Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\loomDesktop\shell\open\command] '' = '"%LOCALAPPDATA%\Programs\Loom\Loom.exe" "%1"'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'electron.app.Loom' = '%LOCALAPPDATA%\Programs\Loom\Loom.exe --process-start-args "--loomHidden"'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /Fi "IMAGENAME eq Loom Helper"
- '<SYSTEM32>\taskkill.exe' /F /Fi "IMAGENAME eq Loom"
Injects code into
the following user processes:
- loom.exe
Modifies file system
Creates the following files
- %TEMP%\nsm61bf.tmp\system.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-utility-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\cmdmp3.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\concrt140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_1.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_2.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\msvcp140_codecvt_ids.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-util-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\ucrtbase.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vcruntime140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vcruntime140_1.dll
- %LOCALAPPDATA%\programs\loom\resources\elevate.exe
- %LOCALAPPDATA%\programs\loom\swiftshader\libegl.dll
- %LOCALAPPDATA%\programs\loom\swiftshader\libglesv2.dll
- %LOCALAPPDATA%\programs\loom\vk_swiftshader.dll
- %LOCALAPPDATA%\programs\loom\vulkan-1.dll
- %LOCALAPPDATA%\loom-updater\installer.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-string-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-time-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-stdio-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-runtime-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-process-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processthreads-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processthreads-l1-1-1.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-profile-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-rtlsupport-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-string-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-synch-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-synch-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-sysinfo-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\uninstall loom.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\vccorlib140.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-timezone-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-convert-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-environment-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-filesystem-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-heap-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-locale-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-math-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-multibyte-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-private-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-processenvironment-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-crt-conio-l1-1-0.dll
- %APPDATA%\loom\storage\current-recording-videoid.json.3727480439
- %APPDATA%\loom\storage\current_video_device.json.3406262554
- %HOMEPATH%\desktop\loom.lnk
- %APPDATA%\loom\cache\index
- %APPDATA%\loom\cache\data_0
- %APPDATA%\loom\cache\data_1
- %APPDATA%\loom\cache\data_2
- %APPDATA%\loom\cache\data_3
- %APPDATA%\loom\logs\renderer.log
- %APPDATA%\loom\b55ea5f5-b140-4bbb-ae53-5b4f5c1ef11f.tmp
- %APPDATA%\loom\0957f26f-2b53-404c-a0f1-421563ae4c6c.tmp
- %APPDATA%\microsoft\windows\start menu\programs\loom.lnk
- %APPDATA%\loom\cookies-journal
- %TEMP%\267fe5dd-e73c-4326-ada7-87fe998ae751.tmp.node
- %APPDATA%\loom\cache\f_000001
- %APPDATA%\loom\cache\f_000002
- %APPDATA%\loom\local storage\leveldb\000003.log
- %APPDATA%\loom\70374436-b9d8-416f-a3e6-4edf7aee4599.tmp
- %APPDATA%\loom\dictionaries\en-us-9-0.bdic
- %APPDATA%\loom\storage\current_audio_device.json.1273956831
- %APPDATA%\loom\cache\f_000003
- %APPDATA%\loom\gpucache\data_2
- %APPDATA%\loom\gpucache\data_3
- %APPDATA%\loom\gpucache\data_1
- %APPDATA%\loom\gpucache\data_0
- %APPDATA%\loom\gpucache\index
- %APPDATA%\loom\crashpad\settings.dat
- %APPDATA%\loom\sentry\scope_v2.json
- %APPDATA%\loom\fontlookuptablecache\font_unique_name_table.pb
- %APPDATA%\loom\storage\show_shortcut_reminder.json.2914100012
- %APPDATA%\loom\storage\app-unexpected-quit.json.3146142721
- %APPDATA%\loom\storage\current_video_device.json.285255333
- %APPDATA%\loom\storage\selected_audio_devices.json.2186886982
- %APPDATA%\loom\storage\selected_video_devices.json.1344270839
- %TEMP%\nsm61bf.tmp\winshell.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-namedpipe-l1-1-0.dll
- %APPDATA%\loom\storage\current_audio_device.json.1642451514
- %APPDATA%\loom\local storage\leveldb\manifest-000001
- %APPDATA%\loom\local storage\leveldb\000001.dbtmp
- %APPDATA%\loom\local storage\leveldb\log
- %APPDATA%\loom\code cache\js\index
- %APPDATA%\loom\code cache\wasm\index
- %APPDATA%\loom\code cache\js\index-dir\temp-index
- %APPDATA%\loom\code cache\wasm\index-dir\temp-index
- %APPDATA%\loom\storage\last-recording-event.json.2061545704
- %APPDATA%\loom\logs\main.log
- %TEMP%\ebfbcb82-3b96-433e-a45f-364f17c63311.tmp.ico
- %APPDATA%\loom\cookies
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-memory-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-datetime-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\locales\fi.pak
- %LOCALAPPDATA%\programs\loom\locales\fil.pak
- %LOCALAPPDATA%\programs\loom\locales\fr.pak
- %LOCALAPPDATA%\programs\loom\locales\gu.pak
- %LOCALAPPDATA%\programs\loom\locales\he.pak
- %LOCALAPPDATA%\programs\loom\locales\hi.pak
- %LOCALAPPDATA%\programs\loom\locales\hr.pak
- %LOCALAPPDATA%\programs\loom\locales\hu.pak
- %LOCALAPPDATA%\programs\loom\locales\am.pak
- %LOCALAPPDATA%\programs\loom\locales\id.pak
- %LOCALAPPDATA%\programs\loom\locales\ja.pak
- %LOCALAPPDATA%\programs\loom\locales\kn.pak
- %LOCALAPPDATA%\programs\loom\locales\ko.pak
- %LOCALAPPDATA%\programs\loom\locales\lt.pak
- %LOCALAPPDATA%\programs\loom\locales\lv.pak
- %LOCALAPPDATA%\programs\loom\locales\ml.pak
- %LOCALAPPDATA%\programs\loom\locales\mr.pak
- %LOCALAPPDATA%\programs\loom\locales\ms.pak
- %LOCALAPPDATA%\programs\loom\locales\et.pak
- %LOCALAPPDATA%\programs\loom\locales\fa.pak
- %LOCALAPPDATA%\programs\loom\locales\es.pak
- %LOCALAPPDATA%\programs\loom\locales\es-419.pak
- %LOCALAPPDATA%\programs\loom\locales\en-us.pak
- %TEMP%\nsm61bf.tmp\spiderbanner.dll
- %TEMP%\nsm61bf.tmp\nsprocess.dll
- %TEMP%\nsm61bf.tmp\app-64.7z
- %TEMP%\nsm61bf.tmp\nsis7z.dll
- %LOCALAPPDATA%\programs\loom\chrome_100_percent.pak
- %LOCALAPPDATA%\programs\loom\chrome_200_percent.pak
- %LOCALAPPDATA%\programs\loom\icudtl.dat
- %LOCALAPPDATA%\programs\loom\license.electron.txt
- %LOCALAPPDATA%\programs\loom\locales\nb.pak
- %LOCALAPPDATA%\programs\loom\locales\it.pak
- %LOCALAPPDATA%\programs\loom\licenses.chromium.html
- %LOCALAPPDATA%\programs\loom\locales\bg.pak
- %LOCALAPPDATA%\programs\loom\locales\bn.pak
- %LOCALAPPDATA%\programs\loom\locales\ca.pak
- %LOCALAPPDATA%\programs\loom\locales\cs.pak
- %LOCALAPPDATA%\programs\loom\locales\da.pak
- %LOCALAPPDATA%\programs\loom\locales\de.pak
- %LOCALAPPDATA%\programs\loom\locales\el.pak
- %LOCALAPPDATA%\programs\loom\locales\en-gb.pak
- %TEMP%\nsm61bf.tmp\stdutils.dll
- %LOCALAPPDATA%\programs\loom\locales\ar.pak
- %LOCALAPPDATA%\programs\loom\locales\th.pak
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-libraryloader-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\locales\pt-br.pak
- %LOCALAPPDATA%\programs\loom\v8_context_snapshot.bin
- %LOCALAPPDATA%\programs\loom\vk_swiftshader_icd.json
- %LOCALAPPDATA%\programs\loom\d3dcompiler_47.dll
- %LOCALAPPDATA%\programs\loom\ffmpeg.dll
- %LOCALAPPDATA%\programs\loom\libegl.dll
- %LOCALAPPDATA%\programs\loom\libglesv2.dll
- %LOCALAPPDATA%\programs\loom\loom.exe
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-console-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\locales\nl.pak
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-console-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-debug-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-errorhandling-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-file-l2-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-handle-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-heap-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-interlocked-l1-1-0.dll
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\start-recording.mp3
- %LOCALAPPDATA%\programs\loom\snapshot_blob.bin
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\screenshot-camera-shutter.mp3
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\end-recording.mp3
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\sounds\airhorn.mp3
- %LOCALAPPDATA%\programs\loom\locales\ro.pak
- %LOCALAPPDATA%\programs\loom\locales\ru.pak
- %LOCALAPPDATA%\programs\loom\locales\sk.pak
- %LOCALAPPDATA%\programs\loom\locales\sl.pak
- %LOCALAPPDATA%\programs\loom\locales\sr.pak
- %LOCALAPPDATA%\programs\loom\locales\sv.pak
- %LOCALAPPDATA%\programs\loom\locales\sw.pak
- %LOCALAPPDATA%\programs\loom\locales\ta.pak
- %LOCALAPPDATA%\programs\loom\locales\pl.pak
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\api-ms-win-core-localization-l1-2-0.dll
- %LOCALAPPDATA%\programs\loom\locales\te.pak
- %LOCALAPPDATA%\programs\loom\locales\uk.pak
- %LOCALAPPDATA%\programs\loom\locales\vi.pak
- %LOCALAPPDATA%\programs\loom\locales\zh-cn.pak
- %LOCALAPPDATA%\programs\loom\locales\zh-tw.pak
- %LOCALAPPDATA%\programs\loom\resources.pak
- %LOCALAPPDATA%\programs\loom\resources\app-update.yml
- %LOCALAPPDATA%\programs\loom\resources\app.asar
- %LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\assets\application-icons\app-logo.ico
- %LOCALAPPDATA%\programs\loom\locales\pt-pt.pak
- %LOCALAPPDATA%\programs\loom\locales\tr.pak
- %APPDATA%\loom\08bb1b2d-b1db-420f-b56c-6d585f21f699.tmp
Deletes the following files
- %TEMP%\nsm61bf.tmp\app-64.7z
- %TEMP%\nsm61bf.tmp\nsis7z.dll
- %TEMP%\nsm61bf.tmp\nsprocess.dll
- %TEMP%\nsm61bf.tmp\spiderbanner.dll
- %TEMP%\nsm61bf.tmp\stdutils.dll
- %TEMP%\nsm61bf.tmp\system.dll
- %TEMP%\nsm61bf.tmp\winshell.dll
- %APPDATA%\loom\preferences~rf13d799.tmp
- %APPDATA%\loom\transportsecurity~rf13f630.tmp
- %APPDATA%\loom\network persistent state~rf14b7ba.tmp
Moves the following files
- from %APPDATA%\loom\storage\app-unexpected-quit.json.3146142721 to %APPDATA%\loom\storage\app-unexpected-quit.json
- from %APPDATA%\loom\transportsecurity to %APPDATA%\loom\transportsecurity~rf13f630.tmp
- from %APPDATA%\loom\08bb1b2d-b1db-420f-b56c-6d585f21f699.tmp to %APPDATA%\loom\transportsecurity
- from %APPDATA%\loom\storage\current_video_device.json.3406262554 to %APPDATA%\loom\storage\current_video_device.json
- from %APPDATA%\loom\storage\current_audio_device.json.1273956831 to %APPDATA%\loom\storage\current_audio_device.json
- from %APPDATA%\loom\preferences to %APPDATA%\loom\preferences~rf13d799.tmp
- from %APPDATA%\loom\0957f26f-2b53-404c-a0f1-421563ae4c6c.tmp to %APPDATA%\loom\network persistent state
- from %APPDATA%\loom\b55ea5f5-b140-4bbb-ae53-5b4f5c1ef11f.tmp to %APPDATA%\loom\preferences
- from %APPDATA%\loom\storage\last-recording-event.json.2061545704 to %APPDATA%\loom\storage\last-recording-event.json
- from %APPDATA%\loom\storage\current_audio_device.json.1642451514 to %APPDATA%\loom\storage\current_audio_device.json
- from %APPDATA%\loom\storage\current-recording-videoid.json.3727480439 to %APPDATA%\loom\storage\current-recording-videoid.json
- from %APPDATA%\loom\code cache\wasm\index-dir\temp-index to %APPDATA%\loom\code cache\wasm\index-dir\the-real-index
- from %APPDATA%\loom\code cache\js\index-dir\temp-index to %APPDATA%\loom\code cache\js\index-dir\the-real-index
- from %APPDATA%\loom\local storage\leveldb\000001.dbtmp to %APPDATA%\loom\local storage\leveldb\current
- from %APPDATA%\loom\storage\selected_video_devices.json.1344270839 to %APPDATA%\loom\storage\selected_video_devices.json
- from %APPDATA%\loom\storage\selected_audio_devices.json.2186886982 to %APPDATA%\loom\storage\selected_audio_devices.json
- from %APPDATA%\loom\storage\current_video_device.json.285255333 to %APPDATA%\loom\storage\current_video_device.json
- from %APPDATA%\loom\storage\show_shortcut_reminder.json.2914100012 to %APPDATA%\loom\storage\show_shortcut_reminder.json
- from %APPDATA%\loom\transportsecurity to %APPDATA%\loom\transportsecurity~rf14a9b6.tmp
- from %APPDATA%\loom\network persistent state to %APPDATA%\loom\network persistent state~rf14b7ba.tmp
Substitutes the following files
- %APPDATA%\loom\preferences
Network activity
Connects to
- 'ht#######ke.logs.datadoghq.com':443
- 'r4######5hne6nsz.gvt1.com':443
- 'oo#####-x1.puregig.net':8080
- 'sp#####st-ams.retn.net':8080
- 'sp######t3.serverius.net':8080
- 'sp######t.hyperfilter.com':8080
- 'sp#####d.phoenixnap.com':8080
- 'ap#.#egment.io':443
- 're####ctor.gvt1.com':443
- 'lo##.com':443
- 'sp###test.net':443
- 'sp###test.net':80
- 'o3#####.ingest.sentry.io':443
- 'ca####e.apple.com':443
- 'ic###azip.com':443
- 'cd#.#egment.com':443
- 'go#####analytics.com':443
TCP
HTTP GET requests
- http://sp#######.hyperfilter.com:8080/speedtest/latency.txt via sp######t.hyperfilter.com
HTTP POST requests
- http://sp#######.hyperfilter.com:8080/speedtest/upload.php via sp######t.hyperfilter.com
Other
- 'ht#######ke.logs.datadoghq.com':443
- 'ic###azip.com':443
- 'ca####e.apple.com':443
- 'o3#####.ingest.sentry.io':443
- 'sp###test.net':443
- 'lo##.com':443
- 'cd#.#oom.com':443
- 're####ctor.gvt1.com':443
- 'cd#.#egment.com':443
- 'r4######5hne6nsz.gvt1.com':443
- 'go#####analytics.com':443
- 'ap#.#egment.io':443
UDP
- DNS ASK ht#######ke.logs.datadoghq.com
- DNS ASK r4######5hne6nsz.gvt1.com
- DNS ASK oo#####-x1.puregig.net
- DNS ASK sp#####st-ams.retn.net
- DNS ASK sp######t3.serverius.net
- DNS ASK sp#####d.phoenixnap.com
- DNS ASK sp######t.hyperfilter.com
- DNS ASK cd#.#oom.com
- DNS ASK lo##.com
- DNS ASK cd#.#egment.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK sp###test.net
- DNS ASK o3#####.ingest.sentry.io
- DNS ASK ca####e.apple.com
- DNS ASK ic###azip.com
- DNS ASK my##.#pendns.com
- DNS ASK ap#.#egment.io
- DNS ASK go#####analytics.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Loom'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\programs\loom\loom.exe'
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=gpu-process --field-trial-handle=952,12661963262623669262,7852825101916957714,131072 --enable-features=WebAssemblySimd,WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMus...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=crashpad-handler --user-data-dir=%APPDATA%\Loom /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=%APPDATA%\Loom\Crashpad --url=https://o398470.inge...
- '%LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe' "{\"type\":\"daemon-start\",\"payload\":{\"daemonOptions\":{\"secret\":\"edb5c4100b604c6ca4e8ef337fd3b69a\",\"pipePath\":\"\\\\.\\pipe\\loom_ipc_65037\"}}}"
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=952,12661963262623669262,7852825101916957714,131072 --enable-features=WebAssemblySimd,WebComponentsV0Enabled ...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=952,12661963262623669262,7852825101916957714,131072 --enable-features=WebAssemblySimd,WebComponentsV0Enabled --di...
- '%LOCALAPPDATA%\programs\loom\loom.exe' --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=952,12661963262623669262,7852825101916957714,131072 --enable-features=WebAssemblySimd,WebComponentsV0Enabled --di...
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom Helper""' (with hidden window)
- '%LOCALAPPDATA%\programs\loom\resources\app.asar.unpacked\dist\binaries\loom-recorder-production.exe' "{\"type\":\"daemon-start\",\"payload\":{\"daemonOptions\":{\"secret\":\"edb5c4100b604c6ca4e8ef337fd3b69a\",\"pipePath\":\"\\\\.\\pipe\\loom_ipc_65037\"}}}"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name"
- '<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom""
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill.exe /F /Fi "IMAGENAME eq Loom Helper""
