprocess-crash=true --annotation=is_debug=false --annotation=main_pid=3196 "--annotation=os_version=Windows NT 10.0.19041" --annotation=parfait_version=1.6.6.2 --annotation=posthandler-args= "--annotation=posthandler-copy-dir=C:\Users\Admin\AppData\Local\CapCut\User Data\Crash/crash_post_reports" --annotation=posthandler-process-path=C:/Users/Admin/AppData/Local/CapCut/Apps/9.2.0.3931/VECrashHandler.exe --annotation=posthandler-wait-result=true --annotation=posthandler-wait-timeout=120 --initial-client-data=0x1240,0x1244,0x1248,0x123c,0x1268,0x7fffd6e323b0,0x7fffd6e323c8,0x7fffd6e323e06⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe" driverinfo6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exeC:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe -detect_simulate_check6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\ttdaemon.exe" driverinfo7⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe" -cmd_qt6render_dx_hw_support7⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\VEDetector.exe" -cmd_qt6render_dx_sw_support7⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --mojo-platform-channel-handle=7152 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:86⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --mojo-platform-channel-handle=7156 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:86⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --first-renderer-process --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=7532 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=7536 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=7708 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=7724 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=7960 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=8328 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.capcut.com/lvpc_web/login_proxy?platform=google&lng=en&login_id=10b657be-14a5-40aa-834a-1f6546317825&is_support_looki=true6⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x338,0x7fff8f33c188,0x7fff8f33c194,0x7fff8f33c1a07⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,5774293766072348389,4100660859756829952,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,1849082537330942325,8685748745818586740,262144 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,10974647828724133265,818754336346431880,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,15261540135676741790,12377297964230368928,2097152 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,6605928822149504799,465785194650645014,2097152 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,10655244257728005448,4289064960008057303,2097152 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,14300865160745955045,9795300577805910084,2097152 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,11474229895924250088,17189351040220907788,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,2035058353412592403,2816624533668700953,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,1139496772642048597,910837612038461337,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7127938254331510781,4434051356861101067,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,7127938254331510781,4434051356861101067,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,12796461054951886397,324241105632059875,2097152 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,1900624764651847390,896331155482277264,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7453304368190091142,9489935651837759621,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13850072505110402729,9644581591930579950,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,15506533769548537569,2715507393873101179,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,7367590499816897763,7383823983639930704,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,11412157474644821269,11272524559511003825,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,21945695871812452,12956298607158717933,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,17952628861652650186,364489183741716047,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,18163954894514888450,5023595450545805100,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,14911833974488414436,6302081657588184675,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,7382162817749150551,10553568269641777730,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4300695777718658775,14998709268133521,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,14879639521092518226,13643197322075800095,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5852,i,13380557080122171918,6176458225421851488,262144 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3314144460415440003,3860721099169932742,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4900552094886397446,12303632582536415602,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,15854768965977951466,11467004504414964068,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,8354890690354580525,624856949412463055,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,17340699188001991434,10950288307627292459,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3172,i,8965735376727074623,7560661954111438744,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,14426890827274948600,10272960702628950249,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9396855687005573336,9013834621803911560,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,3602116423669453009,14112999723003819356,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,14261508436783709451,1484851849842722257,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,15086549437140143050,14435411973334977418,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10522301068267308450,12610669156856350412,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,4251381887449282046,5851277266521866188,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,9650054576313903963,13497203530817479410,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,1693228461593053946,17502850378919147264,524288 --field-trial-handle=2364,i,473786072801808460,5169308495315764912,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:87⤵
-
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=10140 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe"C:\Users\Admin\AppData\Local\CapCut\Apps\9.2.0.3931\CapCut.exe" --type=renderer --log-severity=error --user-agent-product="CAPCUT_PC/9.2.0 Chrome/121.0.6167.86" --user-data-dir="C:\Users\Admin\AppData\Local\CapCut\User Data\CEF" --parent-process-id=3196 --no-sandbox --log-file="C:/Users/Admin/AppData/Local/CapCut/User Data/CEF\cef_log.log" --use-fake-ui-for-media-stream --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=9784 --field-trial-handle=2404,i,4759393917447551696,7148278361691732241,262144 --enable-features=AhaCleanBrokenCache,AhaEnablePageLoadMetrics,EnableBlankPaint --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version /prefetch:16⤵
- Checks computer location settings
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x46c 0x4681⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\b72ed2c3298043288ace59573f177bfa /t 3364 /p 31961⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
HorizontalHeaderView.qml
VerticalHeaderView.qml
ScrollView.qml
plugins.qmltypes
content.json
scene.config
sticker.config
chromakey.vert
config.json
default_photo_ico.jpg
content.json
SeekModeScript.lua
main.scene
Quad.mesh
outputTex.rt
colorAdjust.frag
LumiParamsSetter.lua
sticker.config
algorithmConfig.json
ImageBusinessSlider.lua
main.scene
Quad.mesh
NewScreenRT.rt
outputTex.rt
noface.xshader
ImageBusinessSlider.lua
Quad.mesh
MidPyr0.rt
MidPyr1.rt
MidPyr1Up.rt
MidPyr2.rt
MidPyr2Up.rt
MidPyr3.rt
MidPyr3Up.rt
MidPyr4.rt
MidPyr4Up.rt
MidPyr5.rt
MidPyr5Up.rt
MidPyr6.rt
MidPyr6Up.rt
MidPyr7.rt
MidPyr7Up.rt
Pyr0.rt
Pyr1.rt
Pyr2.rt
Pyr3.rt
Pyr4.rt
Pyr5.rt
Pyr6.rt
Pyr7.rt
Saturation.rt
outputTex.rt
passAdd.frag
passFinal.frag
passPyr.frag
passPyrLast.frag
passSaturation.frag
passValue.frag
algorithmConfig.json
content.json
SeekModeScript.lua
main.scene
curveLutB.material
curveLutG.material
curveLutR.material
curveLutY.material
entity.material
quad.mesh
LUTB.rt
LUTG.rt
LUTR.rt
LUTY.rt
outputTex.rt
scene.config
sticker.config
curveLut.frag
curveLut.vert
curveLutB.xshader
curveLutG.xshader
curveLutR.xshader
curveLutY.xshader
entity.xshader
fshader.frag
c8f7d35058d44b8f093ab66c415aadaa.vert
c8f7d35058d44b8f093ab66c415aadaa.vert
AETools.lua
LumiEffect.lua
LumiObjectExtension.lua
sticker.config
sticker.config
algorithmConfig.json
js-meta.json
scene.config
config.json
ImageBusinessSlider.json
LuaRTTI.MarkGen.lua
sticker.config
colorAdjust.vert
Transform.lua
main.scene
sticker.config
gles2_filter.vert
LuaRTTI.MarkGen.lua
algorithmConfig.json
Utils.lua
graphBuild.lua
renderChain.json
fshader.frag
xshader.xshader
outputTex.rt
sticker.config
.clang-format
fade_max.texture
lightSensation_max.png
lightSensation_max.png.meta
lightSensation_min.png
lightSensation_min.png.meta
lua-meta.json
main.scene
colorAdjust.material
Quad.mesh
FliterEntity-2FFE6ABD.prefab
material.material
colorAdjust.xshader
algorithmConfig.json
filter.xshader
Transform.lua
sticker.config
gles2_filter.vert
config.json
content.json
temperature_max.png
temperature_max.png.meta
temperature_min.png
temperature_min.png.meta
main.scene
entity.material
quad.mesh
outputTex.rt
sticker.config
entity.xshader
LuaRTTI.MarkGen.lua
LumiLayer.lua
layer.material
Quad.mesh
layer.ausl
layer.ausl.compile_hash
layer.xshader
311011f458f3dd960d75dc31e1ae2f74.frag
311011f458f3dd960d75dc31e1ae2f74.vert
311011f458f3dd960d75dc31e1ae2f74.frag
311011f458f3dd960d75dc31e1ae2f74.vert
ScriptCompStrongSharpen.lua
gaussianBlurX.material
gaussianBlurY.material
Quad.mesh
GaussianBlurX.ausl
GaussianBlurX.ausl.compile_hash
GaussianBlurY.ausl
GaussianBlurY.ausl.compile_hash
gaussianBlurX.xshader
gaussianBlurY.xshader
71fab010b241317a21f3fb69cece5d66.frag
71fab010b241317a21f3fb69cece5d66.vert
cfec1e49b8bc51cd4c82ffa5a491b9f5.frag
71fab010b241317a21f3fb69cece5d66.frag
71fab010b241317a21f3fb69cece5d66.vert
cfec1e49b8bc51cd4c82ffa5a491b9f5.frag
LumiSurfaceBlur.lua
pass0.material
Quad.mesh
pass0.ausl
pass0.ausl.compile_hash
pass0.xshader
0ac233a84501b32b765b8ab3da49efcf.frag
0ac233a84501b32b765b8ab3da49efcf.vert
0ac233a84501b32b765b8ab3da49efcf.frag
0ac233a84501b32b765b8ab3da49efcf.vert
LumiUsmSharpen.lua
GaussianBlurX.material
GaussianBlurY.material
Quad.mesh
42e8ccc4174ece2abcb86167e481b52e.vert
6b654fa3ea4d94cd805ef88e6e2fafc3.vert
42e8ccc4174ece2abcb86167e481b52e.vert
6b654fa3ea4d94cd805ef88e6e2fafc3.vert
algorithmConfig.json
eyeBrow.png
eyes.png
mouth.png
LumiExportData.lua
LumiManager.lua
LumiParamsSetter.lua
maskV2FaceU_V2_vrko_1654499499.mesh
gles.frag
gles.vert
mask.xshader
algorithmConfig.json
content.json
filter.png.meta
LumiColorAdjustBundle.lua
airLight.material
colorAdjustBundle.material
darkChannel.material
dehaze.material
surfaceBlur.material
Quad.mesh
airLight.frag
airLight.xshader
colorAdjustBundle.frag
colorAdjustBundle.xshader
darkChannel.frag
darkChannel.xshader
dehaze.frag
dehaze.xshader
surfaceBlur.frag
surfaceBlur.xshader
algorithmConfig.json
LumiExportData.lua
main.scene
LumiTempRT0.rt
LumiTempRT1.rt
outputTex.rt
content.json
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
blend.material
Quad.mesh
NewScreenRT.rt
outputTex.rt
sticker.config
blend.frag
blend.vert
blend.xshader
content.json
content.json
content.json
lua-meta.json
SeekModeScript.lua
main.scene
passAdd1.material
passAdd2.material
passAdd3.material
passAdd4.material
passAdd5.material
passAdd6.material
passAdd7.material
passFinal.material
passPyr0.material
passPyr1.material
passPyr2.material
passPyr3.material
passPyr4.material
passPyr5.material
passPyr6.material
passPyr7.material
passSaturation.material
passValue.material
passAdd.xshader
passFinal.xshader
passPyr.xshader
passPyrLast.xshader
passSaturation.xshader
passValue.xshader
content.json
algorithmConfig.json
lua-meta.json
SeekModeScript.lua
main.scene
colorCorrection.material
Quad.mesh
outputTex.rt
colorCorrection.frag
colorCorrection.xshader
content.json
main.scene
colormigration.material
Quad.mesh
outputTex.rt
sticker.config
colormigration.frag
colormigration.vert
colormigration.xshader
vshader.vert
ImageBusinessSlider.json
algorithmConfig.json
MainSystem.js
bach.js
quhui.js
quhuiFinalMat.material
skinColorMaterial.material
Quad.mesh
sticker.config
color.texture
c8f7d35058d44b8f093ab66c415aadaa.frag
c8f7d35058d44b8f093ab66c415aadaa.frag
skinColor.ausl
LuaRTTI.MarkGen.lua
algorithmConfig.json
content.json
algorithmConfig.json
filter_bg.png
filter_bg.png.meta
ImageBusinessSlider.lua
TempScriptLua.lua
main.scene
GaussianBlurX.material
GaussionBlurY.material
dehaze.material
invert.material
mask_faceuv22994_MATERIAL.material
noface.material
pet_mask.material
Quad.mesh
mask_faceuv22994_mesh.mesh
petMask.mesh
blur.rt
blurMid.rt
gray.rt
highPass.rt
mask.rt
outputTex.rt
mask.png
mask.png.meta
mask_cat.png
mask_cat.png.meta
mask_dog.png
mask_dog.png.meta
colorAdjustBundle.vert
dehaze.frag
dehaze.xshader
gaussianBlurX.frag
gaussianBlurX.xshader
gaussianBlurY.frag
gaussianBlurY.xshader
gles2_anlrol.frag
invert.frag
invert.xshader
mask_faceuv22994_xshader_xshader.xshader
noface.xshader
pet_mask.frag
pet_mask.vert
pet_mask.xshader
quad.frag
fshader.frag
content.json
SeekModeScript.lua
main.scene
entity.material
quad.mesh
outputTex.rt
fshader.frag
algorithmConfig.json
content.json
SeekModeScript.lua
main.scene
noise.material
quad.mesh
outputTex.rt
scene.config
noise.frag
noise.xshader
content.json
SeekModeScript.lua
main.scene
entity.material
quad.mesh
entity.xshader
fshader.frag
content.json
lua-meta.json
SeekModeScript.lua
graphBuild.lua
renderChain.json
main.scene
Quad.mesh
sharp.prefab
fshader.frag
material.material
xshader.xshader
outputTex.rt
content.json
lens_vhdr_image_lut_rgb.raw
BachAlgorithm.lua
main.scene
noface.material
Quad.mesh
outputTex.rt
sticker.config
noface.xshader
quad.frag
quad.vert
ImageBusinessSlider.json
content.json
n1.png
n1.png.meta
n2.png
n2.png.meta
p1.png
p1.png.meta
p2.png
p2.png.meta
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
pass0.material
quad.mesh
outputTex.rt
sticker.config
pass0.frag
pass0.vert
pass0.xshader
ImageBusinessSlider.json
algorithmConfig.json
content.json
lua-meta.json
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
Sprite2D.material
dark_angle.material
noface.material
vignetting.material
Quad.mesh
outputTex.rt
Bow0.texture
Sprite2D.xshader
dark_angle.frag
dark_angle.vert
dark_angle.xshader
gles2_bvcwvg.vert
gles2_yvsong.frag
noface.xshader
quad.frag
vignetting.frag
vignetting.xshader
Alexa LogC to Rec709.cube
config.json
algorithmConfig.json
effect_platform_children.tag
extra.json
config.json
content.json
LumiExtra.material
LumiExtra.mesh
LumiExtra.vert
LumiExtra.xshader
LumiHub.lua
LumiObjectExtension.lua
LumiUtils.lua
LumiRoot.prefab
main.scene
outputTex.rt
filter.xshader
outputTex.rt
ImageBusinessSlider.json
content.json
SeekModeScript.lua
main.scene
GaussX_2.material
GaussX_3.material
GaussX_4.material
GaussY_2.material
GaussY_3.material
GaussY_4.material
blend.material
cameraRawAdjust.material
getGray.material
guideFilter.material
Quad.mesh
sticker.config
GaussX.frag
GaussX.vert
GaussX.xshader
GaussX1.frag
GaussX1.xshader
blend.frag
blend.vert
blend.xshader
cameraRawAdjust.xshader
cameraRawAdjustCore.frag
getGray.frag
getGray.xshader
guideFilter.frag
guideFilter.xshader
config.json
NewScreenRT.rt
NewScreenRT_2.rt
midTex1.rt
midTex2.rt
midTex3.rt
midTex4.rt
midTex5.rt
outputTex.rt
LuaRTTI.MarkGen.lua
content.json
Lscript.lua
main.scene
noface.material
Quad.mesh
outputTex.rt
noface.xshader
lua-meta.json
config.json
outputTex.rt
config.json
jypc_yunfuhua_gpucpu.model
config.json
content.json
3d03e554460899c4cdbbd7fb866a0c3d.vert
3d03e554460899c4cdbbd7fb866a0c3d.vert
algorithmConfig.json
ic_mask_en.png
ic_mask_ms-MY.png
result.vert
Default_eyemazing.material
lips_keypoint_faceu.vert
308.b43e2452.css
524.fa46e101.css
publish-caption-template_page.a1f782d3.css
publish-caption-template_page.dfb75c1c.css
publish-caption-animation.4c732448.css
8454.a6de3549.js
9171.901d2cf2.js
308.bc97a6af.js
357.d91d3ba7.js
publish-filter-collection_page.7ac11e69.js
lib-mobx.55cf97ce.js
lib-polyfill.7f821686.js
2592.746b355a.css
4310.22e66650.css
creator-protocol-dialog.fe774418.css
1967.ad090e4a.js
2050.e826e331.js
4103.19418719.js
1902.a56aa9e0.js
2592.5a08d4d4.js
3241.bbcc6a4f.js
4310.33ceea3d.js
4362.5f13a9c4.js
5758.3445fd06.js
6873.ddb67956.js
775.4e617d9b.js
9214.131b428e.js
9647.d95a9cf4.js
9684.f7f694bf.js
9812.6af08022.js
lib-mobx.4de9db41.js
lib-polyfill.54d61ab1.js
lib-react.c5f5a0fa.js
lib-router.414733ad.js
nestedRoutes.json
2958.efab956f.css
5623.f4f8d62e.js
uploader-oversea-crc32.js
lib-react.a17c0062.js
lib-router.1643cdf7.js
798.beb9e54f.css
publish-text-template_page.688380c0.css
6100.647aa69a.js
658.a5c6157b.js
7131.7b518c3b.js
7241.a9389eb0.js
9039.a8b3e186.js
944.89386550.js
9807.c566dcfa.js
1.269ff1bc.js
313.42005ed9.js
50.3eb35a32.js
5856.35317526.js
589.78270f36.js
6413.ddbc9410.js
798.53bd7975.js
808.8117188a.js
8499.33412857.js
8667.399d4c9d.js
9635.d020c489.js
SeekModeScript.lua
blend.material
Quad.mesh
NewScreenRT.rt
outputTex.rt
scene.config
blend.xshader
video.js
config.json
LumiHub.lua
LumiUtils.lua
185_1.svg
3_4.svg
58.svg
9_16.svg
radius.png
.version
.version
.version
quad.frag
ed71fadce408abd63c3b07027bf0eba6.vert
ed71fadce408abd63c3b07027bf0eba6.vert
tt_matting_v15.0.model
main.js
package_info.json
template.js
version.json
unsupported-material.jpg
config.json
heycanInfo.json
infoSticker.lua
heycanInfo.json
infoSticker.lua
CapCut.exe
EffectPlatform.dll
FusionUI.dll
Qt6Concurrent.dll
Qt6Core.dll
Qt6Core5Compat.dll
Qt6Gui.dll
Qt6Network.dll
Qt6Qml.dll
Qt6Quick.dll
Qt6QuickControls2.dll
Qt6Widgets.dll
LumiManager.lua
algorithmConfig.json
content.json
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
outputTex.rt
skinColor.rt
skinMask.texture
transmission.texture
quhui.ausl
quhuiFinal.xshader
8ce38ad7863240b0a23e8492454e2a77.frag
8ce38ad7863240b0a23e8492454e2a77.vert
8ce38ad7863240b0a23e8492454e2a77.frag
8ce38ad7863240b0a23e8492454e2a77.vert
skinColor.xshader
content.json
GaussianBlurX.ausl
GaussianBlurX.ausl.compile_hash
GaussianBlurX.xshader
GaussianBlurY.ausl
GaussianBlurY.ausl.compile_hash
GaussianBlurY.xshader
42e8ccc4174ece2abcb86167e481b52e.frag
6b654fa3ea4d94cd805ef88e6e2fafc3.frag
42e8ccc4174ece2abcb86167e481b52e.frag
6b654fa3ea4d94cd805ef88e6e2fafc3.frag
eyeBrow.png.meta
eyes.png.meta
lua-meta.json
main.scene
mask_faceuv2.material
LumiTempRT0.rt
LumiTempRT1.rt
mask123.rt
outputTex.rt
SeekModeScript.lua
algorithmConfig.json
Feature.js
a42a210f47a968c9a8da0de7bd569211.zip
config.json
lua-meta.json
Lscript.lua
quad.frag
combine_adjust.textClipping
content.json
filter.material
brightness.texture
gles2_filter.frag
content.json
brightness_max.png
brightness_min.png
filter.material
gles2_filter.frag
ImageBusinessSlider.json
content.json
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
brightness.material
pass1.material
quad.mesh
outputTex.rt
brightness.frag
pass1.frag
pass1.vert
pass1.xshader
algorithmConfig.json
config.json
content.json
lua-meta.json
SeekModeScript.lua
main.scene
passAdd1.material
passAdd2.material
passAdd3.material
passAdd4.material
passAdd5.material
passAdd6.material
passAdd7.material
passFinal.material
passPyr0.material
passPyr1.material
passPyr2.material
passPyr3.material
passPyr4.material
passPyr5.material
passPyr6.material
passPyr7.material
passSaturation.material
passValue.material
passAdd.xshader
passFinal.xshader
passPyr.xshader
passPyrLast.xshader
passSaturation.xshader
passValue.xshader
algorithmConfig.json
config.json
Feature.js
algorithmConfig.json
content.json
main.scene
outputTex.rt
sticker.config
config.json
extra.json
config.json
content.json
filter.material
contrast.texture
filter.xshader
gles2_filter.frag
config.json
content.json
lua-meta.json
SeekModeScript.lua
main.scene
Quad.mesh
FliterEntity-2FFE6ABD.prefab
material.material
config.json
content.json
SeekModeScript.lua
config.json
content.json
SeekModeScript.lua
fshader.frag
colorAdjust.frag
config.json
content.json
filter.material
outputTex.rt
fade_max.texture
gles2_filter.frag
config.json
content.json
filter.material
outputTex.rt
hightlight_max.texture
filter.xshader
gles2_filter.frag
content.json
highlight_max.png
highlight_min.png
main.scene
filter.material
outputTex.rt
filter.xshader
gles2_filter.frag
SeekModeScript.lua
fshader.frag
config.json
SeekModeScript.lua
config.json
content.json
main.scene
filter.material
outputTex.rt
filter.xshader
gles2_filter.frag
config.json
content.json
GaussianBlurX.ausl
GaussianBlurX.ausl.compile_hash
GaussianBlurX.xshader
GaussianBlurY.ausl
GaussianBlurY.ausl.compile_hash
GaussianBlurY.xshader
42e8ccc4174ece2abcb86167e481b52e.frag
6b654fa3ea4d94cd805ef88e6e2fafc3.frag
42e8ccc4174ece2abcb86167e481b52e.frag
6b654fa3ea4d94cd805ef88e6e2fafc3.frag
eyeBrow.png.meta
eyes.png.meta
mouth.png.meta
lua-meta.json
ImageBusinessSlider.lua
main.scene
mask_faceuv2.material
LumiTempRT0.rt
LumiTempRT1.rt
mask123.rt
outputTex.rt
LumiManager.lua
curveLut.frag
fshader.frag
content.json
lua-meta.json
ImageBusinessSlider.lua
SeekModeScript.lua
main.scene
outputTex.rt
skinColor.rt
skinMask.texture
transmission.texture
quhui.ausl
quhui.ausl.compile_hash
quhuiFinal.xshader
8ce38ad7863240b0a23e8492454e2a77.frag
8ce38ad7863240b0a23e8492454e2a77.frag
skinColor.ausl.compile_hash
skinColor.xshader
SeekModeScript.lua
algorithmConfig.json
Feature.js
config.json
content.json
filter.material
gles2_filter.frag
config.json
SeekModeScript.lua
noise.frag
config.json
SeekModeScript.lua
config.json
content.json
filter.material
saturation.texture
gles2_filter.frag
config.json
ImageBusinessSlider.json
content.json
ImageBusinessSlider.lua
main.scene
noface.material
Quad.mesh
outputTex.rt
sticker.config
noface.xshader
quad.frag
config.json
filter.material
outputTex.rt
gles2_filter.frag
config.json
ImageBusinessSlider.lua
NewScreenRT.rt
NewScreenRT_2.rt
midTex1.rt
midTex2.rt
midTex3.rt
midTex4.rt
midTex5.rt
outputTex.rt
ImageBusinessSlider.lua
LuaRTTI.MarkGen.lua
algorithmConfig.json
content.json
lua-meta.json
ScriptComp.lua
main.scene
HighlightShadow.material
HighlightShadow.mesh
outputTex.rt
HighlightShadow.frag
HighlightShadow.xshader
config.json
ImageBusinessSlider.lua
SeekModeScript.lua
content.json
filter.material
outputTex.rt
filter.xshader
gles2_filter.frag
config.json
SeekModeScript.lua
algorithmConfig.json
config.json
extra.json
content.json
filter.material
outputTex.rt
temperature.texture
filter.xshader
gles2_filter.frag
config.json
quad.frag
config.json
quad.frag
content.json
filter.material
hue.texture
filter.xshader
gles2_filter.frag
content.json
hue_max.png
hue_max.png.meta
hue_min.png
hue_min.png.meta
main.scene
filter.material
outputTex.rt
filter.xshader
gles2_filter.frag
content.json
anjiao.png
main.scene
filter.material
outputTex.rt
filter.xshader
gles2_filter.frag
config.json
lua-meta.json
SeekModeScript.lua
main.scene
vignetting.material
Quad.mesh
outputTex.rt
vignetting.frag
vignetting.xshader
algorithmConfig.json
config.json
MainSystem.js
bach.js
content.json
blurmask.png
blurmask.png.meta
global.lua
main.scene
noface.material
Quad.mesh
outputTex.rt
sticker.config
noface.xshader
quad.frag
quad.vert
algorithmConfig.json
config.json
effect_platform_children.tag
event.lua
seguiemj.ttf
CapCutSansText-Bold.otf
CapCutSansText-Medium.otf
CapCutSansText-Regular.otf
NotoSans-Regular.ttf
NotoSansArabic-Regular.ttf
NotoSansBengali-Regular.ttf
NotoSansHebrew-Regular.ttf
NotoSansKhmer-Regular.ttf
NotoSansMyanmar-Regular.ttf
NotoSansSymbols2-Regular.ttf
NotoSansThai-Regular.ttf
SourceSerif4_18pt-BoldItalic.ttf
en.ttf
ja.ttf
ko.ttf
th.ttf
zh-hans.ttf
zh-hant.ttf
5ccf14a16ee408733fb178d87473b43b.frag
5ccf14a16ee408733fb178d87473b43b.frag
anim.prefab
blend.material
blend.xshader
a7f18cbf37004a23627033ba8c8b047f.frag
a7f18cbf37004a23627033ba8c8b047f.frag
anim.prefab
blend.material
blend.xshader
3d03e554460899c4cdbbd7fb866a0c3d.frag
3d03e554460899c4cdbbd7fb866a0c3d.frag
anim.prefab
blend.material
blend.xshader
b99ebb584046179bb1065d96eec3fb18.frag
b99ebb584046179bb1065d96eec3fb18.frag
anim.prefab
blend.material
blend.xshader
12fb74826a380d88a276dfa92fc2a18b.frag
12fb74826a380d88a276dfa92fc2a18b.frag
anim.prefab
blend.material
blend.xshader
MixMode.json
b56b2792e75fcde177ffb61953d3eee9.frag
b56b2792e75fcde177ffb61953d3eee9.frag
anim.prefab
blend.material
blend.xshader
9ccd87af6addcf1c9c1367a68476c995.frag
9ccd87af6addcf1c9c1367a68476c995.frag
anim.prefab
blend.material
blend.xshader
d8eaa90b50d0c0a335da3aaf63f195cd.frag
d8eaa90b50d0c0a335da3aaf63f195cd.frag
anim.prefab
blend.material
blend.xshader
d4996a43d654ddc6f35303ed57ebf295.frag
d4996a43d654ddc6f35303ed57ebf295.frag
anim.prefab
blend.material
blend.xshader
c9a94909777c82671f59e28db667c4ba.frag
c9a94909777c82671f59e28db667c4ba.frag
anim.prefab
blend.material
blend.xshader
VEConfig.dll
VEDetector.exe
VESafeGuard.dll
bytebench.dll
bytebenchsdk.dll
clipflow_sdk.dll
eh_core_dump_2026-08-16_04-31-25-066.dmp
ever_cloud_sdk.dll
lynx.dll
lyra_cli_client.dll
msvcp140.dll
msvcp140_1.dll
nuro.dll
parfait_crash_handler.exe
pc_push.dll
ttdaemon.exe
uploader.dll
vcruntime140.dll
vcruntime140_1.dll
CapCut.exe
Configure.ini
ProductInfo.xml
data_0
data_1
data_2
data_3
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity~RFe5ce8b2.TMP
LocalPrefs.json
LocalPrefs.json~RFe5cfb40.TMP
publish-audio-effect_page.6f53ab70.css
publish-video_page.0814a14f.css
23.49d6567d.js
249.19c46e16.js
332.b4cad84e.js
619.e1d5033a.js
684.024d0155.js
707.b6182fa7.js
742.da5f0bda.js
182.288128f5.js
184.9f1a6bbe.js
357.bfa2c871.js
367.f3893993.js
40.e582a6f2.js
414.b89e5def.js
686.3fbf1c4d.js
797.70316746.js
publish-audio-effect_page.36db3704.js
publish-caption-animation_page.eff3b18a.js
publish-caption-template_page.5c6a611e.js
publish-effects_page.cb13cff0.js
publish-filter-collection_page.0dd65678.js
publish-filter-single_page.be8c2c43.js
publish-text-animation_page.de93c85f.js
publish-video_page.f3c7a042.js
uploader-oversea-crc32.js
lib-mobx.ce29c208.js
lib-polyfill.88f2de10.js
9647.8bcbe6ba.css
creator-protocol-dialog_page.d6a2c6a5.css
sticker-publish-collection_page.dac28c5b.css
sticker-publish-single_page.20ec0e6e.css
2648.806d30e8.js
2825.37deaf9f.js
667.ea47b63f.js
sticker-publish-collection_page.fb414ef5.js
sticker-publish-single_page.498bd0df.js
publish-text-effect_page.e5014369.js
publish-text-effect.7ab3135c.js
nestedRoutes.json
2711.b4121d4f.js
4103.19418719.js
2592.5a08d4d4.js
4310.33ceea3d.js
5173.e27ef758.js
5758.3445fd06.js
publish-subtitle-template_page.a1f50b06.js
publish-text-template-collection_page.d28b74dd.js
publish-text-template_page.0ebea921.js
lib-react.c5f5a0fa.js
lib-router.414733ad.js
publish-subtitle-template.5f03e3ed.js
publish-text-template.7b15d972.js
c279a574-ae08-4a08-be52-a23b0c539e06.mp4
SP_Quad.mesh
lua-meta.json
LuaRTTI.MarkGen.lua
sticker.config
LumiManager.lua
LumiObjectExtension.lua
LumiParamsSetter.lua
midRT.rt
config.json
config.json
algorithmConfig.json
config.json
config.json
algorithmConfig.json
algorithmConfig.json
algorithmConfig.json
config.json
mask_faceu_xshader.xshader
eyeline.png.meta
makeup.prefab
Eyeline.material
eyeline_faceu_mesh.mesh
eye_part_faceu_xshader.xshader
eyemazingScreen.png
face3d.frag
lips_keypoint_faceu.frag
makeup3dMesh4.mesh
pupil_mask.png.meta
pupil_normal.png.meta
pupil_screen.png.meta
makeup.lua
makeup.prefab
Pupil.material
PupilCutoff.material
pupil_cutoff_faceu_mesh.mesh
pupil_main_faceu_mesh.mesh
pupil_cutoff_faceu.frag
pupil_cutoff_faceu_xshader.xshader
pupil_main_faceu.frag
pupil_main_faceu.vert
pupil_main_faceu_xshader.xshader
makeup3dLipPoutEnvironmentMask2_laxx_1665303912.png
makeup3dLipPoutEnvironmentMask_ysjn_1665303912.png
lipGloss.png
eyemazing.png
blit.frag
blit.vert
face3d.vert
fd_withMask_pos.vert
fd_withMask.frag
fd_withMask.frag
fd_withMask_neg.frag
stereo.png.meta
makeup.prefab
Stereo_MATERIAL.material
stereo_faceu_mesh.mesh
highlight_khgp_1655297390.png
scene.config
face_makeup_gloss_b013b9bd7c52631240d507e14cde9678.vert
face_makeup_gloss_fcb3990da7c5f3ea43b8db92c1da62ea.frag
fd_withoutMask.frag
fd_withoutMask.vert
mask_faceuv22986.frag
mask_faceuv22986.vert
mask_faceuv22994.frag
mask_faceuv22994.vert
algorithmConfig.json
51c7d4646423fff2ccfbc3314150b43c_tmp_dtm.594699
blusher.png.meta
highlight.png
highlight.png.meta
makeup.lua
makeup.prefab
Blusher_MATERIAL.material
blusher_faceu_mesh.mesh
mask_faceu.frag
none.png
none.png.meta
makeup.lua
Blit.material
Default.material
Default_blusher.material
Default_eyelash.material
Default_eyeline.material
Default_eyeshadow.material
Default_lip.material
Default_pupil.material
Default_pupilcutoff.material
Default_stereo.material
Face3D.material
face3d.frag
face3d.xshader
highlight.png
makeup3d_ydku_1658219217.png
pupilBlend.png
makeup.png
Blit_MATERIAL.material
Face3D_MATERIAL.material
PupilCutoff_MATERIAL.material
Quad.mesh
blusher_faceu_mesh.mesh
brow_faceu_mesh.mesh
eyelash_faceu_mesh.mesh
eyeline_faceu_mesh.mesh
eyemazing_faceu_mesh.mesh
eyeshadow_faceu_mesh.mesh
face3d0_mesh.mesh
face3d1_mesh.mesh
face3d2_mesh.mesh
face3d3_mesh.mesh
face3d4_mesh.mesh
lips_keypoint_faceu_mesh.mesh
pupil_cutoff_faceu_mesh.mesh
pupil_main_faceu_mesh.mesh
stereo_faceu_mesh.mesh
output2d.rt
outputTex.rt
blit_xshader.xshader
brow_faceu_xshader.xshader
eye_part_faceu_xshader.xshader
face3d_xshader.xshader
mask_faceu_xshader.xshader
pupil_main_faceu_xshader.xshader
highlight_khgp_1655297390.png.meta
makeup.prefab
Highlight.material
fdx.vert
eyebrow.png.meta
makeup.lua
makeup.prefab
Brow.material
brow_faceu_mesh.mesh
brow_faceu.frag
brow_faceu_xshader.xshader
scene.config
sticker.config
fd_withoutMask.vert
2672ec7924b75f536446626369fd680b_tmp_dtm.597909
fDShader_negative.vert
fDShader_positive.vert
fDShader_positive.frag
fDShader_negative.vert
fDShader_negative.frag
fDShader_positive.vert
makeup3dLipPoutNormal_zilf_1665303912.png
wry_eye_left_mask.png
fd_withMask_neg.frag
eye_part_faceu.frag
main.scene
Face145_mesh.mesh
outputTex.rt
scene.config
eye_part_faceu_xshader.xshader
mask_faceu_xshader.xshader
pupil_main_faceu_xshader.xshader
pupilMask.png
FaceAlgorithm.lua
maskFace.material
maskFace.mesh
maskCamera.prefab
output_makeup.rt
face.frag
face.vert
face.xshader
brow_faceu.frag
pupil_main_faceu.frag
eye_part_faceu_xshader.xshader
freckles.png.meta
makeup.prefab
Freckles.material
blusher.png.meta
highlight.png.meta
eyebrow.png.meta
eyelash.png.meta
eyeline.png.meta
eyemazing.png.meta
eyemazingScreen.png.meta
eyeshadow.png.meta
eyeshadowScreen.png.meta
highlight_khgp_1655297390.png.meta
makeup3dLipPoutEnvironment2_advj_1665303912.png.meta
makeup3dLipPoutEnvironmentMask2_laxx_1665303912.png.meta
makeup3dLipPoutEnvironmentMask_ysjn_1665303912.png.meta
makeup3dLipPoutEnvironment_mfgl_1665303912.png.meta
makeup3dLipPoutNormal_zilf_1665303912.png.meta
lipClose.png.meta
lipGloss.png.meta
lipOpen.png.meta
makeup3d_ydku_1658219217.png.meta
pupilBlend.png.meta
pupilMask.png.meta
makeup.png.meta
stereo.png.meta
main.scene
Blusher_MATERIAL.material
Brow_MATERIAL.material
Eyelash_MATERIAL.material
Eyeline_MATERIAL.material
Eyemazing_MATERIAL.material
Eyeshadow_MATERIAL.material
Lip_MATERIAL.material
Pupil_MATERIAL.material
Stereo_MATERIAL.material
lips_keypoint_faceu_xshader.xshader
pupil_cutoff_faceu_xshader.xshader
algorithmConfig.json
lipClose.png.meta
lipOpen.png.meta
lipClose.png.meta
lipOpen.png.meta
lipClose.png
lipClose.png.meta
lipOpen.png
lipOpen.png.meta
makeup.prefab
default.material
default.material
default.material
lips_keypoint_faceu_mesh.mesh
lips_keypoint_faceu_xshader.xshader
lips_keypoint_faceu_xshader.xshader
lips_keypoint_faceu_xshader.xshader
LuaRTTI.MarkGen.lua
fDShader_positive.frag
fDShader_positive.vert
eyeline.png
makeup.lua
face3d3_mesh.mesh
lips_keypoint_faceu_mesh.mesh
liquefy.lua
main.scene
FDV6WithMask_0.material
FDV6WithMask_1.material
FDV6WithMask_2.material
FDV6WithMask_3.material
FDV6WithMask_4.material
FDV6WithMask_5.material
FDV6WithMask_6.material
FDV6WithMask_7.material
FDV6WithMask_8.material
FDV6WithMask_9.material
TouchCircle.material
offsetMapBlurH.material
offsetMapBlurV.material
offsetMapGen.material
Quad.mesh
face0Offset.rt
face1Offset.rt
face2Offset.rt
face3Offset.rt
face4Offset.rt
face5Offset.rt
face6Offset.rt
face7Offset.rt
face8Offset.rt
face9Offset.rt
offsetMap.rt
outputTex.rt
FacialMask.png
FacialMask.png.meta
LiquefyMask.png
LiquefyMask.png.meta
FDV6WithMask.xshader
TouchCircle.xshader
fd_withMask.frag
fd_withMask.vert
offsetMapBlur.vert
offsetMapBlurH.frag
offsetMapBlurH.xshader
offsetMapBlurV.frag
offsetMapBlurV.xshader
offsetMapGen.frag
offsetMapGen.vert
offsetMapGen.xshader
touchCircle.frag
touchCircle.vert
fdx.vert
6870364c894073278208be96f04e1055_tmp_dtm.21726
lipOpen.png
lips_keypoint_faceu_xshader.xshader
fdx.frag
reshapeV5_single.frag
5c5f33121388d6155de7c8c3f80117a2_tmp_dtm.15403
eyeshadow.png.meta
eyeshadowScreen.png.meta
makeup.prefab
default.material
eyeshadow_faceu_mesh.mesh
b1c6f6201f7726196688b12d27ef5544_tmp_dtm.15695
eyelash.png.meta
makeup.prefab
default.material
eyelash_faceu_mesh.mesh
config.json
sticker.config
sticker.config
gles2_blit.vert
makeup.lua
brow_faceu.vert
pupil_cutoff_faceu.frag
pupil_cutoff_faceu.vert
pupil_main_faceu.vert
sticker.config
blusher.png.meta
highlight.png.meta
eyebrow.png.meta
eyelash.png.meta
eyeline.png.meta
eyemazing.png.meta
eyemazingScreen.png.meta
eyeshadow.png.meta
eyeshadowScreen.png
eyeshadowScreen.png.meta
lipClose.png.meta
lipGloss.png
lipGloss.png.meta
lipOpen.png.meta
pupilBlend.png.meta
pupilMask.png.meta
stereo.png.meta
main.scene
Blusher_MATERIAL.material
Brow_MATERIAL.material
Eyelash_MATERIAL.material
Eyeline_MATERIAL.material
Eyemazing_MATERIAL.material
Eyeshadow_MATERIAL.material
Lip_MATERIAL.material
PupilCutoff_MATERIAL.material
Pupil_MATERIAL.material
Stereo_MATERIAL.material
blusher_faceu_mesh.mesh
brow_faceu_mesh.mesh
eyelash_faceu_mesh.mesh
eyeline_faceu_mesh.mesh
eyemazing_faceu_mesh.mesh
eyeshadow_faceu_mesh.mesh
lips_keypoint_faceu_mesh.mesh
pupil_cutoff_faceu_mesh.mesh
pupil_main_faceu_mesh.mesh
stereo_faceu_mesh.mesh
outputTex.rt
brow_faceu_xshader.xshader
lips_keypoint_faceu_xshader.xshader
pupil_cutoff_faceu_xshader.xshader
highlight.png
algorithmConfig.json
algorithmConfig.json
filter_bg.png
mask.png
EffectFaceMakeup.lua
maskV2FaceU.material
skinSeg.material
Quad.mesh
maskV2FaceU.mesh
mask.rt
renderOutput.rt
sticker.config
filter_skin.png
mask.frag
mask.vert
mask.xshader
skinSeg.frag
skinSeg.vert
skinSeg.xshader
algorithmConfig.json
ImageBusinessSlider.json
sticker.config
aec44k_v1.2_size0_md5d3db6e2307b73d7432e892bb793c31cf.model
aed40_10m_v1.0_size0_md52adca481f477a315f27b684f6a7140a6.model
cc_auto_beauty_simo_script_v2.1_size0_md5e1beb65d7312244b50a46bf1ec54ede0.model
cc_yunfeng_js_v1.1_size0_md58b4dcd3dce933212926e395b4a813f92.model
cc_yunfeng_v1.0_size0_md5b9e28561f63c8549c3a724434bfa025d.model
custom_lockon_v1.0_size0_md57703caee3fd0ba5b7ae29333ed06f6e6.model
custom_region_v2.0_size0_md54aed5332509e087b6054a0b88c8f374c.model
eur_new_v1.0_size2_md5c19b861e535defd71193c0278204c45f.model
lens_ii_auto_color_map_v1.0_size0_md52cd07ace080c7dcea626ac9c1d41a915.model
lens_ii_auto_color_ros_kernel_v1.0_size0_md50a6f68d17608eee4953ad17816babcee.model
lock_key_point_v1.0_size0_md56ea06c229865e967a36929ecd65b77c5.model
lock_obj_det_v1.0_size0_md55c70ca5313fbd999cb2dd9d54be3732d.model
mask_post_process_v1.0_size0_md5592d7737e1ab8df68fb440a804a6edcd.model_dtm.51032
newbandou_remove_script_v1.0_size0_md5b486dbd567a781b600ef8eb84c8b664e.model
newbandou_v1.0_size5_md55fc89a8ac6262038e4d054d198e080e5.model
nh_smartmotion_v3.0_size0_md5425d5151c795893f2a8ba7609bca379f.model
saliency_matting_v1.0_size0_md55882cbfb5e9c1f205cd599d3c5d0833a.model_dtm.7066590
saliency_script_for_cc_v1.2_size0_md57b5c3cdeb513b9e4d65f0e3fd5909100.model
single_object_tracking_v1.0_size0_md5d0b0e377347d69bacef2473f5bae4799.model_dtm.627511
skinunified_v1.0_size0_md53d9f40470eed902719f291fb4f7fad83.model_dtm.1945540
tt_avatar_drive_v1.0_size0_md5544b5bb2c63bffb792e3e79a967a1a62.model_dtm.624364
tt_body_detection_lockon_v1.0_size0_md58d1b2ea2ca03dedd6afd0fbb959c7cf3.model
tt_face_extra_fast_v14.0_size0_md50f716c0e5bf5d90a25ea051ebafc8ae4.model
tt_face_extra_v15.0_size47_md5e172bbbecd816501be9ca786472b5671.model
tt_face_v11.1_size0_md58572969b01c3ca4b84b7078b3d9bde0a.model
tt_facefitting1220_v2.0_size0_md55ef72a364cb25d9e729fc80b0cba27f6.model_dtm.549366
tt_facefitting1256_v2.0_size0_md5fffe6eddf140be723d9256df98cf6122.model_dtm.659938
tt_facefitting845_v2.1_size0_md5b9083f941a17c73c42bf98ce1c662f00.model
tt_facefitting_3d_v6.3_size4_md5cf68ecca4d74448fa05801cc5594b70d.model
tt_freid_v2.0_size0_md58a6f6a1c942d1241256e71eb3c56f154.model_dtm.12389297
tt_fsnew_base_jianying_v2.0_size12_md557727b34f2f63f68bb4f0c1003d014f3.model
tt_matting_video_gru_v1.0_size1_md5189a7adb1121316ab231ba6b7b3e0260.model
tt_matting_video_v1.2_size6_md53d483565757bd96185debaa2ba07e7ba.model_dtm.5913922
tt_petface_v5.2_size0_md5623dfe1589675c0ec4e565ae3c4111cb.model_dtm.1081486
tt_skeleton_v9.2_size0_md5e3719cc754749796c500b35e73120ed5.model_dtm.400587
tt_skeletonlockon_v1.0_size0_md57b0bc7e4ec901ba6ae049556b5e22824.model
tt_skeletonsquat_v10.0_size6_md5b3e8658226bb8b32008a240c1526d0a7.model
tt_skin_seg_hypic_backlight_v1.0_size0_md5e44e98b5029806fb31b0329c6edda716.model
tt_skin_seg_v5.1_size4_md586a2d8254e982e11fbf0ff44f2942e27.model
material_preupload_local_config.json
beauty_panels_en.ini.NXjdWB
beauty_panels_en.ini.QpHpdi
camera_tracking.ini
complex_video_mask.ini
complex_video_mask.ini.RiECJa
complex_video_mask.ini.TmPLyb
complex_video_mask.ini.WEHLol
segment_js_config.ini
segment_js_config.ini.wIkGxk
channel
commonSetting.ini
commonSetting.ini.NBLJea
commonSetting.ini.PHpYrp
commonSetting.ini.SEjije
commonSetting.ini.XerkXv
commonSetting.ini.fNexRB
commonSetting.ini.jDDFqt
commonSetting.ini.ktfZtH
commonSetting.ini.oSloAf
fission.ini
fission.ini.vqSwSV
globalSetting
globalSetting
globalSetting.FLMOuj
highlight_penetrate.ini
highlight_penetrate.ini.dgDbxE
language_setting
language_setting.XhEsec
language_setting.lock
looki_settings
looki_settings.lock
vesdk.ini
vesdk.ini.lock
attachment_id_mapping.json
draft_content.json
template-2.tmp
project.json
mouth.png.meta
brightness.xshader
fshader.frag
Transform.lua
content.json
shadow_max.texture
filter.xshader
content.json
local_prefs.json
local_prefs.json
local_prefs.json~RFe5b3a85.TMP
tt_net_config.config
tt_net_config.config
tt_net_config.config
tt_net_config.config
blocklist
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
692ba66d-d519-4c54-a28c-02086106b8be.dmp
settings.dat
settings.dat
46a93e9c-ca5b-40d2-9fe5-4abd99f3d78f.tmp
LOG.old
LOG.old
LOG.old
MANIFEST-000001
the-real-index
the-real-index~RFe5d53df.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Secure Preferences
temp-index
the-real-index~RFe617e95.TMP
index.txt
sync_diagnostic.log
domain_actions.dll
OperationConfig
OperationConfig~RFe5db0f3.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
787e7e84-94c8-4676-8ace-024008cae68e.tmp
7zip.dll
b7cff0d4-897d-409b-8248-28b5eec6afd7.tmp
bd36ffb1-a516-458b-9ae9-789e28508035.tmp
BgWorker.dll
System.dll
downloader_nsis_plugin.dll
shell_downloader.dll
content_new.js
35feeb36-b0ba-42fe-98c0-d4c11595c0bb.tmp
gpuSupport.ini
ve_hw_check.ini
vesdk.ini
memory/588-21727-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/588-21772-0x000001C3D2CB0000-0x000001C3D3CB0000-memory.dmp
memory/588-21728-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/1188-21769-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/1188-21770-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/2020-22048-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/2020-22072-0x0000023D1CEF0000-0x0000023D1DEF0000-memory.dmp
memory/2020-22047-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/2140-21984-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/2140-21985-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/2492-21986-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/2492-21987-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/3196-22360-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22351-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22023-0x00007FFFD19E0000-0x00007FFFD2B54000-memory.dmp
memory/3196-22021-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/3196-22325-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22326-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22081-0x00007FFF90850000-0x00007FFF90860000-memory.dmp
memory/3196-22084-0x000002179E350000-0x000002179E550000-memory.dmp
memory/3196-22082-0x000002179DF10000-0x000002179E350000-memory.dmp
memory/3196-22327-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22329-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22365-0x000002179FD00000-0x000002179FD01000-memory.dmp
memory/3196-22364-0x000002179FD00000-0x000002179FD01000-memory.dmp
memory/3196-22363-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22362-0x000002179FD00000-0x000002179FD01000-memory.dmp
memory/3196-22020-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/3196-22359-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22328-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22358-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22357-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22356-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22355-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22018-0x00007FFFB4970000-0x00007FFFB4980000-memory.dmp
memory/3196-22354-0x000002179FCF0000-0x000002179FCF1000-memory.dmp
memory/3196-22352-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22026-0x0000021785DA0000-0x0000021786DA0000-memory.dmp
memory/3196-22350-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22349-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22348-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22347-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22346-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22345-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22344-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22343-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22342-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22341-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22340-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22339-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22338-0x000002179FCE0000-0x000002179FCE1000-memory.dmp
memory/3196-22336-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22335-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22334-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22019-0x00007FFFB4970000-0x00007FFFB4980000-memory.dmp
memory/3196-22333-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22330-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22332-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/3196-22331-0x000002179FCD0000-0x000002179FCD1000-memory.dmp
memory/4620-21670-0x00007FFFD5330000-0x00007FFFD57FB000-memory.dmp
memory/4620-21624-0x00007FFFB4970000-0x00007FFFB4980000-memory.dmp
memory/4620-21671-0x000002C91F1C0000-0x000002C9201C0000-memory.dmp
memory/4620-21669-0x00007FFFD5EE0000-0x00007FFFD6489000-memory.dmp
memory/4620-21623-0x00007FFFB4970000-0x00007FFFB4980000-memory.dmp