Overview

overview

7

Static

static

3

LiquidLaun...US.msi

windows10-2004-x64

7

LiquidLaun...US.msi

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 22:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LiquidLauncher_0.6.1_x64_en-US.msi
  • Size 9.6MB
  • Sample260908-2pn6jayeqb
  • SHA256 c9e08018574191c83413a66d709a439e34b9911b2964de219dce2d97a0ac7e72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 14 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 26 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\LiquidLauncher_0.6.1_x64_en-US.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Program Files\LiquidLauncher\liquidlauncher.exe
      "C:\Program Files\LiquidLauncher\liquidlauncher.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Modifies trusted root certificate store through registry
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5208
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5208.1800.4931658337407817337 /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView /prefetch:4 /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbad905fd8,0x7ffbad905fe4,0x7ffbad905ff0
          4⤵
            PID:5980
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,1540000430497844627,9896949404560829,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f
            4⤵
              PID:1472
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2240 --field-trial-handle=1804,i,1540000430497844627,9896949404560829,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f
              4⤵
                PID:4508
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2632 --field-trial-handle=1804,i,1540000430497844627,9896949404560829,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f
                4⤵
                  PID:4820
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3256 --field-trial-handle=1804,i,1540000430497844627,9896949404560829,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f /prefetch:1
                  4⤵
                    PID:3408
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView" --webview-exe-name=liquidlauncher.exe --webview-exe-version=0.6.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4712 --field-trial-handle=1804,i,1540000430497844627,9896949404560829,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:547281418f4107e286430cacadfceb152897fb2f /prefetch:1
                    4⤵
                      PID:3128
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4464
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 45B56DD8DE2EB81B1F7B654B0ECAC6A3 C
                  2⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:1376
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  2⤵
                    PID:4728
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Checks SCSI registry key(s)
                  PID:2892

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e5a41be.rbs
                      • Path C:\Config.Msi\e5a41be.rbs
                      • Size 10KB
                      • SHA256 50615c048432ac142af54ac401a8ee3f04ecbe8dc1a017627ed139b0ebef0f58
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      liquidlauncher.exe
                      • Path C:\Program Files\LiquidLauncher\liquidlauncher.exe
                      • Size 19.8MB
                      • SHA256 d87cf4b9d4080323b2390ef9387535a029583c7868ed0b77cd0d95d0f290ad10
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      LiquidLauncher.lnk
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiquidLauncher\LiquidLauncher.lnk
                      • Size 2KB
                      • SHA256 e4e8ed535ec11f87a476c7477fda4ed9107fd71a8fcfffa4c29cc92a363f3534
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      LiquidLauncher.lnk~RFe5a5fc5.TMP
                      • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LiquidLauncher\LiquidLauncher.lnk~RFe5a5fc5.TMP
                      • Size 1KB
                      • SHA256 3c56d507ba72e6e30abf6f341587f296018ed3767f3a322d4e26803c5be2bf97
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSIF543.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\MSIF543.tmp
                      • Size 132KB
                      • SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 061923dfd9ea96e1ddc29beed2a9c5efdf8c4ad644f7b35f6bddc0725f791087
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 9e297bf2553ab950dec74f984a5877c145fac4c20d8cf0272ebf15fc3b50ed4e
                      • MD5 SHA1 SHA512
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad\settings.dat
                      • Size 280B
                      • SHA256 9b7ff0054c77ed68fc81072f6ab7d7ef000d97428cd9def10ec4f9ad5c6af1be
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      throttle_store.dat
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Crashpad\throttle_store.dat
                      • Size 20B
                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                      • MD5 SHA1 SHA512
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 72B
                      • SHA256 62e4635d8a4d747e553abcdf9859a755d5e4e37f359617781552b71083c59815
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                      • Size 600B
                      • SHA256 8dfb460f1eb18d92610e153fde8b178b6baf2d9f033954d02145cf6e45be4704
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      the-real-index~RFe5ad36e.TMP
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5ad36e.TMP
                      • Size 48B
                      • SHA256 1cbc6ef19e90c32f6ae22d5255a932a3f8074acb697d885df0a4afcc5cb66f66
                      • MD5 SHA1 SHA512
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Extension Rules\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      SCT Auditing Pending Reports
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\SCT Auditing Pending Reports
                      • Size 2B
                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                      • MD5 SHA1 SHA512
                      Submit Download

                      TransportSecurity
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\TransportSecurity
                      • Size 355B
                      • SHA256 5b510c7c63d30b66e17e5fba8f53724ee22fa5512a4f6ed68fd6dc41c811a3b7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      TransportSecurity
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\TransportSecurity
                      • Size 355B
                      • SHA256 6621d67828803e05a09e6b01eaa4ff11d874f3ec0ca0229b206b99103741a5f5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      TransportSecurity~RFe5b0125.TMP
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Network\TransportSecurity~RFe5b0125.TMP
                      • Size 188B
                      • SHA256 c4c340f157a01cefc6ab2bfd32fdbf34c7d17647d4f53fa33e1d99ab4d2ee007
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Preferences
                      • Size 6KB
                      • SHA256 8dd1417524ae2b092d77e36f1a113b943aa2c9ff117f37541e7042a0fbb9f2e4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Preferences
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Preferences
                      • Size 7KB
                      • SHA256 d6442962475fc8af3e70d8665581bac397ce74a40aa06ddc52411a543c8afc29
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Preferences~RFe5affed.TMP
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Preferences~RFe5affed.TMP
                      • Size 6KB
                      • SHA256 4e6cccd34906a4bd293b0cd0858bc74476268671871cfa3c35bb03195f008416
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      data_0
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\GraphiteDawnCache\data_0
                      • Size 8KB
                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_1
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\GraphiteDawnCache\data_1
                      • Size 264KB
                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_2
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\GraphiteDawnCache\data_2
                      • Size 8KB
                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data_3
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\GraphiteDawnCache\data_3
                      • Size 8KB
                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Local State
                      • Size 2KB
                      • SHA256 d5b9b64fce61c820994c96815d9c1932f02b09adffe56d52fac0c92bf1add20f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Local State
                      • Size 3KB
                      • SHA256 f076ce49848b2c529204eea5acb9fc11039099d7d10b23f3309a284ca0542c4e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Local State
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Local State
                      • Size 15KB
                      • SHA256 7beb51a95200deea2ce6dbd07776f0cc6f8787392e68da25c95c70dac14549f4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Local State~RFe5a8251.TMP
                      • Path C:\Users\Admin\AppData\Local\net.ccbluex.liquidlauncher\EBWebView\Local State~RFe5a8251.TMP
                      • Size 1KB
                      • SHA256 99ce332a87d027e742c4cfe9493d071f42f29ba10d883f305e8c77d74708d1c9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ADDITIONAL_LICENSE_INFO
                      • Path C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_25\jdk-25.0.4.1+1-jre\legal\java.logging\ADDITIONAL_LICENSE_INFO
                      • Size 49B
                      • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                      • MD5 SHA1 SHA512
                      Submit Download

                      ASSEMBLY_EXCEPTION
                      • Path C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_25\jdk-25.0.4.1+1-jre\legal\java.logging\ASSEMBLY_EXCEPTION
                      • Size 44B
                      • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                      • MD5 SHA1 SHA512
                      Submit Download

                      LICENSE
                      • Path C:\Users\Admin\AppData\Roaming\CCBlueX\LiquidLauncher\data\runtimes\temurin_25\jdk-25.0.4.1+1-jre\legal\java.logging\LICENSE
                      • Size 33B
                      • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                      • MD5 SHA1 SHA512
                      Submit Download

                      default.exc
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                      • Size 2B
                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                      • MD5 SHA1 SHA512
                      Submit Download

                      2a2e0412b8ad04a2.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                      • Size 4KB
                      • SHA256 9d1a11d2896a840dc3b32f138ff53795f5c1cd90e8e11c78012c5d92fbc53e32
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      2a2e0412b8ad04a2.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                      • Size 4KB
                      • SHA256 9eba48f8e843709db15b04b663e999138cd22cd73ce1528be16bccb35e110a94
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5a41bd.msi
                      • Path C:\Windows\Installer\e5a41bd.msi
                      • Size 9.6MB
                      • SHA256 c9e08018574191c83413a66d709a439e34b9911b2964de219dce2d97a0ac7e72
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      metadata-2
                      • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                      • Size 26.1MB
                      • SHA256 278c7394a52d98f1f9cbebd0134e69021ff856160006ec8e3f24211e72e6839b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      {cf6e72d9-f84c-46b6-a11f-8105e351de47}_OnDiskSnapshotProp
                      • Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{cf6e72d9-f84c-46b6-a11f-8105e351de47}_OnDiskSnapshotProp
                      • Size 6KB
                      • SHA256 1c56076d51bf99dc966cc883fd3e357dae79ecb55ecfa3225500986312747652
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1472-226-0x0000023707E40000-0x0000023707E6F000-memory.dmp
                      Download

                      memory/1472-69-0x00007FFBD0120000-0x00007FFBD0121000-memory.dmp
                      Download

                      memory/3408-79-0x00007FFBD0120000-0x00007FFBD0121000-memory.dmp
                      Download